bsd/net/if_pflog.c

   1 /*
   2  * Copyright (c) 2008 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 /*      $apfw: if_pflog.c,v 1.4 2008/08/27 00:01:32 jhw Exp $           */
  30 /*      $OpenBSD: if_pflog.c,v 1.22 2006/12/15 09:31:20 otto Exp $      */
  31 /*
  32  * The authors of this code are John Ioannidis (ji@tla.org),
  33  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  34  * Niels Provos (provos@physnet.uni-hamburg.de).
  35  *
  36  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
  37  * in November 1995.
  38  *
  39  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  40  * by Angelos D. Keromytis.
  41  *
  42  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  43  * and Niels Provos.
  44  *
  45  * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
  46  * and Niels Provos.
  47  * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
  48  *
  49  * Permission to use, copy, and modify this software with or without fee
  50  * is hereby granted, provided that this entire notice is included in
  51  * all copies of any software which is or includes a copy or
  52  * modification of this software.
  53  * You may use this code under the GNU public license if you so wish. Please
  54  * contribute changes back to the authors under this freer than GPL license
  55  * so that we may further the use of strong encryption without limitations to
  56  * all.
  57  *
  58  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  59  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  60  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  61  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  62  * PURPOSE.
  63  */
  64
  65 #include <sys/param.h>
  66 #include <sys/systm.h>
  67 #include <sys/mbuf.h>
  68 #include <sys/proc_internal.h>
  69 #include <sys/socket.h>
  70 #include <sys/ioctl.h>
  71
  72 #include <net/if.h>
  73 #include <net/if_types.h>
  74 #include <net/route.h>
  75 #include <net/bpf.h>
  76
  77 #if INET
  78 #include <netinet/in.h>
  79 #include <netinet/in_var.h>
  80 #include <netinet/in_systm.h>
  81 #include <netinet/ip.h>
  82 #endif
  83
  84 #if INET6
  85 #if !INET
  86 #include <netinet/in.h>
  87 #endif
  88 #include <netinet6/nd6.h>
  89 #endif /* INET6 */
  90
  91 #include <net/pfvar.h>
  92 #include <net/if_pflog.h>
  93
  94 #define PFLOGNAME       "pflog"
  95 #define PFLOGMTU        (32768 + MHLEN + MLEN)
  96
  97 #ifdef PFLOGDEBUG
  98 #define DPRINTF(x)    do { if (pflogdebug) printf x ; } while (0)
  99 #else
 100 #define DPRINTF(x)
 101 #endif
 102
 103 static int pflog_create_dev(void);
 104 static errno_t pflogoutput(struct ifnet *, struct mbuf *);
 105 static errno_t pflogioctl(struct ifnet *, unsigned long, void *);
 106 static errno_t pflogdemux(struct ifnet *, struct mbuf *, char *,
 107     protocol_family_t *);
 108 static errno_t pflogaddproto(struct ifnet *, protocol_family_t,
 109     const struct ifnet_demux_desc *, u_int32_t);
 110 static errno_t pflogdelproto(struct ifnet *, protocol_family_t);
 111
 112 static LIST_HEAD(, pflog_softc) pflogif_list;
 113
 114 struct ifnet *pflogifs[PFLOGIFS_MAX];   /* for fast access */
 115 static int npflog;
 116 static lck_attr_t *pflog_lock_attr;
 117 static lck_grp_t *pflog_lock_grp;
 118 static lck_grp_attr_t *pflog_lock_grp_attr;
 119 static lck_mtx_t *pflog_lock;
 120
 121 void
 122 pfloginit(void)
 123 {
 124         int i;
 125
 126         if (pflog_lock != NULL)
 127                 return;
 128
 129         pflog_lock_grp_attr = lck_grp_attr_alloc_init();
 130         pflog_lock_grp = lck_grp_alloc_init("pflog", pflog_lock_grp_attr);
 131         pflog_lock_attr = lck_attr_alloc_init();
 132         pflog_lock = lck_mtx_alloc_init(pflog_lock_grp, pflog_lock_attr);
 133         if (pflog_lock == NULL) {
 134                 panic("%s: unable to allocate lock", __func__);
 135                 /* NOTREACHED */
 136         }
 137         LIST_INIT(&pflogif_list);
 138         for (i = 0; i < PFLOGIFS_MAX; i++)
 139                 pflogifs[i] = NULL;
 140
 141         pflog_create_dev();
 142 }
 143
 144 static int
 145 pflog_create_dev(void)
 146 {
 147         struct pflog_softc *pflogif;
 148         struct ifnet_init_params pf_init;
 149         int error = 0;
 150
 151         lck_mtx_lock(pflog_lock);
 152         if (npflog >= PFLOGIFS_MAX) {
 153                 error = EINVAL;
 154                 goto done;
 155         }
 156
 157         if ((pflogif = _MALLOC(sizeof (*pflogif),
 158             M_DEVBUF, M_WAITOK|M_ZERO)) == NULL) {
 159                 error = ENOMEM;
 160                 goto done;
 161         }
 162
 163         bzero(&pf_init, sizeof (pf_init));
 164         pf_init.name = PFLOGNAME;
 165         pf_init.unit = npflog;
 166         pf_init.type = IFT_PFLOG;
 167         pf_init.family = IFNET_FAMILY_LOOPBACK;
 168         pf_init.output = pflogoutput;
 169         pf_init.demux = pflogdemux;
 170         pf_init.add_proto = pflogaddproto;
 171         pf_init.del_proto = pflogdelproto;
 172         pf_init.softc = pflogif;
 173         pf_init.ioctl = pflogioctl;
 174
 175         bzero(pflogif, sizeof (*pflogif));
 176         pflogif->sc_unit = npflog;
 177
 178         error = ifnet_allocate(&pf_init, &pflogif->sc_if);
 179         if (error != 0) {
 180                 printf("%s: ifnet_allocate failed - %d\n", __func__, error);
 181                 _FREE(pflogif, M_DEVBUF);
 182                 goto done;
 183         }
 184
 185         ifnet_set_mtu(pflogif->sc_if, PFLOGMTU);
 186         ifnet_set_flags(pflogif->sc_if, IFF_UP, IFF_UP);
 187
 188         error = ifnet_attach(pflogif->sc_if, NULL);
 189         if (error != 0) {
 190                 printf("%s: ifnet_attach failed - %d\n", __func__, error);
 191                 ifnet_release(pflogif->sc_if);
 192                 _FREE(pflogif, M_DEVBUF);
 193                 goto done;
 194         }
 195
 196 #if NBPFILTER > 0
 197         bpfattach(pflogif->sc_if, DLT_PFLOG, PFLOG_HDRLEN);
 198 #endif
 199
 200         LIST_INSERT_HEAD(&pflogif_list, pflogif, sc_list);
 201         pflogifs[npflog] = pflogif->sc_if;
 202         ++npflog;
 203 done:
 204         lck_mtx_unlock(pflog_lock);
 205
 206         return (error);
 207 }
 208
 209 #if 0
 210 int
 211 pflog_destroy_dev(struct ifnet *ifp)
 212 {
 213         struct pflog_softc      *pflogif = ifp->if_softc;
 214
 215         lck_mtx_lock(pflog_lock);
 216         pflogifs[pflogif->sc_unit] = NULL;
 217         LIST_REMOVE(pflogif, sc_list);
 218         lck_mtx_unlock(pflog_lock);
 219
 220 #if NBPFILTER > 0
 221         bpfdetach(ifp);
 222 #endif
 223         if_detach(ifp);
 224         _FREE(pflogif, M_DEVBUF);
 225         return (0);
 226 }
 227 #endif
 228
 229 static errno_t
 230 pflogoutput(struct ifnet *ifp, struct mbuf *m)
 231 {
 232         printf("%s: freeing data for %s%d\n", __func__, ifp->if_name,
 233             ifp->if_unit);
 234         m_freem(m);
 235         return (ENOTSUP);
 236 }
 237
 238 static errno_t
 239 pflogioctl(struct ifnet *ifp, unsigned long cmd, void *data)
 240 {
 241 #pragma unused(data)
 242         switch (cmd) {
 243         case SIOCSIFADDR:
 244         case SIOCAIFADDR:
 245         case SIOCSIFDSTADDR:
 246         case SIOCSIFFLAGS:
 247                 if (ifnet_flags(ifp) & IFF_UP)
 248                         ifnet_set_flags(ifp, IFF_RUNNING, IFF_RUNNING);
 249                 else
 250                         ifnet_set_flags(ifp, 0, IFF_RUNNING);
 251                 break;
 252         default:
 253                 return (ENOTTY);
 254         }
 255
 256         return (0);
 257 }
 258
 259 static errno_t
 260 pflogdemux(struct ifnet *ifp, struct mbuf *m, char *h, protocol_family_t *ppf)
 261 {
 262 #pragma unused(h, ppf)
 263         printf("%s: freeing data for %s%d\n", __func__, ifp->if_name,
 264             ifp->if_unit);
 265         m_freem(m);
 266         return (EJUSTRETURN);
 267 }
 268
 269 static errno_t
 270 pflogaddproto(struct ifnet *ifp, protocol_family_t pf,
 271     const struct ifnet_demux_desc *d, u_int32_t cnt)
 272 {
 273 #pragma unused(ifp, pf, d, cnt)
 274         return (0);
 275 }
 276
 277 static errno_t
 278 pflogdelproto(struct ifnet *ifp, protocol_family_t pf)
 279 {
 280 #pragma unused(ifp, pf)
 281         return (0);
 282 }
 283
 284 int
 285 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
 286     u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
 287     struct pf_ruleset *ruleset, struct pf_pdesc *pd)
 288 {
 289 #if NBPFILTER > 0
 290         struct ifnet *ifn;
 291         struct pfloghdr hdr;
 292
 293         if (kif == NULL || m == NULL || rm == NULL || pd == NULL)
 294                 return (-1);
 295
 296         if (rm->logif >= PFLOGIFS_MAX ||
 297             (ifn = pflogifs[rm->logif]) == NULL || !ifn->if_bpf) {
 298                 return (0);
 299         }
 300
 301         bzero(&hdr, sizeof (hdr));
 302         hdr.length = PFLOG_REAL_HDRLEN;
 303         hdr.af = af;
 304         hdr.action = rm->action;
 305         hdr.reason = reason;
 306         memcpy(hdr.ifname, kif->pfik_name, sizeof (hdr.ifname));
 307
 308         if (am == NULL) {
 309                 hdr.rulenr = htonl(rm->nr);
 310                 hdr.subrulenr = -1;
 311         } else {
 312                 hdr.rulenr = htonl(am->nr);
 313                 hdr.subrulenr = htonl(rm->nr);
 314                 if (ruleset != NULL && ruleset->anchor != NULL)
 315                         strlcpy(hdr.ruleset, ruleset->anchor->name,
 316                             sizeof (hdr.ruleset));
 317         }
 318         if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done)
 319                 pd->lookup.done = pf_socket_lookup(dir, pd);
 320         if (pd->lookup.done > 0) {
 321                 hdr.uid = pd->lookup.uid;
 322                 hdr.pid = pd->lookup.pid;
 323         } else {
 324                 hdr.uid = UID_MAX;
 325                 hdr.pid = NO_PID;
 326         }
 327         hdr.rule_uid = rm->cuid;
 328         hdr.rule_pid = rm->cpid;
 329         hdr.dir = dir;
 330
 331 #if INET
 332         if (af == AF_INET && dir == PF_OUT) {
 333                 struct ip *ip;
 334
 335                 ip = mtod(m, struct ip *);
 336                 ip->ip_sum = 0;
 337                 ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
 338         }
 339 #endif /* INET */
 340
 341         ifn->if_opackets++;
 342         ifn->if_obytes += m->m_pkthdr.len;
 343
 344         switch (dir) {
 345         case PF_IN:
 346                 bpf_tap_in(ifn, DLT_PFLOG, m, &hdr, PFLOG_HDRLEN);
 347                 break;
 348
 349         case PF_OUT:
 350                 bpf_tap_out(ifn, DLT_PFLOG, m, &hdr, PFLOG_HDRLEN);
 351                 break;
 352
 353         default:
 354                 break;
 355         }
 356 #endif /* NBPFILTER > 0 */
 357         return (0);
 358 }