Annotation of sys/net/if_pflog.c, Revision 1.1.1.1
1.1 nbrk 1: /* $OpenBSD: if_pflog.c,v 1.24 2007/05/26 17:13:30 jason Exp $ */
2: /*
3: * The authors of this code are John Ioannidis (ji@tla.org),
4: * Angelos D. Keromytis (kermit@csd.uch.gr) and
5: * Niels Provos (provos@physnet.uni-hamburg.de).
6: *
7: * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
8: * in November 1995.
9: *
10: * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
11: * by Angelos D. Keromytis.
12: *
13: * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
14: * and Niels Provos.
15: *
16: * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
17: * and Niels Provos.
18: * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
19: *
20: * Permission to use, copy, and modify this software with or without fee
21: * is hereby granted, provided that this entire notice is included in
22: * all copies of any software which is or includes a copy or
23: * modification of this software.
24: * You may use this code under the GNU public license if you so wish. Please
25: * contribute changes back to the authors under this freer than GPL license
26: * so that we may further the use of strong encryption without limitations to
27: * all.
28: *
29: * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
30: * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
31: * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
32: * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
33: * PURPOSE.
34: */
35:
36: #include "bpfilter.h"
37: #include "pflog.h"
38:
39: #include <sys/param.h>
40: #include <sys/systm.h>
41: #include <sys/mbuf.h>
42: #include <sys/proc.h>
43: #include <sys/socket.h>
44: #include <sys/ioctl.h>
45:
46: #include <net/if.h>
47: #include <net/if_types.h>
48: #include <net/route.h>
49: #include <net/bpf.h>
50:
51: #ifdef INET
52: #include <netinet/in.h>
53: #include <netinet/in_var.h>
54: #include <netinet/in_systm.h>
55: #include <netinet/ip.h>
56: #endif
57:
58: #ifdef INET6
59: #ifndef INET
60: #include <netinet/in.h>
61: #endif
62: #include <netinet6/nd6.h>
63: #endif /* INET6 */
64:
65: #include <net/pfvar.h>
66: #include <net/if_pflog.h>
67:
68: #define PFLOGMTU (32768 + MHLEN + MLEN)
69:
70: #ifdef PFLOGDEBUG
71: #define DPRINTF(x) do { if (pflogdebug) printf x ; } while (0)
72: #else
73: #define DPRINTF(x)
74: #endif
75:
76: void pflogattach(int);
77: int pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
78: struct rtentry *);
79: int pflogioctl(struct ifnet *, u_long, caddr_t);
80: void pflogstart(struct ifnet *);
81: int pflog_clone_create(struct if_clone *, int);
82: int pflog_clone_destroy(struct ifnet *);
83:
84: LIST_HEAD(, pflog_softc) pflogif_list;
85: struct if_clone pflog_cloner =
86: IF_CLONE_INITIALIZER("pflog", pflog_clone_create, pflog_clone_destroy);
87:
88: struct ifnet *pflogifs[PFLOGIFS_MAX]; /* for fast access */
89:
90: void
91: pflogattach(int npflog)
92: {
93: int i;
94: LIST_INIT(&pflogif_list);
95: for (i = 0; i < PFLOGIFS_MAX; i++)
96: pflogifs[i] = NULL;
97: if_clone_attach(&pflog_cloner);
98: }
99:
100: int
101: pflog_clone_create(struct if_clone *ifc, int unit)
102: {
103: struct ifnet *ifp;
104: struct pflog_softc *pflogif;
105: int s;
106:
107: if (unit >= PFLOGIFS_MAX)
108: return (EINVAL);
109:
110: if ((pflogif = malloc(sizeof(*pflogif), M_DEVBUF, M_NOWAIT)) == NULL)
111: return (ENOMEM);
112: bzero(pflogif, sizeof(*pflogif));
113:
114: pflogif->sc_unit = unit;
115: ifp = &pflogif->sc_if;
116: snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", unit);
117: ifp->if_softc = pflogif;
118: ifp->if_mtu = PFLOGMTU;
119: ifp->if_ioctl = pflogioctl;
120: ifp->if_output = pflogoutput;
121: ifp->if_start = pflogstart;
122: ifp->if_type = IFT_PFLOG;
123: ifp->if_snd.ifq_maxlen = ifqmaxlen;
124: ifp->if_hdrlen = PFLOG_HDRLEN;
125: if_attach(ifp);
126: if_alloc_sadl(ifp);
127:
128: #if NBPFILTER > 0
129: bpfattach(&pflogif->sc_if.if_bpf, ifp, DLT_PFLOG, PFLOG_HDRLEN);
130: #endif
131:
132: s = splnet();
133: LIST_INSERT_HEAD(&pflogif_list, pflogif, sc_list);
134: pflogifs[unit] = ifp;
135: splx(s);
136:
137: return (0);
138: }
139:
140: int
141: pflog_clone_destroy(struct ifnet *ifp)
142: {
143: struct pflog_softc *pflogif = ifp->if_softc;
144: int s;
145:
146: s = splnet();
147: pflogifs[pflogif->sc_unit] = NULL;
148: LIST_REMOVE(pflogif, sc_list);
149: splx(s);
150:
151: #if NBPFILTER > 0
152: bpfdetach(ifp);
153: #endif
154: if_detach(ifp);
155: free(pflogif, M_DEVBUF);
156: return (0);
157: }
158:
159: /*
160: * Start output on the pflog interface.
161: */
162: void
163: pflogstart(struct ifnet *ifp)
164: {
165: struct mbuf *m;
166: int s;
167:
168: for (;;) {
169: s = splnet();
170: IF_DROP(&ifp->if_snd);
171: IF_DEQUEUE(&ifp->if_snd, m);
172: splx(s);
173:
174: if (m == NULL)
175: return;
176: else
177: m_freem(m);
178: }
179: }
180:
181: int
182: pflogoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
183: struct rtentry *rt)
184: {
185: m_freem(m);
186: return (0);
187: }
188:
189: /* ARGSUSED */
190: int
191: pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
192: {
193: switch (cmd) {
194: case SIOCSIFADDR:
195: case SIOCAIFADDR:
196: case SIOCSIFDSTADDR:
197: case SIOCSIFFLAGS:
198: if (ifp->if_flags & IFF_UP)
199: ifp->if_flags |= IFF_RUNNING;
200: else
201: ifp->if_flags &= ~IFF_RUNNING;
202: break;
203: default:
204: return (EINVAL);
205: }
206:
207: return (0);
208: }
209:
210: int
211: pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
212: u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
213: struct pf_ruleset *ruleset, struct pf_pdesc *pd)
214: {
215: #if NBPFILTER > 0
216: struct ifnet *ifn;
217: struct pfloghdr hdr;
218:
219: if (kif == NULL || m == NULL || rm == NULL || pd == NULL)
220: return (-1);
221:
222: if ((ifn = pflogifs[rm->logif]) == NULL || !ifn->if_bpf)
223: return (0);
224:
225: bzero(&hdr, sizeof(hdr));
226: hdr.length = PFLOG_REAL_HDRLEN;
227: hdr.af = af;
228: hdr.action = rm->action;
229: hdr.reason = reason;
230: memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
231:
232: if (am == NULL) {
233: hdr.rulenr = htonl(rm->nr);
234: hdr.subrulenr = -1;
235: } else {
236: hdr.rulenr = htonl(am->nr);
237: hdr.subrulenr = htonl(rm->nr);
238: if (ruleset != NULL && ruleset->anchor != NULL)
239: strlcpy(hdr.ruleset, ruleset->anchor->name,
240: sizeof(hdr.ruleset));
241: }
242: if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done)
243: pd->lookup.done = pf_socket_lookup(dir, pd);
244: if (pd->lookup.done > 0) {
245: hdr.uid = pd->lookup.uid;
246: hdr.pid = pd->lookup.pid;
247: } else {
248: hdr.uid = UID_MAX;
249: hdr.pid = NO_PID;
250: }
251: hdr.rule_uid = rm->cuid;
252: hdr.rule_pid = rm->cpid;
253: hdr.dir = dir;
254:
255: #ifdef INET
256: if (af == AF_INET && dir == PF_OUT) {
257: struct ip *ip;
258:
259: ip = mtod(m, struct ip *);
260: ip->ip_sum = 0;
261: ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
262: }
263: #endif /* INET */
264:
265: ifn->if_opackets++;
266: ifn->if_obytes += m->m_pkthdr.len;
267: bpf_mtap_hdr(ifn->if_bpf, (char *)&hdr, PFLOG_HDRLEN, m,
268: BPF_DIRECTION_OUT);
269: #endif
270:
271: return (0);
272: }
CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to if_pflog.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net