static bool npf_log(npf_cache_t *npc, nbuf_t *nbuf, void *meta, int *decision) { struct mbuf *m = nbuf_head_mbuf(nbuf); const npf_ext_log_t *log = meta; ifnet_t *ifp; int family; /* Set the address family. */ if (npf_iscached(npc, NPC_IP4)) { family = AF_INET; } else if (npf_iscached(npc, NPC_IP6)) { family = AF_INET6; } else { family = AF_UNSPEC; } KERNEL_LOCK(1, NULL); /* Find a pseudo-interface to log. */ ifp = if_byindex(log->if_idx); if (ifp == NULL) { /* No interface. */ KERNEL_UNLOCK_ONE(NULL); return true; } /* Pass through BPF. */ ifp->if_opackets++; ifp->if_obytes += m->m_pkthdr.len; bpf_mtap_af(ifp, family, m); KERNEL_UNLOCK_ONE(NULL); return true; }
/* * npfa_icmp_match: ALG matching inspector - determines ALG case and * associates ALG with NAT entry. */ static bool npfa_icmp_match(npf_cache_t *npc, nbuf_t *nbuf, void *ntptr) { const int proto = npf_cache_ipproto(npc); struct ip *ip = &npc->npc_ip.v4; in_port_t dport; KASSERT(npf_iscached(npc, NPC_IP46)); KASSERT(npf_iscached(npc, NPC_LAYER4)); /* Check for low TTL. */ if (ip->ip_ttl > TR_MAX_TTL) { return false; } if (proto == IPPROTO_TCP) { struct tcphdr *th = &npc->npc_l4.tcp; dport = ntohs(th->th_dport); } else if (proto == IPPROTO_UDP) { struct udphdr *uh = &npc->npc_l4.udp; dport = ntohs(uh->uh_dport); } else { return false; } /* Handle TCP/UDP traceroute - check for port range. */ if (dport < TR_BASE_PORT || dport > TR_PORT_RANGE) { return false; } /* Associate ALG with translation entry. */ npf_nat_t *nt = ntptr; npf_nat_setalg(nt, alg_icmp, 0); return true; }
/* * npf_return_tcp: return a TCP reset (RST) packet. */ static int npf_return_tcp(npf_cache_t *npc) { struct mbuf *m; struct ip *ip = NULL; struct ip6_hdr *ip6 = NULL; struct tcphdr *oth, *th; tcp_seq seq, ack; int tcpdlen, len; uint32_t win; /* Fetch relevant data. */ KASSERT(npf_iscached(npc, NPC_IP46)); KASSERT(npf_iscached(npc, NPC_LAYER4)); tcpdlen = npf_tcpsaw(npc, &seq, &ack, &win); oth = npc->npc_l4.tcp; if (oth->th_flags & TH_RST) { return 0; } /* Create and setup a network buffer. */ if (npf_iscached(npc, NPC_IP4)) { len = sizeof(struct ip) + sizeof(struct tcphdr); } else if (npf_iscached(npc, NPC_IP6)) { len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr); } else { return EINVAL; } m = m_gethdr(M_DONTWAIT, MT_HEADER); if (m == NULL) { return ENOMEM; } m->m_data += max_linkhdr; m->m_len = len; m->m_pkthdr.len = len; if (npf_iscached(npc, NPC_IP4)) { struct ip *oip = npc->npc_ip.v4; ip = mtod(m, struct ip *); memset(ip, 0, len); /* * First, partially fill IPv4 header for TCP checksum. * Note: IP length contains TCP header length. */ ip->ip_p = IPPROTO_TCP; ip->ip_src.s_addr = oip->ip_dst.s_addr; ip->ip_dst.s_addr = oip->ip_src.s_addr; ip->ip_len = htons(sizeof(struct tcphdr)); th = (struct tcphdr *)(ip + 1); } else {
static int npf_reassembly(npf_t *npf, npf_cache_t *npc, struct mbuf **mp) { nbuf_t *nbuf = npc->npc_nbuf; int error = EINVAL; /* Reset the mbuf as it may have changed. */ *mp = nbuf_head_mbuf(nbuf); nbuf_reset(nbuf); if (npf_iscached(npc, NPC_IP4)) { struct ip *ip = nbuf_dataptr(nbuf); error = ip_reass_packet(mp, ip); } else if (npf_iscached(npc, NPC_IP6)) { /* * Note: ip6_reass_packet() offset is the start of * the fragment header. */ error = ip6_reass_packet(mp, npc->npc_hlen); if (error && *mp == NULL) { memset(nbuf, 0, sizeof(nbuf_t)); } } if (error) { npf_stats_inc(npf, NPF_STAT_REASSFAIL); return error; } if (*mp == NULL) { /* More fragments should come. */ npf_stats_inc(npf, NPF_STAT_FRAGMENTS); return 0; } /* * Reassembly is complete, we have the final packet. * Cache again, since layer 4 data is accessible now. */ nbuf_init(npf, nbuf, *mp, nbuf->nb_ifp); npc->npc_info = 0; if (npf_cache_all(npc) & NPC_IPFRAG) { return EINVAL; } npf_stats_inc(npf, NPF_STAT_REASSEMBLY); return 0; }
/* * npfa_icmp_session: ALG session inspector, returns unique identifiers. */ static bool npfa_icmp_session(npf_cache_t *npc, nbuf_t *nbuf, void *keyptr) { npf_cache_t *key = keyptr; bool ret; KASSERT(key->npc_info == 0); /* IP + ICMP? Get unique identifiers from ICMP packet. */ if (!npf_iscached(npc, NPC_IP4)) { return false; } if (npf_cache_ipproto(npc) != IPPROTO_ICMP) { return false; } KASSERT(npf_iscached(npc, NPC_ICMP)); /* Advance to ICMP header. */ void *n_ptr = nbuf_dataptr(nbuf); const u_int hlen = npf_cache_hlen(npc); if ((n_ptr = nbuf_advance(&nbuf, n_ptr, hlen)) == NULL) { return false; } /* * Fetch relevant data into the separate ("key") cache. */ struct icmp *ic = &npc->npc_l4.icmp; if (npf_iscached(npc, NPC_IP4)) { ret = npf_icmp4_uniqid(ic->icmp_type, key, nbuf, n_ptr); } else if (npf_iscached(npc, NPC_IP6)) { KASSERT(offsetof(struct icmp, icmp_id) == offsetof(struct icmp6_hdr, icmp6_id)); ret = npf_icmp6_uniqid(ic->icmp_type, key, nbuf, n_ptr); } else {
/* * npf_packet_handler: main packet handling routine for layer 3. * * Note: packet flow and inspection logic is in strict order. */ int npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) { nbuf_t *nbuf = *mp; npf_cache_t npc; npf_session_t *se; npf_ruleset_t *rlset; npf_rule_t *rl; npf_rproc_t *rp; int error, retfl; int decision; /* * Initialise packet information cache. * Note: it is enough to clear the info bits. */ npc.npc_info = 0; decision = NPF_DECISION_BLOCK; error = 0; retfl = 0; rp = NULL; /* Cache everything. Determine whether it is an IP fragment. */ if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) { /* * Pass to IPv4 or IPv6 reassembly mechanism. */ error = EINVAL; if (npf_iscached(&npc, NPC_IP4)) { struct ip *ip = nbuf_dataptr(*mp); error = ip_reass_packet(mp, ip); } else if (npf_iscached(&npc, NPC_IP6)) { #ifdef INET6 /* * Note: ip6_reass_packet() offset is the start of * the fragment header. */ const u_int hlen = npf_cache_hlen(&npc); error = ip6_reass_packet(mp, hlen); #endif } if (error) { npf_stats_inc(NPF_STAT_REASSFAIL); se = NULL; goto out; } if (*mp == NULL) { /* More fragments should come; return. */ npf_stats_inc(NPF_STAT_FRAGMENTS); return 0; } /* * Reassembly is complete, we have the final packet. * Cache again, since layer 4 data is accessible now. */ nbuf = (nbuf_t *)*mp; npc.npc_info = 0; if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) { se = NULL; goto out; } npf_stats_inc(NPF_STAT_REASSEMBLY); } /* Inspect the list of sessions. */ se = npf_session_inspect(&npc, nbuf, ifp, di, &error); /* If "passing" session found - skip the ruleset inspection. */ if (se && npf_session_pass(se, &rp)) { npf_stats_inc(NPF_STAT_PASS_SESSION); KASSERT(error == 0); goto pass; } if (error) { goto block; } /* Acquire the lock, inspect the ruleset using this packet. */ npf_core_enter(); rlset = npf_core_ruleset(); rl = npf_ruleset_inspect(&npc, nbuf, rlset, ifp, di, NPF_LAYER_3); if (rl == NULL) { bool default_pass = npf_default_pass(); npf_core_exit(); if (default_pass) { npf_stats_inc(NPF_STAT_PASS_DEFAULT); goto pass; } npf_stats_inc(NPF_STAT_BLOCK_DEFAULT); goto block; } /* * Get the rule procedure (acquires a reference) for assocation * with a session (if any) and execution. */ KASSERT(rp == NULL); rp = npf_rule_getrproc(rl); /* Apply the rule, release the lock. */ error = npf_rule_apply(&npc, nbuf, rl, &retfl); if (error) { npf_stats_inc(NPF_STAT_BLOCK_RULESET); goto block; } npf_stats_inc(NPF_STAT_PASS_RULESET); /* * Establish a "pass" session, if required. Just proceed, if session * creation fails (e.g. due to unsupported protocol). * * Note: the reference on the rule procedure is transfered to the * session. It will be released on session destruction. */ if ((retfl & NPF_RULE_STATEFUL) != 0 && !se) { se = npf_session_establish(&npc, nbuf, ifp, di); if (se) { npf_session_setpass(se, rp); } } pass: decision = NPF_DECISION_PASS; KASSERT(error == 0); /* * Perform NAT. */ error = npf_do_nat(&npc, se, nbuf, ifp, di); block: /* * Execute the rule procedure, if any is associated. * It may reverse the decision from pass to block. */ if (rp) { npf_rproc_run(&npc, nbuf, rp, &decision); } out: /* * Release the reference on a session. Release the reference on a * rule procedure only if there was no association. */ if (se) { npf_session_release(se); } else if (rp) { npf_rproc_release(rp); } /* Pass the packet if decided and there is no error. */ if (decision == NPF_DECISION_PASS && !error) { /* * XXX: Disable for now, it will be set accordingly later, * for optimisations (to reduce inspection). */ (*mp)->m_flags &= ~M_CANFASTFWD; return 0; } /* * Block the packet. ENETUNREACH is used to indicate blocking. * Depending on the flags and protocol, return TCP reset (RST) or * ICMP destination unreachable. */ if (retfl && npf_return_block(&npc, nbuf, retfl)) { *mp = NULL; } if (!error) { error = ENETUNREACH; } if (*mp) { m_freem(*mp); *mp = NULL; } return error; }