/*
* npfctl_table: add, remove or query entries in the specified table.
*
* For maximum performance, interface is avoiding proplib(3)'s overhead.
*/
int
npfctl_table(void *data)
{
const npf_ioctl_table_t *nct = data;
char tname[NPF_TABLE_MAXNAMELEN];
npf_tableset_t *ts;
npf_table_t *t;
int s, error;
error = copyinstr(nct->nct_name, tname, sizeof(tname), NULL);
if (error) {
return error;
}
s = npf_config_read_enter(); /* XXX */
ts = npf_config_tableset();
if ((t = npf_tableset_getbyname(ts, tname)) == NULL) {
npf_config_read_exit(s);
return EINVAL;
}
switch (nct->nct_cmd) {
case NPF_CMD_TABLE_LOOKUP:
error = npf_table_lookup(t, nct->nct_data.ent.alen,
&nct->nct_data.ent.addr);
break;
case NPF_CMD_TABLE_ADD:
error = npf_table_insert(t, nct->nct_data.ent.alen,
&nct->nct_data.ent.addr, nct->nct_data.ent.mask);
break;
case NPF_CMD_TABLE_REMOVE:
error = npf_table_remove(t, nct->nct_data.ent.alen,
&nct->nct_data.ent.addr, nct->nct_data.ent.mask);
break;
case NPF_CMD_TABLE_LIST:
error = npf_table_list(t, nct->nct_data.buf.buf,
nct->nct_data.buf.len);
break;
case NPF_CMD_TABLE_FLUSH:
error = npf_table_flush(t);
break;
default:
error = EINVAL;
break;
}
npf_config_read_exit(s);
return error;
}
/*
* npf_packet_handler: main packet handling routine for layer 3.
*
* Note: packet flow and inspection logic is in strict order.
*/
int
npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
{
nbuf_t nbuf;
npf_cache_t npc;
npf_session_t *se;
npf_rule_t *rl;
npf_rproc_t *rp;
int error, retfl;
int decision;
/*
* Initialise packet information cache.
* Note: it is enough to clear the info bits.
*/
KASSERT(ifp != NULL);
nbuf_init(&nbuf, *mp, ifp);
npc.npc_info = 0;
decision = NPF_DECISION_BLOCK;
error = 0;
retfl = 0;
rp = NULL;
/* Cache everything. Determine whether it is an IP fragment. */
if (npf_cache_all(&npc, &nbuf) & NPC_IPFRAG) {
/*
* Pass to IPv4 or IPv6 reassembly mechanism.
*/
error = npf_reassembly(&npc, &nbuf, mp);
if (error) {
se = NULL;
goto out;
}
if (*mp == NULL) {
/* More fragments should come; return. */
return 0;
}
}
/* Inspect the list of sessions (if found, acquires a reference). */
se = npf_session_inspect(&npc, &nbuf, di, &error);
/* If "passing" session found - skip the ruleset inspection. */
if (se && npf_session_pass(se, &rp)) {
npf_stats_inc(NPF_STAT_PASS_SESSION);
KASSERT(error == 0);
goto pass;
}
if (error) {
if (error == ENETUNREACH)
goto block;
goto out;
}
/* Acquire the lock, inspect the ruleset using this packet. */
int slock = npf_config_read_enter();
npf_ruleset_t *rlset = npf_config_ruleset();
rl = npf_ruleset_inspect(&npc, &nbuf, rlset, di, NPF_LAYER_3);
if (rl == NULL) {
const bool pass = npf_default_pass();
npf_config_read_exit(slock);
if (pass) {
npf_stats_inc(NPF_STAT_PASS_DEFAULT);
goto pass;
}
npf_stats_inc(NPF_STAT_BLOCK_DEFAULT);
goto block;
}
/*
* Get the rule procedure (acquires a reference) for association
* with a session (if any) and execution.
*/
KASSERT(rp == NULL);
rp = npf_rule_getrproc(rl);
/* Conclude with the rule and release the lock. */
error = npf_rule_conclude(rl, &retfl);
npf_config_read_exit(slock);
if (error) {
npf_stats_inc(NPF_STAT_BLOCK_RULESET);
goto block;
}
npf_stats_inc(NPF_STAT_PASS_RULESET);
/*
* Establish a "pass" session, if required. Just proceed,
* if session creation fails (e.g. due to unsupported protocol).
*/
if ((retfl & NPF_RULE_STATEFUL) != 0 && !se) {
se = npf_session_establish(&npc, &nbuf, di,
(retfl & NPF_RULE_MULTIENDS) == 0);
if (se) {
/*
* Note: the reference on the rule procedure is
* transfered to the session. It will be released
* on session destruction.
*/
npf_session_setpass(se, rp);
}
}
pass:
decision = NPF_DECISION_PASS;
KASSERT(error == 0);
/*
* Perform NAT.
*/
error = npf_do_nat(&npc, se, &nbuf, di);
block:
/*
* Execute the rule procedure, if any is associated.
* It may reverse the decision from pass to block.
*/
if (rp && !npf_rproc_run(&npc, &nbuf, rp, &decision)) {
if (se) {
npf_session_release(se);
}
npf_rproc_release(rp);
*mp = NULL;
return 0;
}
out:
/*
* Release the reference on a session. Release the reference on a
* rule procedure only if there was no association.
*/
if (se) {
npf_session_release(se);
} else if (rp) {
npf_rproc_release(rp);
}
/* Reset mbuf pointer before returning to the caller. */
if ((*mp = nbuf_head_mbuf(&nbuf)) == NULL) {
return error ? error : ENOMEM;
}
/* Pass the packet if decided and there is no error. */
if (decision == NPF_DECISION_PASS && !error) {
/*
* XXX: Disable for now, it will be set accordingly later,
* for optimisations (to reduce inspection).
*/
(*mp)->m_flags &= ~M_CANFASTFWD;
return 0;
}
/*
* Block the packet. ENETUNREACH is used to indicate blocking.
* Depending on the flags and protocol, return TCP reset (RST) or
* ICMP destination unreachable.
*/
if (retfl && npf_return_block(&npc, &nbuf, retfl)) {
*mp = NULL;
}
if (!error) {
error = ENETUNREACH;
}
if (*mp) {
m_freem(*mp);
*mp = NULL;
}
return error;
}
