/* * npfctl_table: add, remove or query entries in the specified table. * * For maximum performance, interface is avoiding proplib(3)'s overhead. */ int npfctl_table(void *data) { const npf_ioctl_table_t *nct = data; char tname[NPF_TABLE_MAXNAMELEN]; npf_tableset_t *ts; npf_table_t *t; int s, error; error = copyinstr(nct->nct_name, tname, sizeof(tname), NULL); if (error) { return error; } s = npf_config_read_enter(); /* XXX */ ts = npf_config_tableset(); if ((t = npf_tableset_getbyname(ts, tname)) == NULL) { npf_config_read_exit(s); return EINVAL; } switch (nct->nct_cmd) { case NPF_CMD_TABLE_LOOKUP: error = npf_table_lookup(t, nct->nct_data.ent.alen, &nct->nct_data.ent.addr); break; case NPF_CMD_TABLE_ADD: error = npf_table_insert(t, nct->nct_data.ent.alen, &nct->nct_data.ent.addr, nct->nct_data.ent.mask); break; case NPF_CMD_TABLE_REMOVE: error = npf_table_remove(t, nct->nct_data.ent.alen, &nct->nct_data.ent.addr, nct->nct_data.ent.mask); break; case NPF_CMD_TABLE_LIST: error = npf_table_list(t, nct->nct_data.buf.buf, nct->nct_data.buf.len); break; case NPF_CMD_TABLE_FLUSH: error = npf_table_flush(t); break; default: error = EINVAL; break; } npf_config_read_exit(s); return error; }
/* * npf_packet_handler: main packet handling routine for layer 3. * * Note: packet flow and inspection logic is in strict order. */ int npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) { nbuf_t nbuf; npf_cache_t npc; npf_session_t *se; npf_rule_t *rl; npf_rproc_t *rp; int error, retfl; int decision; /* * Initialise packet information cache. * Note: it is enough to clear the info bits. */ KASSERT(ifp != NULL); nbuf_init(&nbuf, *mp, ifp); npc.npc_info = 0; decision = NPF_DECISION_BLOCK; error = 0; retfl = 0; rp = NULL; /* Cache everything. Determine whether it is an IP fragment. */ if (npf_cache_all(&npc, &nbuf) & NPC_IPFRAG) { /* * Pass to IPv4 or IPv6 reassembly mechanism. */ error = npf_reassembly(&npc, &nbuf, mp); if (error) { se = NULL; goto out; } if (*mp == NULL) { /* More fragments should come; return. */ return 0; } } /* Inspect the list of sessions (if found, acquires a reference). */ se = npf_session_inspect(&npc, &nbuf, di, &error); /* If "passing" session found - skip the ruleset inspection. */ if (se && npf_session_pass(se, &rp)) { npf_stats_inc(NPF_STAT_PASS_SESSION); KASSERT(error == 0); goto pass; } if (error) { if (error == ENETUNREACH) goto block; goto out; } /* Acquire the lock, inspect the ruleset using this packet. */ int slock = npf_config_read_enter(); npf_ruleset_t *rlset = npf_config_ruleset(); rl = npf_ruleset_inspect(&npc, &nbuf, rlset, di, NPF_LAYER_3); if (rl == NULL) { const bool pass = npf_default_pass(); npf_config_read_exit(slock); if (pass) { npf_stats_inc(NPF_STAT_PASS_DEFAULT); goto pass; } npf_stats_inc(NPF_STAT_BLOCK_DEFAULT); goto block; } /* * Get the rule procedure (acquires a reference) for association * with a session (if any) and execution. */ KASSERT(rp == NULL); rp = npf_rule_getrproc(rl); /* Conclude with the rule and release the lock. */ error = npf_rule_conclude(rl, &retfl); npf_config_read_exit(slock); if (error) { npf_stats_inc(NPF_STAT_BLOCK_RULESET); goto block; } npf_stats_inc(NPF_STAT_PASS_RULESET); /* * Establish a "pass" session, if required. Just proceed, * if session creation fails (e.g. due to unsupported protocol). */ if ((retfl & NPF_RULE_STATEFUL) != 0 && !se) { se = npf_session_establish(&npc, &nbuf, di, (retfl & NPF_RULE_MULTIENDS) == 0); if (se) { /* * Note: the reference on the rule procedure is * transfered to the session. It will be released * on session destruction. */ npf_session_setpass(se, rp); } } pass: decision = NPF_DECISION_PASS; KASSERT(error == 0); /* * Perform NAT. */ error = npf_do_nat(&npc, se, &nbuf, di); block: /* * Execute the rule procedure, if any is associated. * It may reverse the decision from pass to block. */ if (rp && !npf_rproc_run(&npc, &nbuf, rp, &decision)) { if (se) { npf_session_release(se); } npf_rproc_release(rp); *mp = NULL; return 0; } out: /* * Release the reference on a session. Release the reference on a * rule procedure only if there was no association. */ if (se) { npf_session_release(se); } else if (rp) { npf_rproc_release(rp); } /* Reset mbuf pointer before returning to the caller. */ if ((*mp = nbuf_head_mbuf(&nbuf)) == NULL) { return error ? error : ENOMEM; } /* Pass the packet if decided and there is no error. */ if (decision == NPF_DECISION_PASS && !error) { /* * XXX: Disable for now, it will be set accordingly later, * for optimisations (to reduce inspection). */ (*mp)->m_flags &= ~M_CANFASTFWD; return 0; } /* * Block the packet. ENETUNREACH is used to indicate blocking. * Depending on the flags and protocol, return TCP reset (RST) or * ICMP destination unreachable. */ if (retfl && npf_return_block(&npc, &nbuf, retfl)) { *mp = NULL; } if (!error) { error = ENETUNREACH; } if (*mp) { m_freem(*mp); *mp = NULL; } return error; }