int
npfctl_remove_rule(u_long cmd, void *data)
{
struct plistref *pref = data;
prop_dictionary_t dict, errdict;
prop_object_t obj;
const char *name;
int error, numrules;
/* Retrieve and construct the rule. */
error = prop_dictionary_copyin_ioctl(pref, cmd, &dict);
if (error) {
return error;
}
/* Dictionary for error reporting. */
errdict = prop_dictionary_create();
obj = prop_dictionary_get(dict, "name");
name = prop_string_cstring_nocopy(obj);
npf_rule_t *rl;
error = npf_mk_singlerule(dict, prop_array_create(), &rl, errdict);
npf_core_enter();
numrules = npf_named_ruleset_remove(name, npf_core_ruleset(), rl);
npf_core_exit();
prop_object_release(dict);
/* Error report. */
prop_dictionary_set_int32(errdict, "errno", error);
prop_dictionary_set_int32(errdict, "numrules", numrules);
prop_dictionary_copyout_ioctl(pref, cmd, errdict);
prop_object_release(errdict);
return error;
}
/*
* npf_packet_handler: main packet handling routine for layer 3.
*
* Note: packet flow and inspection logic is in strict order.
*/
int
npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
{
nbuf_t *nbuf = *mp;
npf_cache_t npc;
npf_session_t *se;
npf_ruleset_t *rlset;
npf_rule_t *rl;
npf_rproc_t *rp;
int error, retfl;
int decision;
/*
* Initialise packet information cache.
* Note: it is enough to clear the info bits.
*/
npc.npc_info = 0;
decision = NPF_DECISION_BLOCK;
error = 0;
retfl = 0;
rp = NULL;
/* Cache everything. Determine whether it is an IP fragment. */
if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) {
/*
* Pass to IPv4 or IPv6 reassembly mechanism.
*/
error = EINVAL;
if (npf_iscached(&npc, NPC_IP4)) {
struct ip *ip = nbuf_dataptr(*mp);
error = ip_reass_packet(mp, ip);
} else if (npf_iscached(&npc, NPC_IP6)) {
#ifdef INET6
/*
* Note: ip6_reass_packet() offset is the start of
* the fragment header.
*/
const u_int hlen = npf_cache_hlen(&npc);
error = ip6_reass_packet(mp, hlen);
#endif
}
if (error) {
npf_stats_inc(NPF_STAT_REASSFAIL);
se = NULL;
goto out;
}
if (*mp == NULL) {
/* More fragments should come; return. */
npf_stats_inc(NPF_STAT_FRAGMENTS);
return 0;
}
/*
* Reassembly is complete, we have the final packet.
* Cache again, since layer 4 data is accessible now.
*/
nbuf = (nbuf_t *)*mp;
npc.npc_info = 0;
if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) {
se = NULL;
goto out;
}
npf_stats_inc(NPF_STAT_REASSEMBLY);
}
/* Inspect the list of sessions. */
se = npf_session_inspect(&npc, nbuf, ifp, di, &error);
/* If "passing" session found - skip the ruleset inspection. */
if (se && npf_session_pass(se, &rp)) {
npf_stats_inc(NPF_STAT_PASS_SESSION);
KASSERT(error == 0);
goto pass;
}
if (error) {
goto block;
}
/* Acquire the lock, inspect the ruleset using this packet. */
npf_core_enter();
rlset = npf_core_ruleset();
rl = npf_ruleset_inspect(&npc, nbuf, rlset, ifp, di, NPF_LAYER_3);
if (rl == NULL) {
bool default_pass = npf_default_pass();
npf_core_exit();
if (default_pass) {
npf_stats_inc(NPF_STAT_PASS_DEFAULT);
goto pass;
}
npf_stats_inc(NPF_STAT_BLOCK_DEFAULT);
goto block;
}
/*
* Get the rule procedure (acquires a reference) for assocation
* with a session (if any) and execution.
*/
KASSERT(rp == NULL);
rp = npf_rule_getrproc(rl);
/* Apply the rule, release the lock. */
error = npf_rule_apply(&npc, nbuf, rl, &retfl);
if (error) {
npf_stats_inc(NPF_STAT_BLOCK_RULESET);
goto block;
}
npf_stats_inc(NPF_STAT_PASS_RULESET);
/*
* Establish a "pass" session, if required. Just proceed, if session
* creation fails (e.g. due to unsupported protocol).
*
* Note: the reference on the rule procedure is transfered to the
* session. It will be released on session destruction.
*/
if ((retfl & NPF_RULE_STATEFUL) != 0 && !se) {
se = npf_session_establish(&npc, nbuf, ifp, di);
if (se) {
npf_session_setpass(se, rp);
}
}
pass:
decision = NPF_DECISION_PASS;
KASSERT(error == 0);
/*
* Perform NAT.
*/
error = npf_do_nat(&npc, se, nbuf, ifp, di);
block:
/*
* Execute the rule procedure, if any is associated.
* It may reverse the decision from pass to block.
*/
if (rp) {
npf_rproc_run(&npc, nbuf, rp, &decision);
}
out:
/*
* Release the reference on a session. Release the reference on a
* rule procedure only if there was no association.
*/
if (se) {
npf_session_release(se);
} else if (rp) {
npf_rproc_release(rp);
}
/* Pass the packet if decided and there is no error. */
if (decision == NPF_DECISION_PASS && !error) {
/*
* XXX: Disable for now, it will be set accordingly later,
* for optimisations (to reduce inspection).
*/
(*mp)->m_flags &= ~M_CANFASTFWD;
return 0;
}
/*
* Block the packet. ENETUNREACH is used to indicate blocking.
* Depending on the flags and protocol, return TCP reset (RST) or
* ICMP destination unreachable.
*/
if (retfl && npf_return_block(&npc, nbuf, retfl)) {
*mp = NULL;
}
if (!error) {
error = ENETUNREACH;
}
if (*mp) {
m_freem(*mp);
*mp = NULL;
}
return error;
}