xref: /freebsd/sys/netpfil/ipfw/ip_fw_log.c (revision 2407636ff1cc30e30355a6adc28d63e35780a7f0)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 /*
30  * Logging support for ipfw
31  */
32 
33 #include "opt_ipfw.h"
34 #include "opt_inet.h"
35 #ifndef INET
36 #error IPFIREWALL requires INET.
37 #endif /* INET */
38 #include "opt_inet6.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/mbuf.h>
44 #include <sys/socket.h>
45 #include <sys/sysctl.h>
46 #include <sys/syslog.h>
47 #include <net/ethernet.h> /* for ETHERTYPE_IP */
48 #include <net/if.h>
49 #include <net/if_dl.h>
50 #include <net/if_var.h>
51 #include <net/if_private.h>
52 #include <net/vnet.h>
53 #include <net/route.h>
54 #include <net/route/route_var.h>
55 
56 #include <netinet/in.h>
57 #include <netinet/ip.h>
58 #include <netinet/ip_icmp.h>
59 #include <netinet/ip_var.h>
60 #include <netinet/ip_fw.h>
61 #include <netinet/udp.h>
62 #include <netinet/tcp.h>
63 
64 #include <netinet/ip6.h>
65 #include <netinet/icmp6.h>
66 #ifdef INET6
67 #include <netinet6/in6_var.h>	/* ip6_sprintf() */
68 #endif
69 
70 #include <netpfil/ipfw/ip_fw_private.h>
71 
72 #ifdef MAC
73 #include <security/mac/mac_framework.h>
74 #endif
75 
76 /*
77  * L3HDR maps an ipv4 pointer into a layer3 header pointer of type T
78  * Other macros just cast void * into the appropriate type
79  */
80 #define	L3HDR(T, ip)	((T *)((u_int32_t *)(ip) + (ip)->ip_hl))
81 #define	TCP(p)		((struct tcphdr *)(p))
82 #define	SCTP(p)		((struct sctphdr *)(p))
83 #define	UDP(p)		((struct udphdr *)(p))
84 #define	ICMP(p)		((struct icmphdr *)(p))
85 #define	ICMP6(p)	((struct icmp6_hdr *)(p))
86 
87 #ifdef __APPLE__
88 #undef snprintf
89 #define snprintf	sprintf
90 #define SNPARGS(buf, len) buf + len
91 #define SNP(buf) buf
92 #else	/* !__APPLE__ */
93 #define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0
94 #define SNP(buf) buf, sizeof(buf)
95 #endif /* !__APPLE__ */
96 
97 #define	TARG(k, f)	IP_FW_ARG_TABLEARG(chain, k, f)
98 
99 static void
ipfw_log_ipfw0(struct ip_fw_args * args,struct ip * ip)100 ipfw_log_ipfw0(struct ip_fw_args *args, struct ip *ip)
101 {
102 	if (args->flags & IPFW_ARGS_LENMASK)
103 		ipfw_bpf_tap(args->mem, IPFW_ARGS_LENGTH(args->flags));
104 	else if (args->flags & IPFW_ARGS_ETHER)
105 		/* layer2, use orig hdr */
106 		ipfw_bpf_mtap(args->m);
107 	else {
108 		/* Add fake header. Later we will store
109 		 * more info in the header.
110 		 */
111 		if (ip->ip_v == 4)
112 			ipfw_bpf_mtap2("DDDDDDSSSSSS\x08\x00",
113 			    ETHER_HDR_LEN, args->m);
114 		else if (ip->ip_v == 6)
115 			ipfw_bpf_mtap2("DDDDDDSSSSSS\x86\xdd",
116 			    ETHER_HDR_LEN, args->m);
117 		else
118 			/* Obviously bogus EtherType. */
119 			ipfw_bpf_mtap2("DDDDDDSSSSSS\xff\xff",
120 			    ETHER_HDR_LEN, args->m);
121 	}
122 }
123 
124 /*
125  * XXX this function alone takes about 2Kbytes of code!
126  */
127 static void
ipfw_log_syslog(struct ip_fw_chain * chain,struct ip_fw * f,u_int hlen,struct ip_fw_args * args,u_short offset,uint32_t tablearg,struct ip * ip)128 ipfw_log_syslog(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
129     struct ip_fw_args *args, u_short offset, uint32_t tablearg, struct ip *ip)
130 {
131 	char *action;
132 	int limit_reached = 0;
133 	char action2[92], proto[128], fragment[32], mark_str[24];
134 
135 	fragment[0] = '\0';
136 	proto[0] = '\0';
137 
138 	if (f == NULL) {	/* bogus pkt */
139 		if (V_verbose_limit != 0 && V_norule_counter >= V_verbose_limit)
140 			return;
141 		V_norule_counter++;
142 		if (V_norule_counter == V_verbose_limit)
143 			limit_reached = V_verbose_limit;
144 		action = "Refuse";
145 	} else {	/* O_LOG is the first action, find the real one */
146 		ipfw_insn *cmd = ACTION_PTR(f);
147 		ipfw_insn_log *l = (ipfw_insn_log *)cmd;
148 
149 		if (l->max_log != 0 && l->log_left == 0)
150 			return;
151 		l->log_left--;
152 		if (l->log_left == 0)
153 			limit_reached = l->max_log;
154 		cmd += F_LEN(cmd);	/* point to first action */
155 		if (cmd->opcode == O_ALTQ) {
156 			ipfw_insn_altq *altq = (ipfw_insn_altq *)cmd;
157 
158 			snprintf(SNPARGS(action2, 0), "Altq %d",
159 				altq->qid);
160 			cmd += F_LEN(cmd);
161 		}
162 		if (cmd->opcode == O_PROB || cmd->opcode == O_TAG)
163 			cmd += F_LEN(cmd);
164 
165 		action = action2;
166 		switch (cmd->opcode) {
167 		case O_DENY:
168 			action = "Deny";
169 			break;
170 
171 		case O_REJECT:
172 			if (cmd->arg1==ICMP_REJECT_RST)
173 				action = "Reset";
174 			else if (cmd->arg1==ICMP_REJECT_ABORT)
175 				action = "Abort";
176 			else if (cmd->arg1==ICMP_UNREACH_HOST)
177 				action = "Reject";
178 			else
179 				snprintf(SNPARGS(action2, 0), "Unreach %d",
180 					cmd->arg1);
181 			break;
182 
183 		case O_UNREACH6:
184 			if (cmd->arg1==ICMP6_UNREACH_RST)
185 				action = "Reset";
186 			else if (cmd->arg1==ICMP6_UNREACH_ABORT)
187 				action = "Abort";
188 			else
189 				snprintf(SNPARGS(action2, 0), "Unreach %d",
190 					cmd->arg1);
191 			break;
192 
193 		case O_ACCEPT:
194 			action = "Accept";
195 			break;
196 		case O_COUNT:
197 			action = "Count";
198 			break;
199 		case O_DIVERT:
200 			snprintf(SNPARGS(action2, 0), "Divert %d",
201 				TARG(cmd->arg1, divert));
202 			break;
203 		case O_TEE:
204 			snprintf(SNPARGS(action2, 0), "Tee %d",
205 				TARG(cmd->arg1, divert));
206 			break;
207 		case O_SETDSCP:
208 			snprintf(SNPARGS(action2, 0), "SetDscp %d",
209 				TARG(cmd->arg1, dscp) & 0x3F);
210 			break;
211 		case O_SETFIB:
212 			snprintf(SNPARGS(action2, 0), "SetFib %d",
213 				TARG(cmd->arg1, fib) & 0x7FFF);
214 			break;
215 		case O_SKIPTO:
216 			snprintf(SNPARGS(action2, 0), "SkipTo %d",
217 			    TARG(insntod(cmd, u32)->d[0], skipto));
218 			break;
219 		case O_PIPE:
220 			snprintf(SNPARGS(action2, 0), "Pipe %d",
221 				TARG(cmd->arg1, pipe));
222 			break;
223 		case O_QUEUE:
224 			snprintf(SNPARGS(action2, 0), "Queue %d",
225 				TARG(cmd->arg1, pipe));
226 			break;
227 		case O_FORWARD_IP:
228 			if (IS_IP4_FLOW_ID(&args->f_id)) {
229 				char buf[INET_ADDRSTRLEN];
230 				const struct sockaddr_in *sin = &insntod(cmd, sa)->sa;
231 				int len;
232 
233 				/* handle fwd tablearg */
234 				if (sin->sin_addr.s_addr == INADDR_ANY) {
235 					struct in_addr tmp;
236 
237 					tmp.s_addr = htonl(
238 					    TARG_VAL(chain, tablearg, nh4));
239 					inet_ntoa_r(tmp, buf);
240 				} else
241 					inet_ntoa_r(sin->sin_addr, buf);
242 				len = snprintf(SNPARGS(action2, 0),
243 				    "Forward to %s", buf);
244 				if (sin->sin_port != 0)
245 					snprintf(SNPARGS(action2, len), ":%d",
246 					    sin->sin_port);
247 			}
248 			/* FALLTHROUGH */
249 #ifdef INET6
250 		case O_FORWARD_IP6:
251 			if (IS_IP6_FLOW_ID(&args->f_id)) {
252 				char buf[INET6_ADDRSTRLEN];
253 				struct sockaddr_in6 tmp;
254 				const struct sockaddr_in *sin = &insntod(cmd, sa)->sa;
255 				struct sockaddr_in6 *sin6 = &insntod(cmd, sa6)->sa;
256 				int len;
257 
258 				if (cmd->opcode == O_FORWARD_IP &&
259 				    sin->sin_addr.s_addr == INADDR_ANY) {
260 					sin6 = &tmp;
261 					sin6->sin6_addr =
262 					    TARG_VAL(chain, tablearg, nh6);
263 					sin6->sin6_scope_id =
264 					    TARG_VAL(chain, tablearg, zoneid);
265 					sin6->sin6_port = sin->sin_port;
266 				}
267 
268 				ip6_sprintf(buf, &sin6->sin6_addr);
269 				if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
270 				    sin6->sin6_scope_id != 0)
271 					len = snprintf(SNPARGS(action2, 0),
272 					    "Forward to [%s%%%u]",
273 					    buf, sin6->sin6_scope_id);
274 				else
275 					len = snprintf(SNPARGS(action2, 0),
276 					    "Forward to [%s]", buf);
277 				if (sin6->sin6_port != 0)
278 					snprintf(SNPARGS(action2, len), ":%u",
279 					    sin6->sin6_port);
280 			}
281 #endif
282 			break;
283 		case O_NETGRAPH:
284 			snprintf(SNPARGS(action2, 0), "Netgraph %d",
285 				cmd->arg1);
286 			break;
287 		case O_NGTEE:
288 			snprintf(SNPARGS(action2, 0), "Ngtee %d",
289 				cmd->arg1);
290 			break;
291 		case O_NAT:
292 			action = "Nat";
293  			break;
294 		case O_REASS:
295 			action = "Reass";
296 			break;
297 		case O_CALLRETURN:
298 			if (cmd->len & F_NOT)
299 				snprintf(SNPARGS(action2, 0), "Return %s",
300 				    cmd->arg1 == RETURN_NEXT_RULENUM ?
301 				    "next-rulenum": "next-rule");
302 			else
303 				snprintf(SNPARGS(action2, 0), "Call %d",
304 				    TARG(insntod(cmd, u32)->d[0], skipto));
305 			break;
306 		case O_SETMARK:
307 			if (cmd->arg1 == IP_FW_TARG)
308 				snprintf(SNPARGS(action2, 0), "SetMark %#010x",
309 				    TARG(cmd->arg1, mark));
310 			else
311 				snprintf(SNPARGS(action2, 0), "SetMark %#010x",
312 				    insntoc(cmd, u32)->d[0]);
313 			break;
314 		case O_EXTERNAL_ACTION:
315 			snprintf(SNPARGS(action2, 0), "Eaction %s",
316 			    ((struct named_object *)SRV_OBJECT(chain,
317 			    insntod(cmd, kidx)->kidx))->name);
318 			break;
319 		default:
320 			action = "UNKNOWN";
321 			break;
322 		}
323 	}
324 
325 	if (hlen == 0) {	/* non-ip */
326 		snprintf(SNPARGS(proto, 0), "MAC");
327 
328 	} else {
329 		int len;
330 #ifdef INET6
331 		char src[INET6_ADDRSTRLEN + 2], dst[INET6_ADDRSTRLEN + 2];
332 #else
333 		char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
334 #endif
335 		struct icmphdr *icmp;
336 		struct tcphdr *tcp;
337 		struct udphdr *udp;
338 #ifdef INET6
339 		struct ip6_hdr *ip6 = NULL;
340 		struct icmp6_hdr *icmp6;
341 		u_short ip6f_mf;
342 #endif
343 		src[0] = '\0';
344 		dst[0] = '\0';
345 #ifdef INET6
346 		ip6f_mf = offset & IP6F_MORE_FRAG;
347 		offset &= IP6F_OFF_MASK;
348 
349 		if (IS_IP6_FLOW_ID(&(args->f_id))) {
350 			char ip6buf[INET6_ADDRSTRLEN];
351 			snprintf(src, sizeof(src), "[%s]",
352 			    ip6_sprintf(ip6buf, &args->f_id.src_ip6));
353 			snprintf(dst, sizeof(dst), "[%s]",
354 			    ip6_sprintf(ip6buf, &args->f_id.dst_ip6));
355 
356 			ip6 = (struct ip6_hdr *)ip;
357 			tcp = (struct tcphdr *)(((char *)ip) + hlen);
358 			udp = (struct udphdr *)(((char *)ip) + hlen);
359 		} else
360 #endif
361 		{
362 			tcp = L3HDR(struct tcphdr, ip);
363 			udp = L3HDR(struct udphdr, ip);
364 
365 			inet_ntop(AF_INET, &ip->ip_src, src, sizeof(src));
366 			inet_ntop(AF_INET, &ip->ip_dst, dst, sizeof(dst));
367 		}
368 
369 		switch (args->f_id.proto) {
370 		case IPPROTO_TCP:
371 			len = snprintf(SNPARGS(proto, 0), "TCP %s", src);
372 			if (offset == 0)
373 				snprintf(SNPARGS(proto, len), ":%d %s:%d",
374 				    ntohs(tcp->th_sport),
375 				    dst,
376 				    ntohs(tcp->th_dport));
377 			else
378 				snprintf(SNPARGS(proto, len), " %s", dst);
379 			break;
380 
381 		case IPPROTO_UDP:
382 		case IPPROTO_UDPLITE:
383 			len = snprintf(SNPARGS(proto, 0), "UDP%s%s",
384 			    args->f_id.proto == IPPROTO_UDP ? " ": "Lite ",
385 			    src);
386 			if (offset == 0)
387 				snprintf(SNPARGS(proto, len), ":%d %s:%d",
388 				    ntohs(udp->uh_sport),
389 				    dst,
390 				    ntohs(udp->uh_dport));
391 			else
392 				snprintf(SNPARGS(proto, len), " %s", dst);
393 			break;
394 
395 		case IPPROTO_ICMP:
396 			icmp = L3HDR(struct icmphdr, ip);
397 			if (offset == 0)
398 				len = snprintf(SNPARGS(proto, 0),
399 				    "ICMP:%u.%u ",
400 				    icmp->icmp_type, icmp->icmp_code);
401 			else
402 				len = snprintf(SNPARGS(proto, 0), "ICMP ");
403 			len += snprintf(SNPARGS(proto, len), "%s", src);
404 			snprintf(SNPARGS(proto, len), " %s", dst);
405 			break;
406 #ifdef INET6
407 		case IPPROTO_ICMPV6:
408 			icmp6 = (struct icmp6_hdr *)(((char *)ip) + hlen);
409 			if (offset == 0)
410 				len = snprintf(SNPARGS(proto, 0),
411 				    "ICMPv6:%u.%u ",
412 				    icmp6->icmp6_type, icmp6->icmp6_code);
413 			else
414 				len = snprintf(SNPARGS(proto, 0), "ICMPv6 ");
415 			len += snprintf(SNPARGS(proto, len), "%s", src);
416 			snprintf(SNPARGS(proto, len), " %s", dst);
417 			break;
418 #endif
419 		default:
420 			len = snprintf(SNPARGS(proto, 0), "P:%d %s",
421 			    args->f_id.proto, src);
422 			snprintf(SNPARGS(proto, len), " %s", dst);
423 			break;
424 		}
425 
426 #ifdef INET6
427 		if (IS_IP6_FLOW_ID(&(args->f_id))) {
428 			if (offset || ip6f_mf)
429 				snprintf(SNPARGS(fragment, 0),
430 				    " (frag %08x:%d@%d%s)",
431 				    args->f_id.extra,
432 				    ntohs(ip6->ip6_plen) - hlen,
433 				    ntohs(offset) << 3, ip6f_mf ? "+" : "");
434 		} else
435 #endif
436 		{
437 			int ipoff, iplen;
438 			ipoff = ntohs(ip->ip_off);
439 			iplen = ntohs(ip->ip_len);
440 			if (ipoff & (IP_MF | IP_OFFMASK))
441 				snprintf(SNPARGS(fragment, 0),
442 				    " (frag %d:%d@%d%s)",
443 				    ntohs(ip->ip_id), iplen - (ip->ip_hl << 2),
444 				    offset << 3,
445 				    (ipoff & IP_MF) ? "+" : "");
446 		}
447 	}
448 
449 	/* [fw]mark */
450 	if (args->rule.pkt_mark)
451 		snprintf(SNPARGS(mark_str, 0), " mark:%#x",
452 		    args->rule.pkt_mark);
453 	else
454 		mark_str[0] = '\0';
455 
456 #ifdef __FreeBSD__
457 	log(LOG_SECURITY | LOG_INFO, "ipfw: %d %s %s%s %s via %s%s\n",
458 	    f ? f->rulenum : -1, action, proto, mark_str,
459 	    args->flags & IPFW_ARGS_OUT ? "out" : "in", args->ifp->if_xname,
460 	    fragment);
461 #else
462 	log(LOG_SECURITY | LOG_INFO, "ipfw: %d %s %s%s [no if info]%s\n",
463 	    f ? f->rulenum : -1, action, proto, mark_str, fragment);
464 #endif
465 	if (limit_reached)
466 		log(LOG_SECURITY | LOG_NOTICE,
467 		    "ipfw: limit %d reached on entry %d\n",
468 		    limit_reached, f ? f->rulenum : -1);
469 }
470 
471 static void
ipfw_rtsocklog_fill_l3(struct ip_fw_args * args,char ** buf,struct sockaddr ** src,struct sockaddr ** dst)472 ipfw_rtsocklog_fill_l3(struct ip_fw_args *args,
473     char **buf, struct sockaddr **src, struct sockaddr **dst)
474 {
475 	struct sockaddr_in *v4src, *v4dst;
476 #ifdef INET6
477 	struct sockaddr_in6 *v6src, *v6dst;
478 
479 	if (IS_IP6_FLOW_ID(&(args->f_id))) {
480 		v6src = (struct sockaddr_in6 *)*buf;
481 		*buf += sizeof(*v6src);
482 		v6dst = (struct sockaddr_in6 *)*buf;
483 		*buf += sizeof(*v6dst);
484 		v6src->sin6_len = v6dst->sin6_len = sizeof(*v6src);
485 		v6src->sin6_family = v6dst->sin6_family = AF_INET6;
486 		v6src->sin6_addr = args->f_id.src_ip6;
487 		v6dst->sin6_addr = args->f_id.dst_ip6;
488 
489 		*src = (struct sockaddr *)v6src;
490 		*dst = (struct sockaddr *)v6dst;
491 	} else
492 #endif
493 	{
494 		v4src = (struct sockaddr_in *)*buf;
495 		*buf += sizeof(*v4src);
496 		v4dst = (struct sockaddr_in *)*buf;
497 		*buf += sizeof(*v4dst);
498 		v4src->sin_len = v4dst->sin_len = sizeof(*v4src);
499 		v4src->sin_family = v4dst->sin_family = AF_INET;
500 		v4src->sin_addr.s_addr = htonl(args->f_id.src_ip);
501 		v4dst->sin_addr.s_addr = htonl(args->f_id.dst_ip);
502 
503 		*src = (struct sockaddr *)v4src;
504 		*dst = (struct sockaddr *)v4dst;
505 	}
506 }
507 
508 static struct sockaddr *
ipfw_rtsocklog_handle_tablearg(struct ip_fw_chain * chain,struct ip_fw_args * args,ipfw_insn * cmd,uint32_t tablearg,uint32_t * targ_value,char ** buf)509 ipfw_rtsocklog_handle_tablearg(struct ip_fw_chain *chain,
510     struct ip_fw_args *args, ipfw_insn *cmd, uint32_t tablearg,
511     uint32_t *targ_value, char **buf)
512 {
513 	/* handle tablearg now */
514 	switch (cmd->opcode) {
515 	case O_DIVERT:
516 	case O_TEE:
517 		*targ_value = TARG(cmd->arg1, divert);
518 		break;
519 	case O_NETGRAPH:
520 	case O_NGTEE:
521 		*targ_value = TARG(cmd->arg1, netgraph);
522 		break;
523 	case O_SETDSCP:
524 		*targ_value = (TARG(cmd->arg1, dscp) & 0x3F);
525 		break;
526 	case O_SETFIB:
527 		*targ_value = (TARG(cmd->arg1, fib) & 0x7FFF);
528 		break;
529 	case O_SKIPTO:
530 	case O_CALLRETURN:
531 		if (cmd->opcode == O_CALLRETURN && (cmd->len & F_NOT))
532 			break;
533 		*targ_value = TARG(insntod(cmd, u32)->d[0], skipto);
534 		break;
535 	case O_PIPE:
536 	case O_QUEUE:
537 		*targ_value = TARG(cmd->arg1, pipe);
538 		break;
539 	case O_SETMARK:
540 		if (cmd->arg1 == IP_FW_TARG)
541 			*targ_value = TARG_VAL(chain, tablearg, mark);
542 		break;
543 	case O_FORWARD_IP:
544 		if (IS_IP4_FLOW_ID(&args->f_id)) {
545 			struct sockaddr_in *nh = (struct sockaddr_in *)*buf;
546 
547 			*buf += sizeof(*nh);
548 			memcpy(nh, &insntod(cmd, sa)->sa, sizeof(*nh));
549 			if (nh->sin_addr.s_addr == INADDR_ANY)
550 				nh->sin_addr.s_addr = htonl(
551 				    TARG_VAL(chain, tablearg, nh4));
552 			return ((struct sockaddr *)nh);
553 		}
554 		/* FALLTHROUGH */
555 #ifdef INET6
556 	case O_FORWARD_IP6:
557 		if (IS_IP6_FLOW_ID(&args->f_id)) {
558 			const struct sockaddr_in *sin = &insntod(cmd, sa)->sa;
559 			struct sockaddr_in6 *nh = (struct sockaddr_in6 *)*buf;
560 
561 			*buf += sizeof(*nh);
562 			if (cmd->opcode == O_FORWARD_IP &&
563 			    sin->sin_addr.s_addr == INADDR_ANY) {
564 				nh->sin6_family = AF_INET6;
565 				nh->sin6_len = sizeof(*nh);
566 				nh->sin6_addr = TARG_VAL(chain, tablearg, nh6);
567 				nh->sin6_port = sin->sin_port;
568 				nh->sin6_scope_id =
569 				    TARG_VAL(chain, tablearg, zoneid);
570 			} else
571 				memcpy(nh, &insntod(cmd, sa6)->sa, sizeof(*nh));
572 			return ((struct sockaddr *)nh);
573 		}
574 #endif
575 	default:
576 		break;
577 	}
578 
579 	return (NULL);
580 }
581 
582 #define	MAX_COMMENT_LEN	80
583 
584 static size_t
ipfw_copy_rule_comment(struct ip_fw * f,char * dst)585 ipfw_copy_rule_comment(struct ip_fw *f, char *dst)
586 {
587 	ipfw_insn *cmd;
588 	size_t rcomment_len = 0;
589 	int l, cmdlen;
590 
591 	for (l = f->cmd_len, cmd = f->cmd; l > 0; l -= cmdlen, cmd += cmdlen) {
592 		cmdlen = F_LEN(cmd);
593 		if (cmd->opcode != O_NOP) {
594 			continue;
595 		} else if (cmd->len == 1) {
596 			return (0);
597 		}
598 		break;
599 	}
600 	if (l <= 0) {
601 		return (0);
602 	}
603 	rcomment_len = strnlen((char *)(cmd + 1), MAX_COMMENT_LEN - 1) + 1;
604 	strlcpy(dst, (char *)(cmd + 1), rcomment_len);
605 	return (rcomment_len);
606 }
607 
608 /*
609  * Logs a packet matched by a rule as a route(4) socket message.
610  *
611  * While ipfw0 pseudo interface provides a way to observe full packet body,
612  * no metadata (rule number, action, mark, etc) is available.
613  * pflog(4) is not an option either as it's header is hardcoded and does not
614  * provide sufficient space for ipfw meta information.
615  *
616  * To be able to get a machine-readable event with all meta information needed
617  * for user-space daemons we construct a route(4) message and pack as much meta
618  * information as we can into it.
619  *
620  * RTAX_DST(0): (struct sockaddr_dl) carrying ipfwlog_rtsock_hdr_v2 in sdl_data
621  *		with general rule information (rule number, set, action, mark,
622  *		cmd, comment) and source/destination MAC addresses in case we're
623  *		logging in layer2 pass.
624  *
625  * RTAX_GATEWAY(1): (struct sockaddr) IP source address
626  *
627  * RTAX_NETMASK(2): (struct sockaddr) IP destination address
628  *
629  * RTAX_GENMASK(3): (struct sockaddr) IP address and port used in fwd action
630  *
631  * One SHOULD set an explicit logamount for any rule using rtsock as flooding
632  * route socket with such events could lead to various system-wide side effects.
633  * RTF_PROTO1 flag in (struct rt_addrinfo).rti_flags is set in all messages
634  * once half of logamount limit is crossed. This could be used by the software
635  * processing these logs to issue `ipfw resetlog` command to keep the event
636  * flow.
637  *
638  * TODO: convert ipfwlog_rtsock_hdr_v2 data into TLV to ease expansion.
639 */
640 
641 static void
ipfw_log_rtsock(struct ip_fw_chain * chain,struct ip_fw * f,u_int hlen,struct ip_fw_args * args,u_short offset,uint32_t tablearg,void * _eh)642 ipfw_log_rtsock(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
643     struct ip_fw_args *args, u_short offset, uint32_t tablearg, void *_eh)
644 {
645 	struct sockaddr_dl *sdl_ipfwcmd;
646 	struct ether_header *eh = _eh;
647 	struct rt_addrinfo *info;
648 	uint32_t *targ_value;
649 	ipfwlog_rtsock_hdr_v2 *hdr;
650 	ipfw_insn *cmd;
651 	ipfw_insn_log *l;
652 	char *buf, *orig_buf;
653 	/* at least 4 x sizeof(struct sockaddr_dl) + rule comment (80) */
654 	size_t buflen = 512;
655 
656 	/* Should we log? O_LOG is the first one */
657 	cmd = ACTION_PTR(f);
658 	l = (ipfw_insn_log *)cmd;
659 
660 	if (l->max_log != 0 && l->log_left == 0)
661 		return;
662 
663 	if (hlen == 0) /* non-ip */
664 		return;
665 
666 	l->log_left--;
667 	if (V_fw_verbose != 0 && l->log_left == 0) {
668 		log(LOG_SECURITY | LOG_NOTICE,
669 		    "ipfw: limit %d reached on entry %d\n",
670 		    l->max_log, f ? f->rulenum : -1);
671 	}
672 
673 	buf = orig_buf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
674 	if (buf == NULL)
675 		return;
676 
677 	info = (struct rt_addrinfo *)buf;
678 	buf += sizeof (*info);
679 
680 	cmd = ipfw_get_action(f);
681 	sdl_ipfwcmd = (struct sockaddr_dl *)buf;
682 	sdl_ipfwcmd->sdl_family = AF_IPFWLOG;
683 	sdl_ipfwcmd->sdl_index = f->set;
684 	sdl_ipfwcmd->sdl_type = 2; /* version */
685 	sdl_ipfwcmd->sdl_alen = sizeof(*hdr);
686 	hdr = (ipfwlog_rtsock_hdr_v2 *)(sdl_ipfwcmd->sdl_data);
687 	/* fill rule comment in if any */
688 	sdl_ipfwcmd->sdl_nlen = ipfw_copy_rule_comment(f, hdr->comment);
689 	targ_value = &hdr->tablearg;
690 	hdr->rulenum = f->rulenum;
691 	hdr->mark = args->rule.pkt_mark;
692 	hdr->cmd = *cmd;
693 
694 	sdl_ipfwcmd->sdl_len = sizeof(*sdl_ipfwcmd);
695 	if (sizeof(*hdr) + sdl_ipfwcmd->sdl_nlen > sizeof(sdl_ipfwcmd->sdl_data)) {
696 		sdl_ipfwcmd->sdl_len += sizeof(*hdr) + sdl_ipfwcmd->sdl_nlen  -
697 		    sizeof(sdl_ipfwcmd->sdl_data);
698 	}
699 	buf += sdl_ipfwcmd->sdl_len;
700 
701 	/* fill L2 in if present */
702 	if (args->flags & IPFW_ARGS_ETHER && eh != NULL) {
703 		sdl_ipfwcmd->sdl_slen = sizeof(eh->ether_shost);
704 		memcpy(hdr->ether_shost, eh->ether_shost,
705 		    sdl_ipfwcmd->sdl_slen);
706 		memcpy(hdr->ether_dhost, eh->ether_dhost,
707 		    sdl_ipfwcmd->sdl_slen);
708 	}
709 
710 	info->rti_info[RTAX_DST] = (struct sockaddr *)sdl_ipfwcmd;
711 
712 	/* Warn if we're about to stop sending messages */
713 	if (l->max_log != 0 && l->log_left < (l->max_log >> 1)) {
714 		info->rti_flags |= RTF_PROTO1;
715 	}
716 
717 	/* handle tablearg */
718 	info->rti_info[RTAX_GENMASK] = ipfw_rtsocklog_handle_tablearg(
719 	    chain, args, cmd, tablearg, targ_value, &buf);
720 
721 	/* L3 */
722 	ipfw_rtsocklog_fill_l3(args, &buf,
723 	    &info->rti_info[RTAX_GATEWAY],
724 	    &info->rti_info[RTAX_NETMASK]);
725 
726 	KASSERT(buf <= (orig_buf + buflen),
727 	    ("ipfw: buffer for logdst rtsock is not big enough"));
728 
729 	info->rti_ifp = args->ifp;
730 	rtsock_routemsg_info(RTM_IPFWLOG, info, RT_ALL_FIBS);
731 
732 	free(orig_buf, M_TEMP);
733 }
734 
735 /*
736  * We enter here when we have a rule with O_LOG.
737  */
738 void
ipfw_log(struct ip_fw_chain * chain,struct ip_fw * f,u_int hlen,struct ip_fw_args * args,u_short offset,uint32_t tablearg,struct ip * ip,void * eh)739 ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
740     struct ip_fw_args *args, u_short offset, uint32_t tablearg,
741     struct ip *ip, void *eh)
742 {
743 	ipfw_insn *cmd;
744 
745 	/* Fallback to default logging if we're missing rule pointer */
746 	if (f == NULL ||
747 	    /* O_LOG is the first action */
748 	    ((cmd = ACTION_PTR(f)) && cmd->arg1 == IPFW_LOG_DEFAULT)) {
749 		if (V_fw_verbose == 0) {
750 			ipfw_log_ipfw0(args, ip);
751 			return;
752 		}
753 		ipfw_log_syslog(chain, f, hlen, args, offset, tablearg, ip);
754 		return;
755 	}
756 
757 	if (cmd->arg1 & IPFW_LOG_SYSLOG)
758 		ipfw_log_syslog(chain, f, hlen, args, offset, tablearg, ip);
759 
760 	if (cmd->arg1 & IPFW_LOG_RTSOCK)
761 		ipfw_log_rtsock(chain, f, hlen, args, offset, tablearg, eh);
762 
763 	if (cmd->arg1 & IPFW_LOG_IPFW0)
764 		ipfw_log_ipfw0(args, ip);
765 }
766 /* end of file */
767