1 /*- 2 * ng_etf.c Ethertype filter 3 */ 4 5 /*- 6 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 7 * 8 * Copyright (c) 2001, FreeBSD Incorporated 9 * All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice unmodified, this list of conditions, and the following 16 * disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * Author: Julian Elischer <julian@freebsd.org> 34 * 35 * $FreeBSD$ 36 */ 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/kernel.h> 41 #include <sys/mbuf.h> 42 #include <sys/malloc.h> 43 #include <sys/ctype.h> 44 #include <sys/errno.h> 45 #include <sys/queue.h> 46 #include <sys/syslog.h> 47 48 #include <net/ethernet.h> 49 50 #include <netgraph/ng_message.h> 51 #include <netgraph/ng_parse.h> 52 #include <netgraph/ng_etf.h> 53 #include <netgraph/netgraph.h> 54 55 /* If you do complicated mallocs you may want to do this */ 56 /* and use it for your mallocs */ 57 #ifdef NG_SEPARATE_MALLOC 58 static MALLOC_DEFINE(M_NETGRAPH_ETF, "netgraph_etf", "netgraph etf node "); 59 #else 60 #define M_NETGRAPH_ETF M_NETGRAPH 61 #endif 62 63 /* 64 * This section contains the netgraph method declarations for the 65 * etf node. These methods define the netgraph 'type'. 66 */ 67 68 static ng_constructor_t ng_etf_constructor; 69 static ng_rcvmsg_t ng_etf_rcvmsg; 70 static ng_shutdown_t ng_etf_shutdown; 71 static ng_newhook_t ng_etf_newhook; 72 static ng_rcvdata_t ng_etf_rcvdata; /* note these are both ng_rcvdata_t */ 73 static ng_disconnect_t ng_etf_disconnect; 74 75 /* Parse type for struct ng_etfstat */ 76 static const struct ng_parse_struct_field ng_etf_stat_type_fields[] 77 = NG_ETF_STATS_TYPE_INFO; 78 static const struct ng_parse_type ng_etf_stat_type = { 79 &ng_parse_struct_type, 80 &ng_etf_stat_type_fields 81 }; 82 /* Parse type for struct ng_setfilter */ 83 static const struct ng_parse_struct_field ng_etf_filter_type_fields[] 84 = NG_ETF_FILTER_TYPE_INFO; 85 static const struct ng_parse_type ng_etf_filter_type = { 86 &ng_parse_struct_type, 87 &ng_etf_filter_type_fields 88 }; 89 90 /* List of commands and how to convert arguments to/from ASCII */ 91 static const struct ng_cmdlist ng_etf_cmdlist[] = { 92 { 93 NGM_ETF_COOKIE, 94 NGM_ETF_GET_STATUS, 95 "getstatus", 96 NULL, 97 &ng_etf_stat_type, 98 }, 99 { 100 NGM_ETF_COOKIE, 101 NGM_ETF_SET_FLAG, 102 "setflag", 103 &ng_parse_int32_type, 104 NULL 105 }, 106 { 107 NGM_ETF_COOKIE, 108 NGM_ETF_SET_FILTER, 109 "setfilter", 110 &ng_etf_filter_type, 111 NULL 112 }, 113 { 0 } 114 }; 115 116 /* Netgraph node type descriptor */ 117 static struct ng_type typestruct = { 118 .version = NG_ABI_VERSION, 119 .name = NG_ETF_NODE_TYPE, 120 .constructor = ng_etf_constructor, 121 .rcvmsg = ng_etf_rcvmsg, 122 .shutdown = ng_etf_shutdown, 123 .newhook = ng_etf_newhook, 124 .rcvdata = ng_etf_rcvdata, 125 .disconnect = ng_etf_disconnect, 126 .cmdlist = ng_etf_cmdlist, 127 }; 128 NETGRAPH_INIT(etf, &typestruct); 129 130 /* Information we store for each hook on each node */ 131 struct ETF_hookinfo { 132 hook_p hook; 133 }; 134 135 struct filter { 136 LIST_ENTRY(filter) next; 137 u_int16_t ethertype; /* network order ethertype */ 138 hook_p match_hook; /* Hook to use on a match */ 139 }; 140 141 #define HASHSIZE 16 /* Dont change this without changing HASH() */ 142 #define HASH(et) ((((et)>>12)+((et)>>8)+((et)>>4)+(et)) & 0x0f) 143 LIST_HEAD(filterhead, filter); 144 145 /* Information we store for each node */ 146 struct ETF { 147 struct ETF_hookinfo downstream_hook; 148 struct ETF_hookinfo nomatch_hook; 149 node_p node; /* back pointer to node */ 150 u_int packets_in; /* packets in from downstream */ 151 u_int packets_out; /* packets out towards downstream */ 152 u_int32_t flags; 153 struct filterhead hashtable[HASHSIZE]; 154 }; 155 typedef struct ETF *etf_p; 156 157 static struct filter * 158 ng_etf_findentry(etf_p etfp, u_int16_t ethertype) 159 { 160 struct filterhead *chain = etfp->hashtable + HASH(ethertype); 161 struct filter *fil; 162 163 LIST_FOREACH(fil, chain, next) { 164 if (fil->ethertype == ethertype) { 165 return (fil); 166 } 167 } 168 return (NULL); 169 } 170 171 /* 172 * Allocate the private data structure. The generic node has already 173 * been created. Link them together. We arrive with a reference to the node 174 * i.e. the reference count is incremented for us already. 175 */ 176 static int 177 ng_etf_constructor(node_p node) 178 { 179 etf_p privdata; 180 int i; 181 182 /* Initialize private descriptor */ 183 privdata = malloc(sizeof(*privdata), M_NETGRAPH_ETF, M_WAITOK | M_ZERO); 184 for (i = 0; i < HASHSIZE; i++) { 185 LIST_INIT((privdata->hashtable + i)); 186 } 187 188 /* Link structs together; this counts as our one reference to node */ 189 NG_NODE_SET_PRIVATE(node, privdata); 190 privdata->node = node; 191 return (0); 192 } 193 194 /* 195 * Give our ok for a hook to be added... 196 * All names are ok. Two names are special. 197 */ 198 static int 199 ng_etf_newhook(node_p node, hook_p hook, const char *name) 200 { 201 const etf_p etfp = NG_NODE_PRIVATE(node); 202 struct ETF_hookinfo *hpriv; 203 204 if (strcmp(name, NG_ETF_HOOK_DOWNSTREAM) == 0) { 205 etfp->downstream_hook.hook = hook; 206 NG_HOOK_SET_PRIVATE(hook, &etfp->downstream_hook); 207 etfp->packets_in = 0; 208 etfp->packets_out = 0; 209 } else if (strcmp(name, NG_ETF_HOOK_NOMATCH) == 0) { 210 etfp->nomatch_hook.hook = hook; 211 NG_HOOK_SET_PRIVATE(hook, &etfp->nomatch_hook); 212 } else { 213 /* 214 * Any other hook name is valid and can 215 * later be associated with a filter rule. 216 */ 217 hpriv = malloc(sizeof(*hpriv), 218 M_NETGRAPH_ETF, M_NOWAIT | M_ZERO); 219 if (hpriv == NULL) { 220 return (ENOMEM); 221 } 222 223 NG_HOOK_SET_PRIVATE(hook, hpriv); 224 hpriv->hook = hook; 225 } 226 return(0); 227 } 228 229 /* 230 * Get a netgraph control message. 231 * We actually receive a queue item that has a pointer to the message. 232 * If we free the item, the message will be freed too, unless we remove 233 * it from the item using NGI_GET_MSG(); 234 * The return address is also stored in the item, as an ng_ID_t, 235 * accessible as NGI_RETADDR(item); 236 * Check it is one we understand. If needed, send a response. 237 * We could save the address for an async action later, but don't here. 238 * Always free the message. 239 * The response should be in a malloc'd region that the caller can 'free'. 240 * The NG_MKRESPONSE macro does all this for us. 241 * A response is not required. 242 * Theoretically you could respond defferently to old message types if 243 * the cookie in the header didn't match what we consider to be current 244 * (so that old userland programs could continue to work). 245 */ 246 static int 247 ng_etf_rcvmsg(node_p node, item_p item, hook_p lasthook) 248 { 249 const etf_p etfp = NG_NODE_PRIVATE(node); 250 struct ng_mesg *resp = NULL; 251 int error = 0; 252 struct ng_mesg *msg; 253 254 NGI_GET_MSG(item, msg); 255 /* Deal with message according to cookie and command */ 256 switch (msg->header.typecookie) { 257 case NGM_ETF_COOKIE: 258 switch (msg->header.cmd) { 259 case NGM_ETF_GET_STATUS: 260 { 261 struct ng_etfstat *stats; 262 263 NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT); 264 if (!resp) { 265 error = ENOMEM; 266 break; 267 } 268 stats = (struct ng_etfstat *) resp->data; 269 stats->packets_in = etfp->packets_in; 270 stats->packets_out = etfp->packets_out; 271 break; 272 } 273 case NGM_ETF_SET_FLAG: 274 if (msg->header.arglen != sizeof(u_int32_t)) { 275 error = EINVAL; 276 break; 277 } 278 etfp->flags = *((u_int32_t *) msg->data); 279 break; 280 case NGM_ETF_SET_FILTER: 281 { 282 struct ng_etffilter *f; 283 struct filter *fil; 284 hook_p hook; 285 286 /* Check message long enough for this command */ 287 if (msg->header.arglen != sizeof(*f)) { 288 error = EINVAL; 289 break; 290 } 291 292 /* Make sure hook referenced exists */ 293 f = (struct ng_etffilter *)msg->data; 294 hook = ng_findhook(node, f->matchhook); 295 if (hook == NULL) { 296 error = ENOENT; 297 break; 298 } 299 300 /* and is not the downstream hook */ 301 if (hook == etfp->downstream_hook.hook) { 302 error = EINVAL; 303 break; 304 } 305 306 /* Check we don't already trap this ethertype */ 307 if (ng_etf_findentry(etfp, 308 htons(f->ethertype))) { 309 error = EEXIST; 310 break; 311 } 312 313 /* 314 * Ok, make the filter and put it in the 315 * hashtable ready for matching. 316 */ 317 fil = malloc(sizeof(*fil), 318 M_NETGRAPH_ETF, M_NOWAIT | M_ZERO); 319 if (fil == NULL) { 320 error = ENOMEM; 321 break; 322 } 323 324 fil->match_hook = hook; 325 fil->ethertype = htons(f->ethertype); 326 LIST_INSERT_HEAD( etfp->hashtable 327 + HASH(fil->ethertype), 328 fil, next); 329 } 330 break; 331 default: 332 error = EINVAL; /* unknown command */ 333 break; 334 } 335 break; 336 default: 337 error = EINVAL; /* unknown cookie type */ 338 break; 339 } 340 341 /* Take care of synchronous response, if any */ 342 NG_RESPOND_MSG(error, node, item, resp); 343 /* Free the message and return */ 344 NG_FREE_MSG(msg); 345 return(error); 346 } 347 348 /* 349 * Receive data, and do something with it. 350 * Actually we receive a queue item which holds the data. 351 * If we free the item it will also free the data unless we have previously 352 * disassociated it using the NGI_GET_etf() macro. 353 * Possibly send it out on another link after processing. 354 * Possibly do something different if it comes from different 355 * hooks. The caller will never free m , so if we use up this data 356 * or abort we must free it. 357 * 358 * If we want, we may decide to force this data to be queued and reprocessed 359 * at the netgraph NETISR time. 360 * We would do that by setting the HK_QUEUE flag on our hook. We would do that 361 * in the connect() method. 362 */ 363 static int 364 ng_etf_rcvdata(hook_p hook, item_p item ) 365 { 366 const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook)); 367 struct ether_header *eh; 368 int error = 0; 369 struct mbuf *m; 370 u_int16_t ethertype; 371 struct filter *fil; 372 373 if (NG_HOOK_PRIVATE(hook) == NULL) { /* Shouldn't happen but.. */ 374 NG_FREE_ITEM(item); 375 } 376 377 /* 378 * Everything not from the downstream hook goes to the 379 * downstream hook. But only if it matches the ethertype 380 * of the source hook. Un matching must go to/from 'nomatch'. 381 */ 382 383 /* Make sure we have an entire header */ 384 NGI_GET_M(item, m); 385 if (m->m_len < sizeof(*eh) ) { 386 m = m_pullup(m, sizeof(*eh)); 387 if (m == NULL) { 388 NG_FREE_ITEM(item); 389 return(EINVAL); 390 } 391 } 392 393 eh = mtod(m, struct ether_header *); 394 ethertype = eh->ether_type; 395 fil = ng_etf_findentry(etfp, ethertype); 396 397 /* 398 * if from downstream, select between a match hook or 399 * the nomatch hook 400 */ 401 if (hook == etfp->downstream_hook.hook) { 402 etfp->packets_in++; 403 if (fil && fil->match_hook) { 404 NG_FWD_NEW_DATA(error, item, fil->match_hook, m); 405 } else { 406 NG_FWD_NEW_DATA(error, item,etfp->nomatch_hook.hook, m); 407 } 408 } else { 409 /* 410 * It must be heading towards the downstream. 411 * Check that it's ethertype matches 412 * the filters for it's input hook. 413 * If it doesn't have one, check it's from nomatch. 414 */ 415 if ((fil && (fil->match_hook != hook)) 416 || ((fil == NULL) && (hook != etfp->nomatch_hook.hook))) { 417 NG_FREE_ITEM(item); 418 NG_FREE_M(m); 419 return (EPROTOTYPE); 420 } 421 NG_FWD_NEW_DATA( error, item, etfp->downstream_hook.hook, m); 422 if (error == 0) { 423 etfp->packets_out++; 424 } 425 } 426 return (error); 427 } 428 429 /* 430 * Do local shutdown processing.. 431 * All our links and the name have already been removed. 432 */ 433 static int 434 ng_etf_shutdown(node_p node) 435 { 436 const etf_p privdata = NG_NODE_PRIVATE(node); 437 438 NG_NODE_SET_PRIVATE(node, NULL); 439 NG_NODE_UNREF(privdata->node); 440 free(privdata, M_NETGRAPH_ETF); 441 return (0); 442 } 443 444 /* 445 * Hook disconnection 446 * 447 * For this type, removal of the last link destroys the node 448 */ 449 static int 450 ng_etf_disconnect(hook_p hook) 451 { 452 const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook)); 453 int i; 454 struct filter *fil1, *fil2; 455 456 /* purge any rules that refer to this filter */ 457 for (i = 0; i < HASHSIZE; i++) { 458 fil1 = LIST_FIRST(&etfp->hashtable[i]); 459 while (fil1 != NULL) { 460 fil2 = LIST_NEXT(fil1, next); 461 if (fil1->match_hook == hook) { 462 LIST_REMOVE(fil1, next); 463 free(fil1, M_NETGRAPH_ETF); 464 } 465 fil1 = fil2; 466 } 467 } 468 469 /* If it's not one of the special hooks, then free it */ 470 if (hook == etfp->downstream_hook.hook) { 471 etfp->downstream_hook.hook = NULL; 472 } else if (hook == etfp->nomatch_hook.hook) { 473 etfp->nomatch_hook.hook = NULL; 474 } else { 475 if (NG_HOOK_PRIVATE(hook)) /* Paranoia */ 476 free(NG_HOOK_PRIVATE(hook), M_NETGRAPH_ETF); 477 } 478 479 NG_HOOK_SET_PRIVATE(hook, NULL); 480 481 if ((NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0) 482 && (NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))) /* already shutting down? */ 483 ng_rmnode_self(NG_HOOK_NODE(hook)); 484 return (0); 485 } 486