1 /*- 2 * ng_etf.c Ethertype filter 3 */ 4 5 /*- 6 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 7 * 8 * Copyright (c) 2001, FreeBSD Incorporated 9 * All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice unmodified, this list of conditions, and the following 16 * disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * Author: Julian Elischer <julian@freebsd.org> 34 * 35 * $FreeBSD$ 36 */ 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/kernel.h> 41 #include <sys/mbuf.h> 42 #include <sys/malloc.h> 43 #include <sys/ctype.h> 44 #include <sys/errno.h> 45 #include <sys/queue.h> 46 #include <sys/syslog.h> 47 48 #include <net/ethernet.h> 49 50 #include <netgraph/ng_message.h> 51 #include <netgraph/ng_parse.h> 52 #include <netgraph/ng_etf.h> 53 #include <netgraph/netgraph.h> 54 55 /* If you do complicated mallocs you may want to do this */ 56 /* and use it for your mallocs */ 57 #ifdef NG_SEPARATE_MALLOC 58 static MALLOC_DEFINE(M_NETGRAPH_ETF, "netgraph_etf", "netgraph etf node "); 59 #else 60 #define M_NETGRAPH_ETF M_NETGRAPH 61 #endif 62 63 /* 64 * This section contains the netgraph method declarations for the 65 * etf node. These methods define the netgraph 'type'. 66 */ 67 68 static ng_constructor_t ng_etf_constructor; 69 static ng_rcvmsg_t ng_etf_rcvmsg; 70 static ng_shutdown_t ng_etf_shutdown; 71 static ng_newhook_t ng_etf_newhook; 72 static ng_rcvdata_t ng_etf_rcvdata; /* note these are both ng_rcvdata_t */ 73 static ng_disconnect_t ng_etf_disconnect; 74 75 /* Parse type for struct ng_etfstat */ 76 static const struct ng_parse_struct_field ng_etf_stat_type_fields[] 77 = NG_ETF_STATS_TYPE_INFO; 78 static const struct ng_parse_type ng_etf_stat_type = { 79 &ng_parse_struct_type, 80 &ng_etf_stat_type_fields 81 }; 82 /* Parse type for struct ng_setfilter */ 83 static const struct ng_parse_struct_field ng_etf_filter_type_fields[] 84 = NG_ETF_FILTER_TYPE_INFO; 85 static const struct ng_parse_type ng_etf_filter_type = { 86 &ng_parse_struct_type, 87 &ng_etf_filter_type_fields 88 }; 89 90 /* List of commands and how to convert arguments to/from ASCII */ 91 static const struct ng_cmdlist ng_etf_cmdlist[] = { 92 { 93 NGM_ETF_COOKIE, 94 NGM_ETF_GET_STATUS, 95 "getstatus", 96 NULL, 97 &ng_etf_stat_type, 98 }, 99 { 100 NGM_ETF_COOKIE, 101 NGM_ETF_SET_FLAG, 102 "setflag", 103 &ng_parse_int32_type, 104 NULL 105 }, 106 { 107 NGM_ETF_COOKIE, 108 NGM_ETF_SET_FILTER, 109 "setfilter", 110 &ng_etf_filter_type, 111 NULL 112 }, 113 { 0 } 114 }; 115 116 /* Netgraph node type descriptor */ 117 static struct ng_type typestruct = { 118 .version = NG_ABI_VERSION, 119 .name = NG_ETF_NODE_TYPE, 120 .constructor = ng_etf_constructor, 121 .rcvmsg = ng_etf_rcvmsg, 122 .shutdown = ng_etf_shutdown, 123 .newhook = ng_etf_newhook, 124 .rcvdata = ng_etf_rcvdata, 125 .disconnect = ng_etf_disconnect, 126 .cmdlist = ng_etf_cmdlist, 127 }; 128 NETGRAPH_INIT(etf, &typestruct); 129 130 /* Information we store for each hook on each node */ 131 struct ETF_hookinfo { 132 hook_p hook; 133 }; 134 135 struct filter { 136 LIST_ENTRY(filter) next; 137 u_int16_t ethertype; /* network order ethertype */ 138 hook_p match_hook; /* Hook to use on a match */ 139 }; 140 141 #define HASHSIZE 16 /* Dont change this without changing HASH() */ 142 #define HASH(et) ((((et)>>12)+((et)>>8)+((et)>>4)+(et)) & 0x0f) 143 LIST_HEAD(filterhead, filter); 144 145 /* Information we store for each node */ 146 struct ETF { 147 struct ETF_hookinfo downstream_hook; 148 struct ETF_hookinfo nomatch_hook; 149 node_p node; /* back pointer to node */ 150 u_int packets_in; /* packets in from downstream */ 151 u_int packets_out; /* packets out towards downstream */ 152 u_int32_t flags; 153 struct filterhead hashtable[HASHSIZE]; 154 }; 155 typedef struct ETF *etf_p; 156 157 static struct filter * 158 ng_etf_findentry(etf_p etfp, u_int16_t ethertype) 159 { 160 struct filterhead *chain = etfp->hashtable + HASH(ethertype); 161 struct filter *fil; 162 163 164 LIST_FOREACH(fil, chain, next) { 165 if (fil->ethertype == ethertype) { 166 return (fil); 167 } 168 } 169 return (NULL); 170 } 171 172 173 /* 174 * Allocate the private data structure. The generic node has already 175 * been created. Link them together. We arrive with a reference to the node 176 * i.e. the reference count is incremented for us already. 177 */ 178 static int 179 ng_etf_constructor(node_p node) 180 { 181 etf_p privdata; 182 int i; 183 184 /* Initialize private descriptor */ 185 privdata = malloc(sizeof(*privdata), M_NETGRAPH_ETF, M_WAITOK | M_ZERO); 186 for (i = 0; i < HASHSIZE; i++) { 187 LIST_INIT((privdata->hashtable + i)); 188 } 189 190 /* Link structs together; this counts as our one reference to node */ 191 NG_NODE_SET_PRIVATE(node, privdata); 192 privdata->node = node; 193 return (0); 194 } 195 196 /* 197 * Give our ok for a hook to be added... 198 * All names are ok. Two names are special. 199 */ 200 static int 201 ng_etf_newhook(node_p node, hook_p hook, const char *name) 202 { 203 const etf_p etfp = NG_NODE_PRIVATE(node); 204 struct ETF_hookinfo *hpriv; 205 206 if (strcmp(name, NG_ETF_HOOK_DOWNSTREAM) == 0) { 207 etfp->downstream_hook.hook = hook; 208 NG_HOOK_SET_PRIVATE(hook, &etfp->downstream_hook); 209 etfp->packets_in = 0; 210 etfp->packets_out = 0; 211 } else if (strcmp(name, NG_ETF_HOOK_NOMATCH) == 0) { 212 etfp->nomatch_hook.hook = hook; 213 NG_HOOK_SET_PRIVATE(hook, &etfp->nomatch_hook); 214 } else { 215 /* 216 * Any other hook name is valid and can 217 * later be associated with a filter rule. 218 */ 219 hpriv = malloc(sizeof(*hpriv), 220 M_NETGRAPH_ETF, M_NOWAIT | M_ZERO); 221 if (hpriv == NULL) { 222 return (ENOMEM); 223 } 224 225 NG_HOOK_SET_PRIVATE(hook, hpriv); 226 hpriv->hook = hook; 227 } 228 return(0); 229 } 230 231 /* 232 * Get a netgraph control message. 233 * We actually receive a queue item that has a pointer to the message. 234 * If we free the item, the message will be freed too, unless we remove 235 * it from the item using NGI_GET_MSG(); 236 * The return address is also stored in the item, as an ng_ID_t, 237 * accessible as NGI_RETADDR(item); 238 * Check it is one we understand. If needed, send a response. 239 * We could save the address for an async action later, but don't here. 240 * Always free the message. 241 * The response should be in a malloc'd region that the caller can 'free'. 242 * The NG_MKRESPONSE macro does all this for us. 243 * A response is not required. 244 * Theoretically you could respond defferently to old message types if 245 * the cookie in the header didn't match what we consider to be current 246 * (so that old userland programs could continue to work). 247 */ 248 static int 249 ng_etf_rcvmsg(node_p node, item_p item, hook_p lasthook) 250 { 251 const etf_p etfp = NG_NODE_PRIVATE(node); 252 struct ng_mesg *resp = NULL; 253 int error = 0; 254 struct ng_mesg *msg; 255 256 NGI_GET_MSG(item, msg); 257 /* Deal with message according to cookie and command */ 258 switch (msg->header.typecookie) { 259 case NGM_ETF_COOKIE: 260 switch (msg->header.cmd) { 261 case NGM_ETF_GET_STATUS: 262 { 263 struct ng_etfstat *stats; 264 265 NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT); 266 if (!resp) { 267 error = ENOMEM; 268 break; 269 } 270 stats = (struct ng_etfstat *) resp->data; 271 stats->packets_in = etfp->packets_in; 272 stats->packets_out = etfp->packets_out; 273 break; 274 } 275 case NGM_ETF_SET_FLAG: 276 if (msg->header.arglen != sizeof(u_int32_t)) { 277 error = EINVAL; 278 break; 279 } 280 etfp->flags = *((u_int32_t *) msg->data); 281 break; 282 case NGM_ETF_SET_FILTER: 283 { 284 struct ng_etffilter *f; 285 struct filter *fil; 286 hook_p hook; 287 288 /* Check message long enough for this command */ 289 if (msg->header.arglen != sizeof(*f)) { 290 error = EINVAL; 291 break; 292 } 293 294 /* Make sure hook referenced exists */ 295 f = (struct ng_etffilter *)msg->data; 296 hook = ng_findhook(node, f->matchhook); 297 if (hook == NULL) { 298 error = ENOENT; 299 break; 300 } 301 302 /* and is not the downstream hook */ 303 if (hook == etfp->downstream_hook.hook) { 304 error = EINVAL; 305 break; 306 } 307 308 /* Check we don't already trap this ethertype */ 309 if (ng_etf_findentry(etfp, 310 htons(f->ethertype))) { 311 error = EEXIST; 312 break; 313 } 314 315 /* 316 * Ok, make the filter and put it in the 317 * hashtable ready for matching. 318 */ 319 fil = malloc(sizeof(*fil), 320 M_NETGRAPH_ETF, M_NOWAIT | M_ZERO); 321 if (fil == NULL) { 322 error = ENOMEM; 323 break; 324 } 325 326 fil->match_hook = hook; 327 fil->ethertype = htons(f->ethertype); 328 LIST_INSERT_HEAD( etfp->hashtable 329 + HASH(fil->ethertype), 330 fil, next); 331 } 332 break; 333 default: 334 error = EINVAL; /* unknown command */ 335 break; 336 } 337 break; 338 default: 339 error = EINVAL; /* unknown cookie type */ 340 break; 341 } 342 343 /* Take care of synchronous response, if any */ 344 NG_RESPOND_MSG(error, node, item, resp); 345 /* Free the message and return */ 346 NG_FREE_MSG(msg); 347 return(error); 348 } 349 350 /* 351 * Receive data, and do something with it. 352 * Actually we receive a queue item which holds the data. 353 * If we free the item it will also free the data unless we have previously 354 * disassociated it using the NGI_GET_etf() macro. 355 * Possibly send it out on another link after processing. 356 * Possibly do something different if it comes from different 357 * hooks. The caller will never free m , so if we use up this data 358 * or abort we must free it. 359 * 360 * If we want, we may decide to force this data to be queued and reprocessed 361 * at the netgraph NETISR time. 362 * We would do that by setting the HK_QUEUE flag on our hook. We would do that 363 * in the connect() method. 364 */ 365 static int 366 ng_etf_rcvdata(hook_p hook, item_p item ) 367 { 368 const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook)); 369 struct ether_header *eh; 370 int error = 0; 371 struct mbuf *m; 372 u_int16_t ethertype; 373 struct filter *fil; 374 375 if (NG_HOOK_PRIVATE(hook) == NULL) { /* Shouldn't happen but.. */ 376 NG_FREE_ITEM(item); 377 } 378 379 /* 380 * Everything not from the downstream hook goes to the 381 * downstream hook. But only if it matches the ethertype 382 * of the source hook. Un matching must go to/from 'nomatch'. 383 */ 384 385 /* Make sure we have an entire header */ 386 NGI_GET_M(item, m); 387 if (m->m_len < sizeof(*eh) ) { 388 m = m_pullup(m, sizeof(*eh)); 389 if (m == NULL) { 390 NG_FREE_ITEM(item); 391 return(EINVAL); 392 } 393 } 394 395 eh = mtod(m, struct ether_header *); 396 ethertype = eh->ether_type; 397 fil = ng_etf_findentry(etfp, ethertype); 398 399 /* 400 * if from downstream, select between a match hook or 401 * the nomatch hook 402 */ 403 if (hook == etfp->downstream_hook.hook) { 404 etfp->packets_in++; 405 if (fil && fil->match_hook) { 406 NG_FWD_NEW_DATA(error, item, fil->match_hook, m); 407 } else { 408 NG_FWD_NEW_DATA(error, item,etfp->nomatch_hook.hook, m); 409 } 410 } else { 411 /* 412 * It must be heading towards the downstream. 413 * Check that it's ethertype matches 414 * the filters for it's input hook. 415 * If it doesn't have one, check it's from nomatch. 416 */ 417 if ((fil && (fil->match_hook != hook)) 418 || ((fil == NULL) && (hook != etfp->nomatch_hook.hook))) { 419 NG_FREE_ITEM(item); 420 NG_FREE_M(m); 421 return (EPROTOTYPE); 422 } 423 NG_FWD_NEW_DATA( error, item, etfp->downstream_hook.hook, m); 424 if (error == 0) { 425 etfp->packets_out++; 426 } 427 } 428 return (error); 429 } 430 431 /* 432 * Do local shutdown processing.. 433 * All our links and the name have already been removed. 434 */ 435 static int 436 ng_etf_shutdown(node_p node) 437 { 438 const etf_p privdata = NG_NODE_PRIVATE(node); 439 440 NG_NODE_SET_PRIVATE(node, NULL); 441 NG_NODE_UNREF(privdata->node); 442 free(privdata, M_NETGRAPH_ETF); 443 return (0); 444 } 445 446 /* 447 * Hook disconnection 448 * 449 * For this type, removal of the last link destroys the node 450 */ 451 static int 452 ng_etf_disconnect(hook_p hook) 453 { 454 const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook)); 455 int i; 456 struct filter *fil1, *fil2; 457 458 /* purge any rules that refer to this filter */ 459 for (i = 0; i < HASHSIZE; i++) { 460 fil1 = LIST_FIRST(&etfp->hashtable[i]); 461 while (fil1 != NULL) { 462 fil2 = LIST_NEXT(fil1, next); 463 if (fil1->match_hook == hook) { 464 LIST_REMOVE(fil1, next); 465 free(fil1, M_NETGRAPH_ETF); 466 } 467 fil1 = fil2; 468 } 469 } 470 471 /* If it's not one of the special hooks, then free it */ 472 if (hook == etfp->downstream_hook.hook) { 473 etfp->downstream_hook.hook = NULL; 474 } else if (hook == etfp->nomatch_hook.hook) { 475 etfp->nomatch_hook.hook = NULL; 476 } else { 477 if (NG_HOOK_PRIVATE(hook)) /* Paranoia */ 478 free(NG_HOOK_PRIVATE(hook), M_NETGRAPH_ETF); 479 } 480 481 NG_HOOK_SET_PRIVATE(hook, NULL); 482 483 if ((NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0) 484 && (NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))) /* already shutting down? */ 485 ng_rmnode_self(NG_HOOK_NODE(hook)); 486 return (0); 487 } 488 489