xref: /freebsd/sys/netgraph/ng_etf.c (revision 9f23cbd6cae82fd77edfad7173432fa8dccd0a95)
1 /*-
2  * ng_etf.c  Ethertype filter
3  */
4 
5 /*-
6  * SPDX-License-Identifier: BSD-2-Clause
7  *
8  * Copyright (c) 2001, FreeBSD Incorporated
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice unmodified, this list of conditions, and the following
16  *    disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Author: Julian Elischer <julian@freebsd.org>
34  *
35  * $FreeBSD$
36  */
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/kernel.h>
41 #include <sys/mbuf.h>
42 #include <sys/malloc.h>
43 #include <sys/ctype.h>
44 #include <sys/errno.h>
45 #include <sys/queue.h>
46 #include <sys/syslog.h>
47 
48 #include <net/ethernet.h>
49 
50 #include <netgraph/ng_message.h>
51 #include <netgraph/ng_parse.h>
52 #include <netgraph/ng_etf.h>
53 #include <netgraph/netgraph.h>
54 
55 /* If you do complicated mallocs you may want to do this */
56 /* and use it for your mallocs */
57 #ifdef NG_SEPARATE_MALLOC
58 static MALLOC_DEFINE(M_NETGRAPH_ETF, "netgraph_etf", "netgraph etf node ");
59 #else
60 #define M_NETGRAPH_ETF M_NETGRAPH
61 #endif
62 
63 /*
64  * This section contains the netgraph method declarations for the
65  * etf node. These methods define the netgraph 'type'.
66  */
67 
68 static ng_constructor_t	ng_etf_constructor;
69 static ng_rcvmsg_t	ng_etf_rcvmsg;
70 static ng_shutdown_t	ng_etf_shutdown;
71 static ng_newhook_t	ng_etf_newhook;
72 static ng_rcvdata_t	ng_etf_rcvdata;	 /* note these are both ng_rcvdata_t */
73 static ng_disconnect_t	ng_etf_disconnect;
74 
75 /* Parse type for struct ng_etfstat */
76 static const struct ng_parse_struct_field ng_etf_stat_type_fields[]
77 	= NG_ETF_STATS_TYPE_INFO;
78 static const struct ng_parse_type ng_etf_stat_type = {
79 	&ng_parse_struct_type,
80 	&ng_etf_stat_type_fields
81 };
82 /* Parse type for struct ng_setfilter */
83 static const struct ng_parse_struct_field ng_etf_filter_type_fields[]
84 	= NG_ETF_FILTER_TYPE_INFO;
85 static const struct ng_parse_type ng_etf_filter_type = {
86 	&ng_parse_struct_type,
87 	&ng_etf_filter_type_fields
88 };
89 
90 /* List of commands and how to convert arguments to/from ASCII */
91 static const struct ng_cmdlist ng_etf_cmdlist[] = {
92 	{
93 	  NGM_ETF_COOKIE,
94 	  NGM_ETF_GET_STATUS,
95 	  "getstatus",
96 	  NULL,
97 	  &ng_etf_stat_type,
98 	},
99 	{
100 	  NGM_ETF_COOKIE,
101 	  NGM_ETF_SET_FLAG,
102 	  "setflag",
103 	  &ng_parse_int32_type,
104 	  NULL
105 	},
106 	{
107 	  NGM_ETF_COOKIE,
108 	  NGM_ETF_SET_FILTER,
109 	  "setfilter",
110 	  &ng_etf_filter_type,
111 	  NULL
112 	},
113 	{ 0 }
114 };
115 
116 /* Netgraph node type descriptor */
117 static struct ng_type typestruct = {
118 	.version =	NG_ABI_VERSION,
119 	.name =		NG_ETF_NODE_TYPE,
120 	.constructor =	ng_etf_constructor,
121 	.rcvmsg =	ng_etf_rcvmsg,
122 	.shutdown =	ng_etf_shutdown,
123 	.newhook =	ng_etf_newhook,
124 	.rcvdata =	ng_etf_rcvdata,
125 	.disconnect =	ng_etf_disconnect,
126 	.cmdlist =	ng_etf_cmdlist,
127 };
128 NETGRAPH_INIT(etf, &typestruct);
129 
130 /* Information we store for each hook on each node */
131 struct ETF_hookinfo {
132 	hook_p  hook;
133 };
134 
135 struct filter {
136 	LIST_ENTRY(filter) next;
137 	u_int16_t	ethertype;	/* network order ethertype */
138 	hook_p		match_hook;	/* Hook to use on a match */
139 };
140 
141 #define HASHSIZE 16 /* Dont change this without changing HASH() */
142 #define HASH(et) ((((et)>>12)+((et)>>8)+((et)>>4)+(et)) & 0x0f)
143 LIST_HEAD(filterhead, filter);
144 
145 /* Information we store for each node */
146 struct ETF {
147 	struct ETF_hookinfo downstream_hook;
148 	struct ETF_hookinfo nomatch_hook;
149 	node_p		node;		/* back pointer to node */
150 	u_int   	packets_in;	/* packets in from downstream */
151 	u_int   	packets_out;	/* packets out towards downstream */
152 	u_int32_t	flags;
153 	struct filterhead hashtable[HASHSIZE];
154 };
155 typedef struct ETF *etf_p;
156 
157 static struct filter *
158 ng_etf_findentry(etf_p etfp, u_int16_t ethertype)
159 {
160 	struct filterhead *chain = etfp->hashtable + HASH(ethertype);
161 	struct filter *fil;
162 
163 	LIST_FOREACH(fil, chain, next) {
164 		if (fil->ethertype == ethertype) {
165 			return (fil);
166 		}
167 	}
168 	return (NULL);
169 }
170 
171 /*
172  * Allocate the private data structure. The generic node has already
173  * been created. Link them together. We arrive with a reference to the node
174  * i.e. the reference count is incremented for us already.
175  */
176 static int
177 ng_etf_constructor(node_p node)
178 {
179 	etf_p privdata;
180 	int i;
181 
182 	/* Initialize private descriptor */
183 	privdata = malloc(sizeof(*privdata), M_NETGRAPH_ETF, M_WAITOK | M_ZERO);
184 	for (i = 0; i < HASHSIZE; i++) {
185 		LIST_INIT((privdata->hashtable + i));
186 	}
187 
188 	/* Link structs together; this counts as our one reference to node */
189 	NG_NODE_SET_PRIVATE(node, privdata);
190 	privdata->node = node;
191 	return (0);
192 }
193 
194 /*
195  * Give our ok for a hook to be added...
196  * All names are ok. Two names are special.
197  */
198 static int
199 ng_etf_newhook(node_p node, hook_p hook, const char *name)
200 {
201 	const etf_p etfp = NG_NODE_PRIVATE(node);
202 	struct ETF_hookinfo *hpriv;
203 
204 	if (strcmp(name, NG_ETF_HOOK_DOWNSTREAM) == 0) {
205 		etfp->downstream_hook.hook = hook;
206 		NG_HOOK_SET_PRIVATE(hook, &etfp->downstream_hook);
207 		etfp->packets_in = 0;
208 		etfp->packets_out = 0;
209 	} else if (strcmp(name, NG_ETF_HOOK_NOMATCH) == 0) {
210 		etfp->nomatch_hook.hook = hook;
211 		NG_HOOK_SET_PRIVATE(hook, &etfp->nomatch_hook);
212 	} else {
213 		/*
214 		 * Any other hook name is valid and can
215 		 * later be associated with a filter rule.
216 		 */
217 		hpriv = malloc(sizeof(*hpriv),
218 			M_NETGRAPH_ETF, M_NOWAIT | M_ZERO);
219 		if (hpriv == NULL) {
220 			return (ENOMEM);
221 		}
222 
223 		NG_HOOK_SET_PRIVATE(hook, hpriv);
224 		hpriv->hook = hook;
225 	}
226 	return(0);
227 }
228 
229 /*
230  * Get a netgraph control message.
231  * We actually receive a queue item that has a pointer to the message.
232  * If we free the item, the message will be freed too, unless we remove
233  * it from the item using NGI_GET_MSG();
234  * The return address is also stored in the item, as an ng_ID_t,
235  * accessible as NGI_RETADDR(item);
236  * Check it is one we understand. If needed, send a response.
237  * We could save the address for an async action later, but don't here.
238  * Always free the message.
239  * The response should be in a malloc'd region that the caller can 'free'.
240  * The NG_MKRESPONSE macro does all this for us.
241  * A response is not required.
242  * Theoretically you could respond defferently to old message types if
243  * the cookie in the header didn't match what we consider to be current
244  * (so that old userland programs could continue to work).
245  */
246 static int
247 ng_etf_rcvmsg(node_p node, item_p item, hook_p lasthook)
248 {
249 	const etf_p etfp = NG_NODE_PRIVATE(node);
250 	struct ng_mesg *resp = NULL;
251 	int error = 0;
252 	struct ng_mesg *msg;
253 
254 	NGI_GET_MSG(item, msg);
255 	/* Deal with message according to cookie and command */
256 	switch (msg->header.typecookie) {
257 	case NGM_ETF_COOKIE:
258 		switch (msg->header.cmd) {
259 		case NGM_ETF_GET_STATUS:
260 		    {
261 			struct ng_etfstat *stats;
262 
263 			NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT);
264 			if (!resp) {
265 				error = ENOMEM;
266 				break;
267 			}
268 			stats = (struct ng_etfstat *) resp->data;
269 			stats->packets_in = etfp->packets_in;
270 			stats->packets_out = etfp->packets_out;
271 			break;
272 		    }
273 		case NGM_ETF_SET_FLAG:
274 			if (msg->header.arglen != sizeof(u_int32_t)) {
275 				error = EINVAL;
276 				break;
277 			}
278 			etfp->flags = *((u_int32_t *) msg->data);
279 			break;
280 		case NGM_ETF_SET_FILTER:
281 			{
282 				struct ng_etffilter *f;
283 				struct filter *fil;
284 				hook_p  hook;
285 
286 				/* Check message long enough for this command */
287 				if (msg->header.arglen != sizeof(*f)) {
288 					error = EINVAL;
289 					break;
290 				}
291 
292 				/* Make sure hook referenced exists */
293 				f = (struct ng_etffilter *)msg->data;
294 				hook = ng_findhook(node, f->matchhook);
295 				if (hook == NULL) {
296 					error = ENOENT;
297 					break;
298 				}
299 
300 				/* and is not the downstream hook */
301 				if (hook == etfp->downstream_hook.hook) {
302 					error = EINVAL;
303 					break;
304 				}
305 
306 				/* Check we don't already trap this ethertype */
307 				if (ng_etf_findentry(etfp,
308 						htons(f->ethertype))) {
309 					error = EEXIST;
310 					break;
311 				}
312 
313 				/*
314 				 * Ok, make the filter and put it in the
315 				 * hashtable ready for matching.
316 				 */
317 				fil = malloc(sizeof(*fil),
318 					M_NETGRAPH_ETF, M_NOWAIT | M_ZERO);
319 				if (fil == NULL) {
320 					error = ENOMEM;
321 					break;
322 				}
323 
324 				fil->match_hook = hook;
325 				fil->ethertype = htons(f->ethertype);
326 				LIST_INSERT_HEAD( etfp->hashtable
327 					+ HASH(fil->ethertype),
328 						fil, next);
329 			}
330 			break;
331 		default:
332 			error = EINVAL;		/* unknown command */
333 			break;
334 		}
335 		break;
336 	default:
337 		error = EINVAL;			/* unknown cookie type */
338 		break;
339 	}
340 
341 	/* Take care of synchronous response, if any */
342 	NG_RESPOND_MSG(error, node, item, resp);
343 	/* Free the message and return */
344 	NG_FREE_MSG(msg);
345 	return(error);
346 }
347 
348 /*
349  * Receive data, and do something with it.
350  * Actually we receive a queue item which holds the data.
351  * If we free the item it will also free the data unless we have previously
352  * disassociated it using the NGI_GET_etf() macro.
353  * Possibly send it out on another link after processing.
354  * Possibly do something different if it comes from different
355  * hooks. The caller will never free m , so if we use up this data
356  * or abort we must free it.
357  *
358  * If we want, we may decide to force this data to be queued and reprocessed
359  * at the netgraph NETISR time.
360  * We would do that by setting the HK_QUEUE flag on our hook. We would do that
361  * in the connect() method.
362  */
363 static int
364 ng_etf_rcvdata(hook_p hook, item_p item )
365 {
366 	const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
367 	struct ether_header *eh;
368 	int error = 0;
369 	struct mbuf *m;
370 	u_int16_t ethertype;
371 	struct filter *fil;
372 
373 	if (NG_HOOK_PRIVATE(hook) == NULL) { /* Shouldn't happen but.. */
374 		NG_FREE_ITEM(item);
375 	}
376 
377 	/*
378 	 * Everything not from the downstream hook goes to the
379 	 * downstream hook. But only if it matches the ethertype
380 	 * of the source hook. Un matching must go to/from 'nomatch'.
381 	 */
382 
383 	/* Make sure we have an entire header */
384 	NGI_GET_M(item, m);
385 	if (m->m_len < sizeof(*eh) ) {
386 		m = m_pullup(m, sizeof(*eh));
387 		if (m == NULL) {
388 			NG_FREE_ITEM(item);
389 			return(EINVAL);
390 		}
391 	}
392 
393 	eh = mtod(m, struct ether_header *);
394 	ethertype = eh->ether_type;
395 	fil = ng_etf_findentry(etfp, ethertype);
396 
397 	/*
398 	 * if from downstream, select between a match hook or
399 	 * the nomatch hook
400 	 */
401 	if (hook == etfp->downstream_hook.hook) {
402 		etfp->packets_in++;
403 		if (fil && fil->match_hook) {
404 			NG_FWD_NEW_DATA(error, item, fil->match_hook, m);
405 		} else {
406 			NG_FWD_NEW_DATA(error, item,etfp->nomatch_hook.hook, m);
407 		}
408 	} else {
409 		/*
410 		 * It must be heading towards the downstream.
411 		 * Check that it's ethertype matches
412 		 * the filters for it's input hook.
413 		 * If it doesn't have one, check it's from nomatch.
414 		 */
415 		if ((fil && (fil->match_hook != hook))
416 		|| ((fil == NULL) && (hook != etfp->nomatch_hook.hook))) {
417 			NG_FREE_ITEM(item);
418 			NG_FREE_M(m);
419 			return (EPROTOTYPE);
420 		}
421 		NG_FWD_NEW_DATA( error, item, etfp->downstream_hook.hook, m);
422 		if (error == 0) {
423 			etfp->packets_out++;
424 		}
425 	}
426 	return (error);
427 }
428 
429 /*
430  * Do local shutdown processing..
431  * All our links and the name have already been removed.
432  */
433 static int
434 ng_etf_shutdown(node_p node)
435 {
436 	const etf_p privdata = NG_NODE_PRIVATE(node);
437 
438 	NG_NODE_SET_PRIVATE(node, NULL);
439 	NG_NODE_UNREF(privdata->node);
440 	free(privdata, M_NETGRAPH_ETF);
441 	return (0);
442 }
443 
444 /*
445  * Hook disconnection
446  *
447  * For this type, removal of the last link destroys the node
448  */
449 static int
450 ng_etf_disconnect(hook_p hook)
451 {
452 	const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
453 	int i;
454 	struct filter *fil1, *fil2;
455 
456 	/* purge any rules that refer to this filter */
457 	for (i = 0; i < HASHSIZE; i++) {
458 		fil1 = LIST_FIRST(&etfp->hashtable[i]);
459 		while (fil1 != NULL) {
460 			fil2 = LIST_NEXT(fil1, next);
461 			if (fil1->match_hook == hook) {
462 				LIST_REMOVE(fil1, next);
463 				free(fil1, M_NETGRAPH_ETF);
464 			}
465 			fil1 = fil2;
466 		}
467 	}
468 
469 	/* If it's not one of the special hooks, then free it */
470 	if (hook == etfp->downstream_hook.hook) {
471 		etfp->downstream_hook.hook = NULL;
472 	} else if (hook == etfp->nomatch_hook.hook) {
473 		etfp->nomatch_hook.hook = NULL;
474 	} else {
475 		if (NG_HOOK_PRIVATE(hook)) /* Paranoia */
476 			free(NG_HOOK_PRIVATE(hook), M_NETGRAPH_ETF);
477 	}
478 
479 	NG_HOOK_SET_PRIVATE(hook, NULL);
480 
481 	if ((NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0)
482 	&& (NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))) /* already shutting down? */
483 		ng_rmnode_self(NG_HOOK_NODE(hook));
484 	return (0);
485 }
486