1 /* $OpenBSD: if_pflow.c,v 1.100 2023/11/09 08:53:20 mvs Exp $ */ 2 3 /* 4 * Copyright (c) 2023 Rubicon Communications, LLC (Netgate) 5 * Copyright (c) 2011 Florian Obser <florian@narrans.de> 6 * Copyright (c) 2011 Sebastian Benoit <benoit-lists@fb12.de> 7 * Copyright (c) 2008 Henning Brauer <henning@openbsd.org> 8 * Copyright (c) 2008 Joerg Goltermann <jg@osn.de> 9 * 10 * Permission to use, copy, modify, and distribute this software for any 11 * purpose with or without fee is hereby granted, provided that the above 12 * copyright notice and this permission notice appear in all copies. 13 * 14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 18 * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN 19 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT 20 * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 21 */ 22 23 #include <sys/cdefs.h> 24 #include <sys/param.h> 25 #include <sys/bus.h> 26 #include <sys/callout.h> 27 #include <sys/endian.h> 28 #include <sys/interrupt.h> 29 #include <sys/kernel.h> 30 #include <sys/malloc.h> 31 #include <sys/module.h> 32 #include <sys/mbuf.h> 33 #include <sys/socket.h> 34 #include <sys/socketvar.h> 35 #include <sys/sockio.h> 36 #include <sys/sysctl.h> 37 #include <sys/systm.h> 38 #include <sys/priv.h> 39 40 #include <net/if.h> 41 #include <net/if_types.h> 42 #include <net/bpf.h> 43 #include <net/route.h> 44 #include <netinet/in.h> 45 #include <netinet/if_ether.h> 46 #include <netinet/tcp.h> 47 48 #include <netinet/ip.h> 49 #include <netinet/ip_icmp.h> 50 #include <netinet/ip_var.h> 51 #include <netinet/udp.h> 52 #include <netinet/udp_var.h> 53 #include <netinet/in_pcb.h> 54 55 #include <netlink/netlink.h> 56 #include <netlink/netlink_ctl.h> 57 #include <netlink/netlink_generic.h> 58 #include <netlink/netlink_message_writer.h> 59 60 #include <net/pfvar.h> 61 #include <net/pflow.h> 62 #include "net/if_var.h" 63 64 #define PFLOW_MINMTU \ 65 (sizeof(struct pflow_header) + sizeof(struct pflow_flow)) 66 67 #ifdef PFLOWDEBUG 68 #define DPRINTF(x) do { printf x ; } while (0) 69 #else 70 #define DPRINTF(x) 71 #endif 72 73 enum pflow_family_t { 74 PFLOW_INET, 75 PFLOW_INET6, 76 PFLOW_NAT4, 77 }; 78 79 static void pflow_output_process(void *); 80 static int pflow_create(int); 81 static int pflow_destroy(int, bool); 82 static int pflow_calc_mtu(struct pflow_softc *, int, int); 83 static void pflow_setmtu(struct pflow_softc *, int); 84 static int pflowvalidsockaddr(const struct sockaddr *, int); 85 86 static struct mbuf *pflow_get_mbuf(struct pflow_softc *, u_int16_t); 87 static void pflow_flush(struct pflow_softc *); 88 static int pflow_sendout_v5(struct pflow_softc *); 89 static int pflow_sendout_ipfix(struct pflow_softc *, enum pflow_family_t); 90 static int pflow_sendout_ipfix_tmpl(struct pflow_softc *); 91 static int pflow_sendout_mbuf(struct pflow_softc *, struct mbuf *); 92 static int sysctl_pflowstats(SYSCTL_HANDLER_ARGS); 93 static void pflow_timeout(void *); 94 static void pflow_timeout6(void *); 95 static void pflow_timeout_tmpl(void *); 96 static void pflow_timeout_nat4(void *); 97 static void copy_flow_data(struct pflow_flow *, struct pflow_flow *, 98 const struct pf_kstate *, struct pf_state_key *, int, int); 99 static void copy_flow_ipfix_4_data(struct pflow_ipfix_flow4 *, 100 struct pflow_ipfix_flow4 *, const struct pf_kstate *, struct pf_state_key *, 101 struct pflow_softc *, int, int); 102 static void copy_flow_ipfix_6_data(struct pflow_ipfix_flow6 *, 103 struct pflow_ipfix_flow6 *, const struct pf_kstate *, struct pf_state_key *, 104 struct pflow_softc *, int, int); 105 static int pflow_pack_flow(const struct pf_kstate *, struct pf_state_key *, 106 struct pflow_softc *); 107 static int pflow_pack_flow_ipfix(const struct pf_kstate *, struct pf_state_key *, 108 struct pflow_softc *); 109 static void export_pflow(const struct pf_kstate *); 110 static int export_pflow_if(const struct pf_kstate*, struct pf_state_key *, 111 struct pflow_softc *); 112 static int copy_flow_to_m(struct pflow_flow *flow, struct pflow_softc *sc); 113 static int copy_flow_ipfix_4_to_m(struct pflow_ipfix_flow4 *flow, 114 struct pflow_softc *sc); 115 static int copy_flow_ipfix_6_to_m(struct pflow_ipfix_flow6 *flow, 116 struct pflow_softc *sc); 117 static int copy_nat_ipfix_4_to_m(struct pflow_ipfix_nat4 *, 118 const struct pf_kstate *, struct pflow_softc *, 119 uint8_t, uint64_t); 120 121 static const char pflowname[] = "pflow"; 122 123 enum pflowstat_counters { 124 pflow_flows, 125 pflow_packets, 126 pflow_onomem, 127 pflow_oerrors, 128 pflow_ncounters, 129 }; 130 struct pflowstats_ctr { 131 counter_u64_t c[pflow_ncounters]; 132 }; 133 134 /** 135 * Locking concept 136 * 137 * The list of pflow devices (V_pflowif_list) is managed through epoch. 138 * It is safe to read the list without locking (while in NET_EPOCH). 139 * There may only be one simultaneous modifier, hence we need V_pflow_list_mtx 140 * on every add/delete. 141 * 142 * Each pflow interface protects its own data with the sc_lock mutex. 143 * 144 * We do not require any pf locks, and in fact expect to be called without 145 * hashrow locks held. 146 **/ 147 148 VNET_DEFINE(struct unrhdr *, pflow_unr); 149 #define V_pflow_unr VNET(pflow_unr) 150 VNET_DEFINE(CK_LIST_HEAD(, pflow_softc), pflowif_list); 151 #define V_pflowif_list VNET(pflowif_list) 152 VNET_DEFINE(struct mtx, pflowif_list_mtx); 153 #define V_pflowif_list_mtx VNET(pflowif_list_mtx) 154 VNET_DEFINE(struct pflowstats_ctr, pflowstat); 155 #define V_pflowstats VNET(pflowstat) 156 157 #define PFLOW_LOCK(_sc) mtx_lock(&(_sc)->sc_lock) 158 #define PFLOW_UNLOCK(_sc) mtx_unlock(&(_sc)->sc_lock) 159 #define PFLOW_ASSERT(_sc) mtx_assert(&(_sc)->sc_lock, MA_OWNED) 160 161 SYSCTL_NODE(_net, OID_AUTO, pflow, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 162 "PFLOW"); 163 SYSCTL_PROC(_net_pflow, OID_AUTO, stats, CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, 164 0, 0, sysctl_pflowstats, "S,pflowstats", 165 "PFLOW statistics (struct pflowstats, net/if_pflow.h)"); 166 167 static inline void 168 pflowstat_inc(enum pflowstat_counters c) 169 { 170 counter_u64_add(V_pflowstats.c[c], 1); 171 } 172 173 static void 174 vnet_pflowattach(void) 175 { 176 CK_LIST_INIT(&V_pflowif_list); 177 mtx_init(&V_pflowif_list_mtx, "pflow interface list mtx", NULL, MTX_DEF); 178 179 V_pflow_unr = new_unrhdr(0, PFLOW_MAX_ENTRIES - 1, &V_pflowif_list_mtx); 180 181 for (int i = 0; i < pflow_ncounters; i++) 182 V_pflowstats.c[i] = counter_u64_alloc(M_WAITOK); 183 } 184 VNET_SYSINIT(vnet_pflowattach, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY, 185 vnet_pflowattach, NULL); 186 187 static void 188 vnet_pflowdetach(void) 189 { 190 struct pflow_softc *sc; 191 192 CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) { 193 pflow_destroy(sc->sc_id, false); 194 } 195 196 MPASS(CK_LIST_EMPTY(&V_pflowif_list)); 197 delete_unrhdr(V_pflow_unr); 198 mtx_destroy(&V_pflowif_list_mtx); 199 200 for (int i = 0; i < pflow_ncounters; i++) 201 counter_u64_free(V_pflowstats.c[i]); 202 } 203 VNET_SYSUNINIT(vnet_pflowdetach, SI_SUB_PROTO_FIREWALL, SI_ORDER_FOURTH, 204 vnet_pflowdetach, NULL); 205 206 static void 207 vnet_pflow_finalise(void) 208 { 209 /* 210 * Ensure we've freed all interfaces, and do not have pending 211 * epoch cleanup calls. 212 */ 213 NET_EPOCH_DRAIN_CALLBACKS(); 214 } 215 VNET_SYSUNINIT(vnet_pflow_finalise, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD, 216 vnet_pflow_finalise, NULL); 217 218 static void 219 pflow_output_process(void *arg) 220 { 221 struct mbufq ml; 222 struct pflow_softc *sc = arg; 223 struct mbuf *m; 224 225 mbufq_init(&ml, 0); 226 227 PFLOW_LOCK(sc); 228 mbufq_concat(&ml, &sc->sc_outputqueue); 229 PFLOW_UNLOCK(sc); 230 231 CURVNET_SET(sc->sc_vnet); 232 while ((m = mbufq_dequeue(&ml)) != NULL) { 233 pflow_sendout_mbuf(sc, m); 234 } 235 CURVNET_RESTORE(); 236 } 237 238 static int 239 pflow_create(int unit) 240 { 241 struct pflow_softc *pflowif; 242 int error; 243 244 pflowif = malloc(sizeof(*pflowif), M_DEVBUF, M_WAITOK|M_ZERO); 245 mtx_init(&pflowif->sc_lock, "pflowlk", NULL, MTX_DEF); 246 pflowif->sc_version = PFLOW_PROTO_DEFAULT; 247 pflowif->sc_observation_dom = PFLOW_ENGINE_TYPE; 248 249 /* ipfix template init */ 250 bzero(&pflowif->sc_tmpl_ipfix,sizeof(pflowif->sc_tmpl_ipfix)); 251 pflowif->sc_tmpl_ipfix.set_header.set_id = 252 htons(PFLOW_IPFIX_TMPL_SET_ID); 253 pflowif->sc_tmpl_ipfix.set_header.set_length = 254 htons(sizeof(struct pflow_ipfix_tmpl)); 255 256 /* ipfix IPv4 template */ 257 pflowif->sc_tmpl_ipfix.ipv4_tmpl.h.tmpl_id = 258 htons(PFLOW_IPFIX_TMPL_IPV4_ID); 259 pflowif->sc_tmpl_ipfix.ipv4_tmpl.h.field_count 260 = htons(PFLOW_IPFIX_TMPL_IPV4_FIELD_COUNT); 261 pflowif->sc_tmpl_ipfix.ipv4_tmpl.src_ip.field_id = 262 htons(PFIX_IE_sourceIPv4Address); 263 pflowif->sc_tmpl_ipfix.ipv4_tmpl.src_ip.len = htons(4); 264 pflowif->sc_tmpl_ipfix.ipv4_tmpl.dest_ip.field_id = 265 htons(PFIX_IE_destinationIPv4Address); 266 pflowif->sc_tmpl_ipfix.ipv4_tmpl.dest_ip.len = htons(4); 267 pflowif->sc_tmpl_ipfix.ipv4_tmpl.if_index_in.field_id = 268 htons(PFIX_IE_ingressInterface); 269 pflowif->sc_tmpl_ipfix.ipv4_tmpl.if_index_in.len = htons(4); 270 pflowif->sc_tmpl_ipfix.ipv4_tmpl.if_index_out.field_id = 271 htons(PFIX_IE_egressInterface); 272 pflowif->sc_tmpl_ipfix.ipv4_tmpl.if_index_out.len = htons(4); 273 pflowif->sc_tmpl_ipfix.ipv4_tmpl.packets.field_id = 274 htons(PFIX_IE_packetDeltaCount); 275 pflowif->sc_tmpl_ipfix.ipv4_tmpl.packets.len = htons(8); 276 pflowif->sc_tmpl_ipfix.ipv4_tmpl.octets.field_id = 277 htons(PFIX_IE_octetDeltaCount); 278 pflowif->sc_tmpl_ipfix.ipv4_tmpl.octets.len = htons(8); 279 pflowif->sc_tmpl_ipfix.ipv4_tmpl.start.field_id = 280 htons(PFIX_IE_flowStartMilliseconds); 281 pflowif->sc_tmpl_ipfix.ipv4_tmpl.start.len = htons(8); 282 pflowif->sc_tmpl_ipfix.ipv4_tmpl.finish.field_id = 283 htons(PFIX_IE_flowEndMilliseconds); 284 pflowif->sc_tmpl_ipfix.ipv4_tmpl.finish.len = htons(8); 285 pflowif->sc_tmpl_ipfix.ipv4_tmpl.src_port.field_id = 286 htons(PFIX_IE_sourceTransportPort); 287 pflowif->sc_tmpl_ipfix.ipv4_tmpl.src_port.len = htons(2); 288 pflowif->sc_tmpl_ipfix.ipv4_tmpl.dest_port.field_id = 289 htons(PFIX_IE_destinationTransportPort); 290 pflowif->sc_tmpl_ipfix.ipv4_tmpl.dest_port.len = htons(2); 291 pflowif->sc_tmpl_ipfix.ipv4_tmpl.tos.field_id = 292 htons(PFIX_IE_ipClassOfService); 293 pflowif->sc_tmpl_ipfix.ipv4_tmpl.tos.len = htons(1); 294 pflowif->sc_tmpl_ipfix.ipv4_tmpl.protocol.field_id = 295 htons(PFIX_IE_protocolIdentifier); 296 pflowif->sc_tmpl_ipfix.ipv4_tmpl.protocol.len = htons(1); 297 298 /* ipfix IPv6 template */ 299 pflowif->sc_tmpl_ipfix.ipv6_tmpl.h.tmpl_id = 300 htons(PFLOW_IPFIX_TMPL_IPV6_ID); 301 pflowif->sc_tmpl_ipfix.ipv6_tmpl.h.field_count = 302 htons(PFLOW_IPFIX_TMPL_IPV6_FIELD_COUNT); 303 pflowif->sc_tmpl_ipfix.ipv6_tmpl.src_ip.field_id = 304 htons(PFIX_IE_sourceIPv6Address); 305 pflowif->sc_tmpl_ipfix.ipv6_tmpl.src_ip.len = htons(16); 306 pflowif->sc_tmpl_ipfix.ipv6_tmpl.dest_ip.field_id = 307 htons(PFIX_IE_destinationIPv6Address); 308 pflowif->sc_tmpl_ipfix.ipv6_tmpl.dest_ip.len = htons(16); 309 pflowif->sc_tmpl_ipfix.ipv6_tmpl.if_index_in.field_id = 310 htons(PFIX_IE_ingressInterface); 311 pflowif->sc_tmpl_ipfix.ipv6_tmpl.if_index_in.len = htons(4); 312 pflowif->sc_tmpl_ipfix.ipv6_tmpl.if_index_out.field_id = 313 htons(PFIX_IE_egressInterface); 314 pflowif->sc_tmpl_ipfix.ipv6_tmpl.if_index_out.len = htons(4); 315 pflowif->sc_tmpl_ipfix.ipv6_tmpl.packets.field_id = 316 htons(PFIX_IE_packetDeltaCount); 317 pflowif->sc_tmpl_ipfix.ipv6_tmpl.packets.len = htons(8); 318 pflowif->sc_tmpl_ipfix.ipv6_tmpl.octets.field_id = 319 htons(PFIX_IE_octetDeltaCount); 320 pflowif->sc_tmpl_ipfix.ipv6_tmpl.octets.len = htons(8); 321 pflowif->sc_tmpl_ipfix.ipv6_tmpl.start.field_id = 322 htons(PFIX_IE_flowStartMilliseconds); 323 pflowif->sc_tmpl_ipfix.ipv6_tmpl.start.len = htons(8); 324 pflowif->sc_tmpl_ipfix.ipv6_tmpl.finish.field_id = 325 htons(PFIX_IE_flowEndMilliseconds); 326 pflowif->sc_tmpl_ipfix.ipv6_tmpl.finish.len = htons(8); 327 pflowif->sc_tmpl_ipfix.ipv6_tmpl.src_port.field_id = 328 htons(PFIX_IE_sourceTransportPort); 329 pflowif->sc_tmpl_ipfix.ipv6_tmpl.src_port.len = htons(2); 330 pflowif->sc_tmpl_ipfix.ipv6_tmpl.dest_port.field_id = 331 htons(PFIX_IE_destinationTransportPort); 332 pflowif->sc_tmpl_ipfix.ipv6_tmpl.dest_port.len = htons(2); 333 pflowif->sc_tmpl_ipfix.ipv6_tmpl.tos.field_id = 334 htons(PFIX_IE_ipClassOfService); 335 pflowif->sc_tmpl_ipfix.ipv6_tmpl.tos.len = htons(1); 336 pflowif->sc_tmpl_ipfix.ipv6_tmpl.protocol.field_id = 337 htons(PFIX_IE_protocolIdentifier); 338 pflowif->sc_tmpl_ipfix.ipv6_tmpl.protocol.len = htons(1); 339 340 /* NAT44 create template */ 341 pflowif->sc_tmpl_ipfix.nat44_tmpl.h.tmpl_id = 342 htons(PFLOW_IPFIX_TMPL_NAT44_ID); 343 pflowif->sc_tmpl_ipfix.nat44_tmpl.h.field_count = 344 htons(PFLOW_IPFIX_TMPL_NAT44_FIELD_COUNT); 345 pflowif->sc_tmpl_ipfix.nat44_tmpl.timestamp.field_id = 346 htons(PFIX_IE_timeStamp); 347 pflowif->sc_tmpl_ipfix.nat44_tmpl.timestamp.len = 348 htons(8); 349 pflowif->sc_tmpl_ipfix.nat44_tmpl.nat_event.field_id = 350 htons(PFIX_IE_natEvent); 351 pflowif->sc_tmpl_ipfix.nat44_tmpl.nat_event.len = 352 htons(1); 353 pflowif->sc_tmpl_ipfix.nat44_tmpl.protocol.field_id = 354 htons(PFIX_IE_protocolIdentifier); 355 pflowif->sc_tmpl_ipfix.nat44_tmpl.protocol.len = htons(1); 356 pflowif->sc_tmpl_ipfix.nat44_tmpl.src_ip.field_id = 357 htons(PFIX_IE_sourceIPv4Address); 358 pflowif->sc_tmpl_ipfix.nat44_tmpl.src_ip.len = 359 htons(4); 360 pflowif->sc_tmpl_ipfix.nat44_tmpl.src_port.field_id = 361 htons(PFIX_IE_sourceTransportPort); 362 pflowif->sc_tmpl_ipfix.nat44_tmpl.src_port.len = htons(2); 363 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_src_ip.field_id = 364 htons(PFIX_IE_postNATSourceIPv4Address); 365 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_src_ip.len = 366 htons(4); 367 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_src_port.field_id = 368 htons(PFIX_IE_postNAPTSourceTransportPort); 369 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_src_port.len = 370 htons(2); 371 pflowif->sc_tmpl_ipfix.nat44_tmpl.dst_ip.field_id = 372 htons(PFIX_IE_destinationIPv4Address); 373 pflowif->sc_tmpl_ipfix.nat44_tmpl.dst_ip.len = 374 htons(4); 375 pflowif->sc_tmpl_ipfix.nat44_tmpl.dst_port.field_id = 376 htons(PFIX_IE_destinationTransportPort); 377 pflowif->sc_tmpl_ipfix.nat44_tmpl.dst_port.len = htons(2); 378 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_dst_ip.field_id = 379 htons(PFIX_IE_postNATDestinationIPv4Address); 380 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_dst_ip.len = 381 htons(4); 382 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_dst_port.field_id = 383 htons(PFIX_IE_postNAPTDestinationTransportPort); 384 pflowif->sc_tmpl_ipfix.nat44_tmpl.postnat_dst_port.len = 385 htons(2); 386 387 pflowif->sc_id = unit; 388 pflowif->sc_vnet = curvnet; 389 390 mbufq_init(&pflowif->sc_outputqueue, 8192); 391 pflow_setmtu(pflowif, ETHERMTU); 392 393 callout_init_mtx(&pflowif->sc_tmo, &pflowif->sc_lock, 0); 394 callout_init_mtx(&pflowif->sc_tmo6, &pflowif->sc_lock, 0); 395 callout_init_mtx(&pflowif->sc_tmo_nat4, &pflowif->sc_lock, 0); 396 callout_init_mtx(&pflowif->sc_tmo_tmpl, &pflowif->sc_lock, 0); 397 398 error = swi_add(&pflowif->sc_swi_ie, pflowname, pflow_output_process, 399 pflowif, SWI_NET, INTR_MPSAFE, &pflowif->sc_swi_cookie); 400 if (error) { 401 free(pflowif, M_DEVBUF); 402 return (error); 403 } 404 405 /* Insert into list of pflows */ 406 mtx_lock(&V_pflowif_list_mtx); 407 CK_LIST_INSERT_HEAD(&V_pflowif_list, pflowif, sc_next); 408 mtx_unlock(&V_pflowif_list_mtx); 409 410 V_pflow_export_state_ptr = export_pflow; 411 412 return (0); 413 } 414 415 static void 416 pflow_free_cb(struct epoch_context *ctx) 417 { 418 struct pflow_softc *sc; 419 420 sc = __containerof(ctx, struct pflow_softc, sc_epoch_ctx); 421 422 free(sc, M_DEVBUF); 423 } 424 425 static int 426 pflow_destroy(int unit, bool drain) 427 { 428 struct pflow_softc *sc; 429 int error __diagused; 430 431 mtx_lock(&V_pflowif_list_mtx); 432 CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) { 433 if (sc->sc_id == unit) 434 break; 435 } 436 if (sc == NULL) { 437 mtx_unlock(&V_pflowif_list_mtx); 438 return (ENOENT); 439 } 440 CK_LIST_REMOVE(sc, sc_next); 441 if (CK_LIST_EMPTY(&V_pflowif_list)) 442 V_pflow_export_state_ptr = NULL; 443 mtx_unlock(&V_pflowif_list_mtx); 444 445 sc->sc_dying = 1; 446 447 if (drain) { 448 /* Let's be sure no one is using this interface any more. */ 449 NET_EPOCH_DRAIN_CALLBACKS(); 450 } 451 452 error = swi_remove(sc->sc_swi_cookie); 453 MPASS(error == 0); 454 error = intr_event_destroy(sc->sc_swi_ie); 455 MPASS(error == 0); 456 457 callout_drain(&sc->sc_tmo); 458 callout_drain(&sc->sc_tmo6); 459 callout_drain(&sc->sc_tmo_nat4); 460 callout_drain(&sc->sc_tmo_tmpl); 461 462 m_freem(sc->sc_mbuf); 463 m_freem(sc->sc_mbuf6); 464 m_freem(sc->sc_mbuf_nat4); 465 466 PFLOW_LOCK(sc); 467 mbufq_drain(&sc->sc_outputqueue); 468 if (sc->so != NULL) { 469 soclose(sc->so); 470 sc->so = NULL; 471 } 472 if (sc->sc_flowdst != NULL) 473 free(sc->sc_flowdst, M_DEVBUF); 474 if (sc->sc_flowsrc != NULL) 475 free(sc->sc_flowsrc, M_DEVBUF); 476 PFLOW_UNLOCK(sc); 477 478 mtx_destroy(&sc->sc_lock); 479 480 free_unr(V_pflow_unr, unit); 481 482 NET_EPOCH_CALL(pflow_free_cb, &sc->sc_epoch_ctx); 483 484 return (0); 485 } 486 487 static int 488 pflowvalidsockaddr(const struct sockaddr *sa, int ignore_port) 489 { 490 const struct sockaddr_in6 *sin6; 491 const struct sockaddr_in *sin; 492 493 if (sa == NULL) 494 return (0); 495 switch(sa->sa_family) { 496 case AF_INET: 497 sin = (const struct sockaddr_in *)sa; 498 return (sin->sin_addr.s_addr != INADDR_ANY && 499 (ignore_port || sin->sin_port != 0)); 500 case AF_INET6: 501 sin6 = (const struct sockaddr_in6 *)sa; 502 return (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) && 503 (ignore_port || sin6->sin6_port != 0)); 504 default: 505 return (0); 506 } 507 } 508 509 int 510 pflow_calc_mtu(struct pflow_softc *sc, int mtu, int hdrsz) 511 { 512 size_t min; 513 514 sc->sc_maxcount4 = (mtu - hdrsz - 515 sizeof(struct udpiphdr)) / sizeof(struct pflow_ipfix_flow4); 516 sc->sc_maxcount6 = (mtu - hdrsz - 517 sizeof(struct udpiphdr)) / sizeof(struct pflow_ipfix_flow6); 518 sc->sc_maxcount_nat4 = (mtu - hdrsz - 519 sizeof(struct udpiphdr)) / sizeof(struct pflow_ipfix_nat4); 520 if (sc->sc_maxcount4 > PFLOW_MAXFLOWS) 521 sc->sc_maxcount4 = PFLOW_MAXFLOWS; 522 if (sc->sc_maxcount6 > PFLOW_MAXFLOWS) 523 sc->sc_maxcount6 = PFLOW_MAXFLOWS; 524 if (sc->sc_maxcount_nat4 > PFLOW_MAXFLOWS) 525 sc->sc_maxcount_nat4 = PFLOW_MAXFLOWS; 526 527 min = MIN(sc->sc_maxcount4 * sizeof(struct pflow_ipfix_flow4), 528 sc->sc_maxcount6 * sizeof(struct pflow_ipfix_flow6)); 529 min = MIN(min, sc->sc_maxcount_nat4 * sizeof(struct pflow_ipfix_nat4)); 530 531 return (hdrsz + sizeof(struct udpiphdr) + min); 532 } 533 534 static void 535 pflow_setmtu(struct pflow_softc *sc, int mtu_req) 536 { 537 int mtu; 538 539 mtu = mtu_req; 540 541 switch (sc->sc_version) { 542 case PFLOW_PROTO_5: 543 sc->sc_maxcount = (mtu - sizeof(struct pflow_header) - 544 sizeof(struct udpiphdr)) / sizeof(struct pflow_flow); 545 if (sc->sc_maxcount > PFLOW_MAXFLOWS) 546 sc->sc_maxcount = PFLOW_MAXFLOWS; 547 break; 548 case PFLOW_PROTO_10: 549 pflow_calc_mtu(sc, mtu, sizeof(struct pflow_v10_header)); 550 break; 551 default: /* NOTREACHED */ 552 break; 553 } 554 } 555 556 static struct mbuf * 557 pflow_get_mbuf(struct pflow_softc *sc, u_int16_t set_id) 558 { 559 struct pflow_set_header set_hdr; 560 struct pflow_header h; 561 struct mbuf *m; 562 563 MGETHDR(m, M_NOWAIT, MT_DATA); 564 if (m == NULL) { 565 pflowstat_inc(pflow_onomem); 566 return (NULL); 567 } 568 569 MCLGET(m, M_NOWAIT); 570 if ((m->m_flags & M_EXT) == 0) { 571 m_free(m); 572 pflowstat_inc(pflow_onomem); 573 return (NULL); 574 } 575 576 m->m_len = m->m_pkthdr.len = 0; 577 578 if (sc == NULL) /* get only a new empty mbuf */ 579 return (m); 580 581 switch (sc->sc_version) { 582 case PFLOW_PROTO_5: 583 /* populate pflow_header */ 584 h.reserved1 = 0; 585 h.reserved2 = 0; 586 h.count = 0; 587 h.version = htons(PFLOW_PROTO_5); 588 h.flow_sequence = htonl(sc->sc_gcounter); 589 h.engine_type = PFLOW_ENGINE_TYPE; 590 h.engine_id = PFLOW_ENGINE_ID; 591 m_copyback(m, 0, PFLOW_HDRLEN, (caddr_t)&h); 592 593 sc->sc_count = 0; 594 callout_reset(&sc->sc_tmo, PFLOW_TIMEOUT * hz, 595 pflow_timeout, sc); 596 break; 597 case PFLOW_PROTO_10: 598 /* populate pflow_set_header */ 599 set_hdr.set_length = 0; 600 set_hdr.set_id = htons(set_id); 601 m_copyback(m, 0, PFLOW_SET_HDRLEN, (caddr_t)&set_hdr); 602 break; 603 default: /* NOTREACHED */ 604 break; 605 } 606 607 return (m); 608 } 609 610 static void 611 copy_flow_data(struct pflow_flow *flow1, struct pflow_flow *flow2, 612 const struct pf_kstate *st, struct pf_state_key *sk, int src, int dst) 613 { 614 flow1->src_ip = flow2->dest_ip = sk->addr[src].v4.s_addr; 615 flow1->src_port = flow2->dest_port = sk->port[src]; 616 flow1->dest_ip = flow2->src_ip = sk->addr[dst].v4.s_addr; 617 flow1->dest_port = flow2->src_port = sk->port[dst]; 618 619 flow1->dest_as = flow2->src_as = 620 flow1->src_as = flow2->dest_as = 0; 621 flow1->if_index_in = htons(st->if_index_in); 622 flow1->if_index_out = htons(st->if_index_out); 623 flow2->if_index_in = htons(st->if_index_out); 624 flow2->if_index_out = htons(st->if_index_in); 625 flow1->dest_mask = flow2->src_mask = 626 flow1->src_mask = flow2->dest_mask = 0; 627 628 flow1->flow_packets = htonl(st->packets[0]); 629 flow2->flow_packets = htonl(st->packets[1]); 630 flow1->flow_octets = htonl(st->bytes[0]); 631 flow2->flow_octets = htonl(st->bytes[1]); 632 633 /* 634 * Pretend the flow was created or expired when the machine came up 635 * when creation is in the future of the last time a package was seen 636 * or was created / expired before this machine came up due to pfsync. 637 */ 638 flow1->flow_start = flow2->flow_start = st->creation < 0 || 639 st->creation > st->expire ? htonl(0) : htonl(st->creation); 640 flow1->flow_finish = flow2->flow_finish = st->expire < 0 ? htonl(0) : 641 htonl(st->expire); 642 flow1->tcp_flags = flow2->tcp_flags = 0; 643 flow1->protocol = flow2->protocol = sk->proto; 644 flow1->tos = flow2->tos = st->rule.ptr->tos; 645 } 646 647 static void 648 copy_flow_ipfix_4_data(struct pflow_ipfix_flow4 *flow1, 649 struct pflow_ipfix_flow4 *flow2, const struct pf_kstate *st, 650 struct pf_state_key *sk, struct pflow_softc *sc, int src, int dst) 651 { 652 flow1->src_ip = flow2->dest_ip = sk->addr[src].v4.s_addr; 653 flow1->src_port = flow2->dest_port = sk->port[src]; 654 flow1->dest_ip = flow2->src_ip = sk->addr[dst].v4.s_addr; 655 flow1->dest_port = flow2->src_port = sk->port[dst]; 656 657 flow1->if_index_in = htonl(st->if_index_in); 658 flow1->if_index_out = htonl(st->if_index_out); 659 flow2->if_index_in = htonl(st->if_index_out); 660 flow2->if_index_out = htonl(st->if_index_in); 661 662 flow1->flow_packets = htobe64(st->packets[0]); 663 flow2->flow_packets = htobe64(st->packets[1]); 664 flow1->flow_octets = htobe64(st->bytes[0]); 665 flow2->flow_octets = htobe64(st->bytes[1]); 666 667 /* 668 * Pretend the flow was created when the machine came up when creation 669 * is in the future of the last time a package was seen due to pfsync. 670 */ 671 if (st->creation > st->expire) 672 flow1->flow_start = flow2->flow_start = htobe64((time_second - 673 time_uptime)*1000); 674 else 675 flow1->flow_start = flow2->flow_start = htobe64((pf_get_time() - 676 (pf_get_uptime() - st->creation))); 677 flow1->flow_finish = flow2->flow_finish = htobe64((pf_get_time() - 678 (pf_get_uptime() - st->expire))); 679 680 flow1->protocol = flow2->protocol = sk->proto; 681 flow1->tos = flow2->tos = st->rule.ptr->tos; 682 } 683 684 static void 685 copy_flow_ipfix_6_data(struct pflow_ipfix_flow6 *flow1, 686 struct pflow_ipfix_flow6 *flow2, const struct pf_kstate *st, 687 struct pf_state_key *sk, struct pflow_softc *sc, int src, int dst) 688 { 689 bcopy(&sk->addr[src].v6, &flow1->src_ip, sizeof(flow1->src_ip)); 690 bcopy(&sk->addr[src].v6, &flow2->dest_ip, sizeof(flow2->dest_ip)); 691 flow1->src_port = flow2->dest_port = sk->port[src]; 692 bcopy(&sk->addr[dst].v6, &flow1->dest_ip, sizeof(flow1->dest_ip)); 693 bcopy(&sk->addr[dst].v6, &flow2->src_ip, sizeof(flow2->src_ip)); 694 flow1->dest_port = flow2->src_port = sk->port[dst]; 695 696 flow1->if_index_in = htonl(st->if_index_in); 697 flow1->if_index_out = htonl(st->if_index_out); 698 flow2->if_index_in = htonl(st->if_index_out); 699 flow2->if_index_out = htonl(st->if_index_in); 700 701 flow1->flow_packets = htobe64(st->packets[0]); 702 flow2->flow_packets = htobe64(st->packets[1]); 703 flow1->flow_octets = htobe64(st->bytes[0]); 704 flow2->flow_octets = htobe64(st->bytes[1]); 705 706 /* 707 * Pretend the flow was created when the machine came up when creation 708 * is in the future of the last time a package was seen due to pfsync. 709 */ 710 if (st->creation > st->expire) 711 flow1->flow_start = flow2->flow_start = htobe64((time_second - 712 time_uptime)*1000); 713 else 714 flow1->flow_start = flow2->flow_start = htobe64((pf_get_time() - 715 (pf_get_uptime() - st->creation))); 716 flow1->flow_finish = flow2->flow_finish = htobe64((pf_get_time() - 717 (pf_get_uptime() - st->expire))); 718 719 flow1->protocol = flow2->protocol = sk->proto; 720 flow1->tos = flow2->tos = st->rule.ptr->tos; 721 } 722 723 static void 724 copy_nat_ipfix_4_data(struct pflow_ipfix_nat4 *nat1, 725 struct pflow_ipfix_nat4 *nat2, const struct pf_kstate *st, 726 struct pf_state_key *sk, struct pflow_softc *sc, int src, int dst) 727 { 728 nat1->src_ip = nat2->dest_ip = st->key[PF_SK_STACK]->addr[src].v4.s_addr; 729 nat1->src_port = nat2->dest_port = st->key[PF_SK_STACK]->port[src]; 730 nat1->dest_ip = nat2->src_ip = st->key[PF_SK_STACK]->addr[dst].v4.s_addr; 731 nat1->dest_port = nat2->src_port = st->key[PF_SK_STACK]->port[dst]; 732 nat1->postnat_src_ip = nat2->postnat_dest_ip = st->key[PF_SK_WIRE]->addr[src].v4.s_addr; 733 nat1->postnat_src_port = nat2->postnat_dest_port = st->key[PF_SK_WIRE]->port[src]; 734 nat1->postnat_dest_ip = nat2->postnat_src_ip = st->key[PF_SK_WIRE]->addr[dst].v4.s_addr; 735 nat1->postnat_dest_port = nat2->postnat_src_port = st->key[PF_SK_WIRE]->port[dst]; 736 nat1->protocol = nat2->protocol = sk->proto; 737 738 /* 739 * Because we have to generate a create and delete event we'll fill out the 740 * timestamp and nat_event fields when we transmit. As opposed to doing this 741 * work a second time. 742 */ 743 } 744 745 static void 746 export_pflow(const struct pf_kstate *st) 747 { 748 struct pflow_softc *sc = NULL; 749 struct pf_state_key *sk; 750 751 NET_EPOCH_ASSERT(); 752 753 sk = st->key[st->direction == PF_IN ? PF_SK_WIRE : PF_SK_STACK]; 754 755 CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) { 756 PFLOW_LOCK(sc); 757 switch (sc->sc_version) { 758 case PFLOW_PROTO_5: 759 if (sk->af == AF_INET) 760 export_pflow_if(st, sk, sc); 761 break; 762 case PFLOW_PROTO_10: 763 if (sk->af == AF_INET || sk->af == AF_INET6) 764 export_pflow_if(st, sk, sc); 765 break; 766 default: /* NOTREACHED */ 767 break; 768 } 769 PFLOW_UNLOCK(sc); 770 } 771 } 772 773 static int 774 export_pflow_if(const struct pf_kstate *st, struct pf_state_key *sk, 775 struct pflow_softc *sc) 776 { 777 struct pf_kstate pfs_copy; 778 u_int64_t bytes[2]; 779 int ret = 0; 780 781 if (sc->sc_version == PFLOW_PROTO_10) 782 return (pflow_pack_flow_ipfix(st, sk, sc)); 783 784 /* PFLOW_PROTO_5 */ 785 if ((st->bytes[0] < (u_int64_t)PFLOW_MAXBYTES) 786 && (st->bytes[1] < (u_int64_t)PFLOW_MAXBYTES)) 787 return (pflow_pack_flow(st, sk, sc)); 788 789 /* flow > PFLOW_MAXBYTES need special handling */ 790 bcopy(st, &pfs_copy, sizeof(pfs_copy)); 791 bytes[0] = pfs_copy.bytes[0]; 792 bytes[1] = pfs_copy.bytes[1]; 793 794 while (bytes[0] > PFLOW_MAXBYTES) { 795 pfs_copy.bytes[0] = PFLOW_MAXBYTES; 796 pfs_copy.bytes[1] = 0; 797 798 if ((ret = pflow_pack_flow(&pfs_copy, sk, sc)) != 0) 799 return (ret); 800 if ((bytes[0] - PFLOW_MAXBYTES) > 0) 801 bytes[0] -= PFLOW_MAXBYTES; 802 } 803 804 while (bytes[1] > (u_int64_t)PFLOW_MAXBYTES) { 805 pfs_copy.bytes[1] = PFLOW_MAXBYTES; 806 pfs_copy.bytes[0] = 0; 807 808 if ((ret = pflow_pack_flow(&pfs_copy, sk, sc)) != 0) 809 return (ret); 810 if ((bytes[1] - PFLOW_MAXBYTES) > 0) 811 bytes[1] -= PFLOW_MAXBYTES; 812 } 813 814 pfs_copy.bytes[0] = bytes[0]; 815 pfs_copy.bytes[1] = bytes[1]; 816 817 return (pflow_pack_flow(&pfs_copy, sk, sc)); 818 } 819 820 static int 821 copy_flow_to_m(struct pflow_flow *flow, struct pflow_softc *sc) 822 { 823 int ret = 0; 824 825 PFLOW_ASSERT(sc); 826 827 if (sc->sc_mbuf == NULL) { 828 if ((sc->sc_mbuf = pflow_get_mbuf(sc, 0)) == NULL) 829 return (ENOBUFS); 830 } 831 m_copyback(sc->sc_mbuf, PFLOW_HDRLEN + 832 (sc->sc_count * sizeof(struct pflow_flow)), 833 sizeof(struct pflow_flow), (caddr_t)flow); 834 835 pflowstat_inc(pflow_flows); 836 sc->sc_gcounter++; 837 sc->sc_count++; 838 839 if (sc->sc_count >= sc->sc_maxcount) 840 ret = pflow_sendout_v5(sc); 841 842 return(ret); 843 } 844 845 static int 846 copy_flow_ipfix_4_to_m(struct pflow_ipfix_flow4 *flow, struct pflow_softc *sc) 847 { 848 int ret = 0; 849 850 PFLOW_ASSERT(sc); 851 852 if (sc->sc_mbuf == NULL) { 853 if ((sc->sc_mbuf = 854 pflow_get_mbuf(sc, PFLOW_IPFIX_TMPL_IPV4_ID)) == NULL) { 855 return (ENOBUFS); 856 } 857 sc->sc_count4 = 0; 858 callout_reset(&sc->sc_tmo, PFLOW_TIMEOUT * hz, 859 pflow_timeout, sc); 860 } 861 m_copyback(sc->sc_mbuf, PFLOW_SET_HDRLEN + 862 (sc->sc_count4 * sizeof(struct pflow_ipfix_flow4)), 863 sizeof(struct pflow_ipfix_flow4), (caddr_t)flow); 864 865 pflowstat_inc(pflow_flows); 866 sc->sc_gcounter++; 867 sc->sc_count4++; 868 869 if (sc->sc_count4 >= sc->sc_maxcount4) 870 ret = pflow_sendout_ipfix(sc, PFLOW_INET); 871 return(ret); 872 } 873 874 static int 875 copy_flow_ipfix_6_to_m(struct pflow_ipfix_flow6 *flow, struct pflow_softc *sc) 876 { 877 int ret = 0; 878 879 PFLOW_ASSERT(sc); 880 881 if (sc->sc_mbuf6 == NULL) { 882 if ((sc->sc_mbuf6 = 883 pflow_get_mbuf(sc, PFLOW_IPFIX_TMPL_IPV6_ID)) == NULL) { 884 return (ENOBUFS); 885 } 886 sc->sc_count6 = 0; 887 callout_reset(&sc->sc_tmo6, PFLOW_TIMEOUT * hz, 888 pflow_timeout6, sc); 889 } 890 m_copyback(sc->sc_mbuf6, PFLOW_SET_HDRLEN + 891 (sc->sc_count6 * sizeof(struct pflow_ipfix_flow6)), 892 sizeof(struct pflow_ipfix_flow6), (caddr_t)flow); 893 894 pflowstat_inc(pflow_flows); 895 sc->sc_gcounter++; 896 sc->sc_count6++; 897 898 if (sc->sc_count6 >= sc->sc_maxcount6) 899 ret = pflow_sendout_ipfix(sc, PFLOW_INET6); 900 901 return(ret); 902 } 903 904 int 905 copy_nat_ipfix_4_to_m(struct pflow_ipfix_nat4 *nat, const struct pf_kstate *st, 906 struct pflow_softc *sc, uint8_t event, uint64_t timestamp) 907 { 908 int ret = 0; 909 910 PFLOW_ASSERT(sc); 911 912 if (sc->sc_mbuf_nat4 == NULL) { 913 if ((sc->sc_mbuf_nat4 = 914 pflow_get_mbuf(sc, PFLOW_IPFIX_TMPL_NAT44_ID)) == NULL) { 915 return (ENOBUFS); 916 } 917 sc->sc_count_nat4 = 0; 918 callout_reset(&sc->sc_tmo, PFLOW_TIMEOUT * hz, 919 pflow_timeout_nat4, sc); 920 } 921 922 nat->nat_event = event; 923 nat->timestamp = htobe64(pf_get_time() - (pf_get_uptime() - timestamp)); 924 m_copyback(sc->sc_mbuf_nat4, PFLOW_SET_HDRLEN + 925 (sc->sc_count_nat4 * sizeof(struct pflow_ipfix_nat4)), 926 sizeof(struct pflow_ipfix_nat4), (caddr_t)nat); 927 sc->sc_count_nat4++; 928 929 pflowstat_inc(pflow_flows); 930 sc->sc_gcounter++; 931 932 if (sc->sc_count_nat4 >= sc->sc_maxcount_nat4) 933 ret = pflow_sendout_ipfix(sc, PFLOW_NAT4); 934 935 return (ret); 936 } 937 938 static int 939 pflow_pack_flow(const struct pf_kstate *st, struct pf_state_key *sk, 940 struct pflow_softc *sc) 941 { 942 struct pflow_flow flow1; 943 struct pflow_flow flow2; 944 int ret = 0; 945 946 bzero(&flow1, sizeof(flow1)); 947 bzero(&flow2, sizeof(flow2)); 948 949 if (st->direction == PF_OUT) 950 copy_flow_data(&flow1, &flow2, st, sk, 1, 0); 951 else 952 copy_flow_data(&flow1, &flow2, st, sk, 0, 1); 953 954 if (st->bytes[0] != 0) /* first flow from state */ 955 ret = copy_flow_to_m(&flow1, sc); 956 957 if (st->bytes[1] != 0) /* second flow from state */ 958 ret = copy_flow_to_m(&flow2, sc); 959 960 return (ret); 961 } 962 963 static bool 964 pflow_is_natd(const struct pf_kstate *st) 965 { 966 /* If ports or addresses are different we've been NAT-ed. */ 967 return (memcmp(st->key[PF_SK_WIRE], st->key[PF_SK_STACK], 968 sizeof(struct pf_addr) * 2 + sizeof(uint16_t) * 2) != 0); 969 } 970 971 static int 972 pflow_pack_flow_ipfix(const struct pf_kstate *st, struct pf_state_key *sk, 973 struct pflow_softc *sc) 974 { 975 struct pflow_ipfix_flow4 flow4_1, flow4_2; 976 struct pflow_ipfix_nat4 nat4_1, nat4_2; 977 struct pflow_ipfix_flow6 flow6_1, flow6_2; 978 int ret = 0; 979 bool nat = false; 980 981 if (sk->af == AF_INET) { 982 bzero(&flow4_1, sizeof(flow4_1)); 983 bzero(&flow4_2, sizeof(flow4_2)); 984 985 nat = pflow_is_natd(st); 986 987 if (st->direction == PF_OUT) 988 copy_flow_ipfix_4_data(&flow4_1, &flow4_2, st, sk, sc, 989 1, 0); 990 else 991 copy_flow_ipfix_4_data(&flow4_1, &flow4_2, st, sk, sc, 992 0, 1); 993 994 if (nat) 995 copy_nat_ipfix_4_data(&nat4_1, &nat4_2, st, sk, sc, 1, 0); 996 997 if (st->bytes[0] != 0) /* first flow from state */ { 998 ret = copy_flow_ipfix_4_to_m(&flow4_1, sc); 999 1000 if (ret == 0 && nat) { 1001 ret = copy_nat_ipfix_4_to_m(&nat4_1, st, sc, 1002 PFIX_NAT_EVENT_SESSION_CREATE, st->creation); 1003 ret |= copy_nat_ipfix_4_to_m(&nat4_1, st, sc, 1004 PFIX_NAT_EVENT_SESSION_DELETE, st->expire); 1005 } 1006 } 1007 1008 if (st->bytes[1] != 0) /* second flow from state */ { 1009 ret = copy_flow_ipfix_4_to_m(&flow4_2, sc); 1010 1011 if (ret == 0 && nat) { 1012 ret = copy_nat_ipfix_4_to_m(&nat4_2, st, sc, 1013 PFIX_NAT_EVENT_SESSION_CREATE, st->creation); 1014 ret |= copy_nat_ipfix_4_to_m(&nat4_2, st, sc, 1015 PFIX_NAT_EVENT_SESSION_DELETE, st->expire); 1016 } 1017 } 1018 } else if (sk->af == AF_INET6) { 1019 bzero(&flow6_1, sizeof(flow6_1)); 1020 bzero(&flow6_2, sizeof(flow6_2)); 1021 1022 if (st->direction == PF_OUT) 1023 copy_flow_ipfix_6_data(&flow6_1, &flow6_2, st, sk, sc, 1024 1, 0); 1025 else 1026 copy_flow_ipfix_6_data(&flow6_1, &flow6_2, st, sk, sc, 1027 0, 1); 1028 1029 if (st->bytes[0] != 0) /* first flow from state */ 1030 ret = copy_flow_ipfix_6_to_m(&flow6_1, sc); 1031 1032 if (st->bytes[1] != 0) /* second flow from state */ 1033 ret = copy_flow_ipfix_6_to_m(&flow6_2, sc); 1034 } 1035 return (ret); 1036 } 1037 1038 static void 1039 pflow_timeout(void *v) 1040 { 1041 struct pflow_softc *sc = v; 1042 1043 PFLOW_ASSERT(sc); 1044 CURVNET_SET(sc->sc_vnet); 1045 1046 switch (sc->sc_version) { 1047 case PFLOW_PROTO_5: 1048 pflow_sendout_v5(sc); 1049 break; 1050 case PFLOW_PROTO_10: 1051 pflow_sendout_ipfix(sc, PFLOW_INET); 1052 break; 1053 default: /* NOTREACHED */ 1054 panic("Unsupported version %d", sc->sc_version); 1055 break; 1056 } 1057 1058 CURVNET_RESTORE(); 1059 } 1060 1061 static void 1062 pflow_timeout6(void *v) 1063 { 1064 struct pflow_softc *sc = v; 1065 1066 PFLOW_ASSERT(sc); 1067 1068 if (sc->sc_version != PFLOW_PROTO_10) 1069 return; 1070 1071 CURVNET_SET(sc->sc_vnet); 1072 pflow_sendout_ipfix(sc, PFLOW_INET6); 1073 CURVNET_RESTORE(); 1074 } 1075 1076 static void 1077 pflow_timeout_tmpl(void *v) 1078 { 1079 struct pflow_softc *sc = v; 1080 1081 PFLOW_ASSERT(sc); 1082 1083 if (sc->sc_version != PFLOW_PROTO_10) 1084 return; 1085 1086 CURVNET_SET(sc->sc_vnet); 1087 pflow_sendout_ipfix_tmpl(sc); 1088 CURVNET_RESTORE(); 1089 } 1090 1091 static void 1092 pflow_timeout_nat4(void *v) 1093 { 1094 struct pflow_softc *sc = v; 1095 1096 PFLOW_ASSERT(sc); 1097 1098 if (sc->sc_version != PFLOW_PROTO_10) 1099 return; 1100 1101 CURVNET_SET(sc->sc_vnet); 1102 pflow_sendout_ipfix(sc, PFLOW_NAT4); 1103 CURVNET_RESTORE(); 1104 } 1105 1106 static void 1107 pflow_flush(struct pflow_softc *sc) 1108 { 1109 PFLOW_ASSERT(sc); 1110 1111 switch (sc->sc_version) { 1112 case PFLOW_PROTO_5: 1113 pflow_sendout_v5(sc); 1114 break; 1115 case PFLOW_PROTO_10: 1116 pflow_sendout_ipfix(sc, PFLOW_INET); 1117 pflow_sendout_ipfix(sc, PFLOW_INET6); 1118 pflow_sendout_ipfix(sc, PFLOW_NAT4); 1119 break; 1120 default: /* NOTREACHED */ 1121 break; 1122 } 1123 } 1124 1125 static int 1126 pflow_sendout_v5(struct pflow_softc *sc) 1127 { 1128 struct mbuf *m = sc->sc_mbuf; 1129 struct pflow_header *h; 1130 struct timespec tv; 1131 1132 PFLOW_ASSERT(sc); 1133 1134 if (m == NULL) 1135 return (0); 1136 1137 sc->sc_mbuf = NULL; 1138 1139 pflowstat_inc(pflow_packets); 1140 h = mtod(m, struct pflow_header *); 1141 h->count = htons(sc->sc_count); 1142 1143 /* populate pflow_header */ 1144 h->uptime_ms = htonl(time_uptime * 1000); 1145 1146 getnanotime(&tv); 1147 h->time_sec = htonl(tv.tv_sec); /* XXX 2038 */ 1148 h->time_nanosec = htonl(tv.tv_nsec); 1149 if (mbufq_enqueue(&sc->sc_outputqueue, m) == 0) 1150 swi_sched(sc->sc_swi_cookie, 0); 1151 1152 return (0); 1153 } 1154 1155 static int 1156 pflow_sendout_ipfix(struct pflow_softc *sc, enum pflow_family_t af) 1157 { 1158 struct mbuf *m; 1159 struct pflow_v10_header *h10; 1160 struct pflow_set_header *set_hdr; 1161 u_int32_t count; 1162 int set_length; 1163 1164 PFLOW_ASSERT(sc); 1165 1166 switch (af) { 1167 case PFLOW_INET: 1168 m = sc->sc_mbuf; 1169 callout_stop(&sc->sc_tmo); 1170 if (m == NULL) 1171 return (0); 1172 sc->sc_mbuf = NULL; 1173 count = sc->sc_count4; 1174 set_length = sizeof(struct pflow_set_header) 1175 + sc->sc_count4 * sizeof(struct pflow_ipfix_flow4); 1176 break; 1177 case PFLOW_INET6: 1178 m = sc->sc_mbuf6; 1179 callout_stop(&sc->sc_tmo6); 1180 if (m == NULL) 1181 return (0); 1182 sc->sc_mbuf6 = NULL; 1183 count = sc->sc_count6; 1184 set_length = sizeof(struct pflow_set_header) 1185 + sc->sc_count6 * sizeof(struct pflow_ipfix_flow6); 1186 break; 1187 case PFLOW_NAT4: 1188 m = sc->sc_mbuf_nat4; 1189 callout_stop(&sc->sc_tmo_nat4); 1190 if (m == NULL) 1191 return (0); 1192 sc->sc_mbuf_nat4 = NULL; 1193 count = sc->sc_count_nat4; 1194 set_length = sizeof(struct pflow_set_header) 1195 + sc->sc_count_nat4 * sizeof(struct pflow_ipfix_nat4); 1196 break; 1197 default: 1198 panic("Unsupported AF %d", af); 1199 } 1200 1201 pflowstat_inc(pflow_packets); 1202 1203 set_hdr = mtod(m, struct pflow_set_header *); 1204 set_hdr->set_length = htons(set_length); 1205 1206 /* populate pflow_header */ 1207 M_PREPEND(m, sizeof(struct pflow_v10_header), M_NOWAIT); 1208 if (m == NULL) { 1209 pflowstat_inc(pflow_onomem); 1210 return (ENOBUFS); 1211 } 1212 h10 = mtod(m, struct pflow_v10_header *); 1213 h10->version = htons(PFLOW_PROTO_10); 1214 h10->length = htons(PFLOW_IPFIX_HDRLEN + set_length); 1215 h10->time_sec = htonl(time_second); /* XXX 2038 */ 1216 h10->flow_sequence = htonl(sc->sc_sequence); 1217 sc->sc_sequence += count; 1218 h10->observation_dom = htonl(sc->sc_observation_dom); 1219 if (mbufq_enqueue(&sc->sc_outputqueue, m) == 0) 1220 swi_sched(sc->sc_swi_cookie, 0); 1221 1222 return (0); 1223 } 1224 1225 static int 1226 pflow_sendout_ipfix_tmpl(struct pflow_softc *sc) 1227 { 1228 struct mbuf *m; 1229 struct pflow_v10_header *h10; 1230 1231 PFLOW_ASSERT(sc); 1232 1233 m = pflow_get_mbuf(sc, 0); 1234 if (m == NULL) 1235 return (0); 1236 m_copyback(m, 0, sizeof(struct pflow_ipfix_tmpl), 1237 (caddr_t)&sc->sc_tmpl_ipfix); 1238 1239 pflowstat_inc(pflow_packets); 1240 1241 /* populate pflow_header */ 1242 M_PREPEND(m, sizeof(struct pflow_v10_header), M_NOWAIT); 1243 if (m == NULL) { 1244 pflowstat_inc(pflow_onomem); 1245 return (ENOBUFS); 1246 } 1247 h10 = mtod(m, struct pflow_v10_header *); 1248 h10->version = htons(PFLOW_PROTO_10); 1249 h10->length = htons(PFLOW_IPFIX_HDRLEN + sizeof(struct 1250 pflow_ipfix_tmpl)); 1251 h10->time_sec = htonl(time_second); /* XXX 2038 */ 1252 h10->flow_sequence = htonl(sc->sc_sequence); 1253 h10->observation_dom = htonl(sc->sc_observation_dom); 1254 1255 callout_reset(&sc->sc_tmo_tmpl, PFLOW_TMPL_TIMEOUT * hz, 1256 pflow_timeout_tmpl, sc); 1257 if (mbufq_enqueue(&sc->sc_outputqueue, m) == 0) 1258 swi_sched(sc->sc_swi_cookie, 0); 1259 1260 return (0); 1261 } 1262 1263 static int 1264 pflow_sendout_mbuf(struct pflow_softc *sc, struct mbuf *m) 1265 { 1266 if (sc->so == NULL) { 1267 m_freem(m); 1268 return (EINVAL); 1269 } 1270 return (sosend(sc->so, sc->sc_flowdst, NULL, m, NULL, 0, curthread)); 1271 } 1272 1273 static int 1274 sysctl_pflowstats(SYSCTL_HANDLER_ARGS) 1275 { 1276 struct pflowstats pflowstats; 1277 1278 pflowstats.pflow_flows = 1279 counter_u64_fetch(V_pflowstats.c[pflow_flows]); 1280 pflowstats.pflow_packets = 1281 counter_u64_fetch(V_pflowstats.c[pflow_packets]); 1282 pflowstats.pflow_onomem = 1283 counter_u64_fetch(V_pflowstats.c[pflow_onomem]); 1284 pflowstats.pflow_oerrors = 1285 counter_u64_fetch(V_pflowstats.c[pflow_oerrors]); 1286 1287 return (sysctl_handle_opaque(oidp, &pflowstats, sizeof(pflowstats), req)); 1288 } 1289 1290 static int 1291 pflow_nl_list(struct nlmsghdr *hdr, struct nl_pstate *npt) 1292 { 1293 struct epoch_tracker et; 1294 struct pflow_softc *sc = NULL; 1295 struct nl_writer *nw = npt->nw; 1296 int error = 0; 1297 1298 hdr->nlmsg_flags |= NLM_F_MULTI; 1299 1300 NET_EPOCH_ENTER(et); 1301 CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) { 1302 if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 1303 error = ENOMEM; 1304 goto out; 1305 } 1306 1307 struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1308 ghdr_new->cmd = PFLOWNL_CMD_LIST; 1309 ghdr_new->version = 0; 1310 ghdr_new->reserved = 0; 1311 1312 nlattr_add_u32(nw, PFLOWNL_L_ID, sc->sc_id); 1313 1314 if (! nlmsg_end(nw)) { 1315 error = ENOMEM; 1316 goto out; 1317 } 1318 } 1319 1320 out: 1321 NET_EPOCH_EXIT(et); 1322 1323 if (error != 0) 1324 nlmsg_abort(nw); 1325 1326 return (error); 1327 } 1328 1329 static int 1330 pflow_nl_create(struct nlmsghdr *hdr, struct nl_pstate *npt) 1331 { 1332 struct nl_writer *nw = npt->nw; 1333 int error = 0; 1334 int unit; 1335 1336 if (! nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 1337 return (ENOMEM); 1338 } 1339 1340 struct genlmsghdr *ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1341 ghdr_new->cmd = PFLOWNL_CMD_CREATE; 1342 ghdr_new->version = 0; 1343 ghdr_new->reserved = 0; 1344 1345 unit = alloc_unr(V_pflow_unr); 1346 if (unit == -1) { 1347 nlmsg_abort(nw); 1348 return (ENOMEM); 1349 } 1350 1351 error = pflow_create(unit); 1352 if (error != 0) { 1353 free_unr(V_pflow_unr, unit); 1354 nlmsg_abort(nw); 1355 return (error); 1356 } 1357 1358 nlattr_add_s32(nw, PFLOWNL_CREATE_ID, unit); 1359 1360 if (! nlmsg_end(nw)) { 1361 pflow_destroy(unit, true); 1362 return (ENOMEM); 1363 } 1364 1365 return (0); 1366 } 1367 1368 struct pflow_parsed_del { 1369 int id; 1370 }; 1371 #define _IN(_field) offsetof(struct genlmsghdr, _field) 1372 #define _OUT(_field) offsetof(struct pflow_parsed_del, _field) 1373 static const struct nlattr_parser nla_p_del[] = { 1374 { .type = PFLOWNL_DEL_ID, .off = _OUT(id), .cb = nlattr_get_uint32 }, 1375 }; 1376 static const struct nlfield_parser nlf_p_del[] = {}; 1377 #undef _IN 1378 #undef _OUT 1379 NL_DECLARE_PARSER(del_parser, struct genlmsghdr, nlf_p_del, nla_p_del); 1380 1381 static int 1382 pflow_nl_del(struct nlmsghdr *hdr, struct nl_pstate *npt) 1383 { 1384 struct pflow_parsed_del d = {}; 1385 int error; 1386 1387 error = nl_parse_nlmsg(hdr, &del_parser, npt, &d); 1388 if (error != 0) 1389 return (error); 1390 1391 error = pflow_destroy(d.id, true); 1392 1393 return (error); 1394 } 1395 1396 struct pflow_parsed_get { 1397 int id; 1398 }; 1399 #define _IN(_field) offsetof(struct genlmsghdr, _field) 1400 #define _OUT(_field) offsetof(struct pflow_parsed_get, _field) 1401 static const struct nlattr_parser nla_p_get[] = { 1402 { .type = PFLOWNL_GET_ID, .off = _OUT(id), .cb = nlattr_get_uint32 }, 1403 }; 1404 static const struct nlfield_parser nlf_p_get[] = {}; 1405 #undef _IN 1406 #undef _OUT 1407 NL_DECLARE_PARSER(get_parser, struct genlmsghdr, nlf_p_get, nla_p_get); 1408 1409 static bool 1410 nlattr_add_sockaddr(struct nl_writer *nw, int attr, const struct sockaddr *s) 1411 { 1412 int off = nlattr_add_nested(nw, attr); 1413 if (off == 0) 1414 return (false); 1415 1416 nlattr_add_u8(nw, PFLOWNL_ADDR_FAMILY, s->sa_family); 1417 1418 switch (s->sa_family) { 1419 case AF_INET: { 1420 const struct sockaddr_in *in = (const struct sockaddr_in *)s; 1421 nlattr_add_u16(nw, PFLOWNL_ADDR_PORT, in->sin_port); 1422 nlattr_add_in_addr(nw, PFLOWNL_ADDR_IP, &in->sin_addr); 1423 break; 1424 } 1425 case AF_INET6: { 1426 const struct sockaddr_in6 *in6 = (const struct sockaddr_in6 *)s; 1427 nlattr_add_u16(nw, PFLOWNL_ADDR_PORT, in6->sin6_port); 1428 nlattr_add_in6_addr(nw, PFLOWNL_ADDR_IP6, &in6->sin6_addr); 1429 break; 1430 } 1431 default: 1432 panic("Unknown address family %d", s->sa_family); 1433 } 1434 1435 nlattr_set_len(nw, off); 1436 return (true); 1437 } 1438 1439 static int 1440 pflow_nl_get(struct nlmsghdr *hdr, struct nl_pstate *npt) 1441 { 1442 struct epoch_tracker et; 1443 struct pflow_parsed_get g = {}; 1444 struct pflow_softc *sc = NULL; 1445 struct nl_writer *nw = npt->nw; 1446 struct genlmsghdr *ghdr_new; 1447 int error; 1448 1449 error = nl_parse_nlmsg(hdr, &get_parser, npt, &g); 1450 if (error != 0) 1451 return (error); 1452 1453 NET_EPOCH_ENTER(et); 1454 CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) { 1455 if (sc->sc_id == g.id) 1456 break; 1457 } 1458 if (sc == NULL) { 1459 error = ENOENT; 1460 goto out; 1461 } 1462 1463 if (! nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) { 1464 nlmsg_abort(nw); 1465 error = ENOMEM; 1466 goto out; 1467 } 1468 1469 ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr); 1470 if (ghdr_new == NULL) { 1471 nlmsg_abort(nw); 1472 error = ENOMEM; 1473 goto out; 1474 } 1475 1476 ghdr_new->cmd = PFLOWNL_CMD_GET; 1477 ghdr_new->version = 0; 1478 ghdr_new->reserved = 0; 1479 1480 nlattr_add_u32(nw, PFLOWNL_GET_ID, sc->sc_id); 1481 nlattr_add_u16(nw, PFLOWNL_GET_VERSION, sc->sc_version); 1482 if (sc->sc_flowsrc) 1483 nlattr_add_sockaddr(nw, PFLOWNL_GET_SRC, sc->sc_flowsrc); 1484 if (sc->sc_flowdst) 1485 nlattr_add_sockaddr(nw, PFLOWNL_GET_DST, sc->sc_flowdst); 1486 nlattr_add_u32(nw, PFLOWNL_GET_OBSERVATION_DOMAIN, 1487 sc->sc_observation_dom); 1488 nlattr_add_u8(nw, PFLOWNL_GET_SOCKET_STATUS, sc->so != NULL); 1489 1490 if (! nlmsg_end(nw)) { 1491 nlmsg_abort(nw); 1492 error = ENOMEM; 1493 } 1494 1495 out: 1496 NET_EPOCH_EXIT(et); 1497 1498 return (error); 1499 } 1500 1501 struct pflow_sockaddr { 1502 union { 1503 struct sockaddr_in in; 1504 struct sockaddr_in6 in6; 1505 struct sockaddr_storage storage; 1506 }; 1507 }; 1508 static bool 1509 pflow_postparse_sockaddr(void *parsed_args, struct nl_pstate *npt __unused) 1510 { 1511 struct pflow_sockaddr *s = (struct pflow_sockaddr *)parsed_args; 1512 1513 if (s->storage.ss_family == AF_INET) 1514 s->storage.ss_len = sizeof(struct sockaddr_in); 1515 else if (s->storage.ss_family == AF_INET6) 1516 s->storage.ss_len = sizeof(struct sockaddr_in6); 1517 else 1518 return (false); 1519 1520 return (true); 1521 } 1522 1523 #define _OUT(_field) offsetof(struct pflow_sockaddr, _field) 1524 static struct nlattr_parser nla_p_sockaddr[] = { 1525 { .type = PFLOWNL_ADDR_FAMILY, .off = _OUT(in.sin_family), .cb = nlattr_get_uint8 }, 1526 { .type = PFLOWNL_ADDR_PORT, .off = _OUT(in.sin_port), .cb = nlattr_get_uint16 }, 1527 { .type = PFLOWNL_ADDR_IP, .off = _OUT(in.sin_addr), .cb = nlattr_get_in_addr }, 1528 { .type = PFLOWNL_ADDR_IP6, .off = _OUT(in6.sin6_addr), .cb = nlattr_get_in6_addr }, 1529 }; 1530 NL_DECLARE_ATTR_PARSER_EXT(addr_parser, nla_p_sockaddr, pflow_postparse_sockaddr); 1531 #undef _OUT 1532 1533 struct pflow_parsed_set { 1534 int id; 1535 uint16_t version; 1536 struct sockaddr_storage src; 1537 struct sockaddr_storage dst; 1538 uint32_t observation_dom; 1539 }; 1540 #define _IN(_field) offsetof(struct genlmsghdr, _field) 1541 #define _OUT(_field) offsetof(struct pflow_parsed_set, _field) 1542 static const struct nlattr_parser nla_p_set[] = { 1543 { .type = PFLOWNL_SET_ID, .off = _OUT(id), .cb = nlattr_get_uint32 }, 1544 { .type = PFLOWNL_SET_VERSION, .off = _OUT(version), .cb = nlattr_get_uint16 }, 1545 { .type = PFLOWNL_SET_SRC, .off = _OUT(src), .arg = &addr_parser, .cb = nlattr_get_nested }, 1546 { .type = PFLOWNL_SET_DST, .off = _OUT(dst), .arg = &addr_parser, .cb = nlattr_get_nested }, 1547 { .type = PFLOWNL_SET_OBSERVATION_DOMAIN, .off = _OUT(observation_dom), .cb = nlattr_get_uint32 }, 1548 }; 1549 static const struct nlfield_parser nlf_p_set[] = {}; 1550 #undef _IN 1551 #undef _OUT 1552 NL_DECLARE_PARSER(set_parser, struct genlmsghdr, nlf_p_set, nla_p_set); 1553 1554 static int 1555 pflow_set(struct pflow_softc *sc, const struct pflow_parsed_set *pflowr, struct ucred *cred) 1556 { 1557 struct thread *td; 1558 struct socket *so; 1559 int error = 0; 1560 1561 td = curthread; 1562 1563 PFLOW_ASSERT(sc); 1564 1565 if (pflowr->version != 0) { 1566 switch(pflowr->version) { 1567 case PFLOW_PROTO_5: 1568 case PFLOW_PROTO_10: 1569 break; 1570 default: 1571 return(EINVAL); 1572 } 1573 } 1574 1575 pflow_flush(sc); 1576 1577 if (pflowr->dst.ss_len != 0) { 1578 if (sc->sc_flowdst != NULL && 1579 sc->sc_flowdst->sa_family != pflowr->dst.ss_family) { 1580 free(sc->sc_flowdst, M_DEVBUF); 1581 sc->sc_flowdst = NULL; 1582 if (sc->so != NULL) { 1583 soclose(sc->so); 1584 sc->so = NULL; 1585 } 1586 } 1587 1588 switch (pflowr->dst.ss_family) { 1589 case AF_INET: 1590 if (sc->sc_flowdst == NULL) { 1591 if ((sc->sc_flowdst = malloc( 1592 sizeof(struct sockaddr_in), 1593 M_DEVBUF, M_NOWAIT)) == NULL) 1594 return (ENOMEM); 1595 } 1596 memcpy(sc->sc_flowdst, &pflowr->dst, 1597 sizeof(struct sockaddr_in)); 1598 sc->sc_flowdst->sa_len = sizeof(struct 1599 sockaddr_in); 1600 break; 1601 case AF_INET6: 1602 if (sc->sc_flowdst == NULL) { 1603 if ((sc->sc_flowdst = malloc( 1604 sizeof(struct sockaddr_in6), 1605 M_DEVBUF, M_NOWAIT)) == NULL) 1606 return (ENOMEM); 1607 } 1608 memcpy(sc->sc_flowdst, &pflowr->dst, 1609 sizeof(struct sockaddr_in6)); 1610 sc->sc_flowdst->sa_len = sizeof(struct 1611 sockaddr_in6); 1612 break; 1613 default: 1614 break; 1615 } 1616 } 1617 1618 if (pflowr->src.ss_len != 0) { 1619 if (sc->sc_flowsrc != NULL) 1620 free(sc->sc_flowsrc, M_DEVBUF); 1621 sc->sc_flowsrc = NULL; 1622 if (sc->so != NULL) { 1623 soclose(sc->so); 1624 sc->so = NULL; 1625 } 1626 switch(pflowr->src.ss_family) { 1627 case AF_INET: 1628 if ((sc->sc_flowsrc = malloc( 1629 sizeof(struct sockaddr_in), 1630 M_DEVBUF, M_NOWAIT)) == NULL) 1631 return (ENOMEM); 1632 memcpy(sc->sc_flowsrc, &pflowr->src, 1633 sizeof(struct sockaddr_in)); 1634 sc->sc_flowsrc->sa_len = sizeof(struct 1635 sockaddr_in); 1636 break; 1637 case AF_INET6: 1638 if ((sc->sc_flowsrc = malloc( 1639 sizeof(struct sockaddr_in6), 1640 M_DEVBUF, M_NOWAIT)) == NULL) 1641 return (ENOMEM); 1642 memcpy(sc->sc_flowsrc, &pflowr->src, 1643 sizeof(struct sockaddr_in6)); 1644 sc->sc_flowsrc->sa_len = sizeof(struct 1645 sockaddr_in6); 1646 break; 1647 default: 1648 break; 1649 } 1650 } 1651 1652 if (sc->so == NULL) { 1653 if (pflowvalidsockaddr(sc->sc_flowdst, 0)) { 1654 error = socreate(sc->sc_flowdst->sa_family, 1655 &so, SOCK_DGRAM, IPPROTO_UDP, cred, td); 1656 if (error) 1657 return (error); 1658 if (pflowvalidsockaddr(sc->sc_flowsrc, 1)) { 1659 error = sobind(so, sc->sc_flowsrc, td); 1660 if (error) { 1661 soclose(so); 1662 return (error); 1663 } 1664 } 1665 sc->so = so; 1666 } 1667 } else if (!pflowvalidsockaddr(sc->sc_flowdst, 0)) { 1668 soclose(sc->so); 1669 sc->so = NULL; 1670 } 1671 1672 if (pflowr->observation_dom != 0) 1673 sc->sc_observation_dom = pflowr->observation_dom; 1674 1675 /* error check is above */ 1676 if (pflowr->version != 0) 1677 sc->sc_version = pflowr->version; 1678 1679 pflow_setmtu(sc, ETHERMTU); 1680 1681 switch (sc->sc_version) { 1682 case PFLOW_PROTO_5: 1683 callout_stop(&sc->sc_tmo6); 1684 callout_stop(&sc->sc_tmo_tmpl); 1685 break; 1686 case PFLOW_PROTO_10: 1687 callout_reset(&sc->sc_tmo_tmpl, PFLOW_TMPL_TIMEOUT * hz, 1688 pflow_timeout_tmpl, sc); 1689 break; 1690 default: /* NOTREACHED */ 1691 break; 1692 } 1693 1694 return (0); 1695 } 1696 1697 static int 1698 pflow_nl_set(struct nlmsghdr *hdr, struct nl_pstate *npt) 1699 { 1700 struct epoch_tracker et; 1701 struct pflow_parsed_set s = {}; 1702 struct pflow_softc *sc = NULL; 1703 int error; 1704 1705 error = nl_parse_nlmsg(hdr, &set_parser, npt, &s); 1706 if (error != 0) 1707 return (error); 1708 1709 NET_EPOCH_ENTER(et); 1710 CK_LIST_FOREACH(sc, &V_pflowif_list, sc_next) { 1711 if (sc->sc_id == s.id) 1712 break; 1713 } 1714 if (sc == NULL) { 1715 error = ENOENT; 1716 goto out; 1717 } 1718 1719 PFLOW_LOCK(sc); 1720 error = pflow_set(sc, &s, nlp_get_cred(npt->nlp)); 1721 PFLOW_UNLOCK(sc); 1722 1723 out: 1724 NET_EPOCH_EXIT(et); 1725 return (error); 1726 } 1727 1728 static const struct genl_cmd pflow_cmds[] = { 1729 { 1730 .cmd_num = PFLOWNL_CMD_LIST, 1731 .cmd_name = "LIST", 1732 .cmd_cb = pflow_nl_list, 1733 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1734 .cmd_priv = PRIV_NETINET_PF, 1735 }, 1736 { 1737 .cmd_num = PFLOWNL_CMD_CREATE, 1738 .cmd_name = "CREATE", 1739 .cmd_cb = pflow_nl_create, 1740 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1741 .cmd_priv = PRIV_NETINET_PF, 1742 }, 1743 { 1744 .cmd_num = PFLOWNL_CMD_DEL, 1745 .cmd_name = "DEL", 1746 .cmd_cb = pflow_nl_del, 1747 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1748 .cmd_priv = PRIV_NETINET_PF, 1749 }, 1750 { 1751 .cmd_num = PFLOWNL_CMD_GET, 1752 .cmd_name = "GET", 1753 .cmd_cb = pflow_nl_get, 1754 .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1755 .cmd_priv = PRIV_NETINET_PF, 1756 }, 1757 { 1758 .cmd_num = PFLOWNL_CMD_SET, 1759 .cmd_name = "SET", 1760 .cmd_cb = pflow_nl_set, 1761 .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, 1762 .cmd_priv = PRIV_NETINET_PF, 1763 }, 1764 }; 1765 1766 static const struct nlhdr_parser *all_parsers[] = { 1767 &del_parser, 1768 &get_parser, 1769 &set_parser, 1770 }; 1771 1772 static int 1773 pflow_init(void) 1774 { 1775 bool ret; 1776 int family_id __diagused; 1777 1778 NL_VERIFY_PARSERS(all_parsers); 1779 1780 family_id = genl_register_family(PFLOWNL_FAMILY_NAME, 0, 2, PFLOWNL_CMD_MAX); 1781 MPASS(family_id != 0); 1782 ret = genl_register_cmds(PFLOWNL_FAMILY_NAME, pflow_cmds, NL_ARRAY_LEN(pflow_cmds)); 1783 1784 return (ret ? 0 : ENODEV); 1785 } 1786 1787 static void 1788 pflow_uninit(void) 1789 { 1790 genl_unregister_family(PFLOWNL_FAMILY_NAME); 1791 } 1792 1793 static int 1794 pflow_modevent(module_t mod, int type, void *data) 1795 { 1796 int error = 0; 1797 1798 switch (type) { 1799 case MOD_LOAD: 1800 error = pflow_init(); 1801 break; 1802 case MOD_UNLOAD: 1803 pflow_uninit(); 1804 break; 1805 default: 1806 error = EINVAL; 1807 break; 1808 } 1809 1810 return (error); 1811 } 1812 1813 static moduledata_t pflow_mod = { 1814 pflowname, 1815 pflow_modevent, 1816 0 1817 }; 1818 1819 DECLARE_MODULE(pflow, pflow_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY); 1820 MODULE_VERSION(pflow, 1); 1821 MODULE_DEPEND(pflow, pf, PF_MODVER, PF_MODVER, PF_MODVER); 1822