Overhaul if_enc(4) and make it loadable in run-time.

Use hhook(9) framework to achieve ability of loading and unloading
if_enc(4) kernel module. INET and INET6 code on initialization registers
two helper hooks points in the kernel. if_enc(4) module uses these helper
hook points and registers its hooks. IPSEC code uses these hhook points
to call helper hooks implemented in if_enc(4).

4 files changed, 249 insertions, 197 deletions

diff --git a/sys/net/if.c b/sys/net/if.c
index ba326b7..b88c05e 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -183,6 +183,10 @@ static void	if_detach_internal(struct ifnet *, int, struct if_clone **);
 extern void	nd6_setmtu(struct ifnet *);
 #endif
 
+/* ipsec helper hooks */
+VNET_DEFINE(struct hhook_head *, ipsec_hhh_in[HHOOK_IPSEC_COUNT]);
+VNET_DEFINE(struct hhook_head *, ipsec_hhh_out[HHOOK_IPSEC_COUNT]);
+
 VNET_DEFINE(int, if_index);
 int	ifqmaxlen = IFQ_MAXLEN;
 VNET_DEFINE(struct ifnethead, ifnet);	/* depend on static init XXX */
diff --git a/sys/net/if_enc.c b/sys/net/if_enc.c
index b43b7d2..ffcfe64 100644
--- a/sys/net/if_enc.c
+++ b/sys/net/if_enc.c
@@ -1,5 +1,6 @@
 /*-
  * Copyright (c) 2006 The FreeBSD Project.
+ * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -79,56 +80,67 @@ struct enchdr {
 	u_int32_t spi;
 	u_int32_t flags;
 };
-
-struct ifnet	*encif;
-static struct mtx	enc_mtx;
-
 struct enc_softc {
 	struct	ifnet *sc_ifp;
 };
+static VNET_DEFINE(struct enc_softc *, enc_sc);
+#define	V_enc_sc	VNET(enc_sc)
+static VNET_DEFINE(struct if_clone *, enc_cloner);
+#define	V_enc_cloner	VNET(enc_cloner)
 
 static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
-static int	enc_output(struct ifnet *ifp, struct mbuf *m,
-		    const struct sockaddr *dst, struct route *ro);
+static int	enc_output(struct ifnet *, struct mbuf *,
+    const struct sockaddr *, struct route *);
 static int	enc_clone_create(struct if_clone *, int, caddr_t);
 static void	enc_clone_destroy(struct ifnet *);
-static struct if_clone *enc_cloner;
-static const char encname[] = "enc";
+static int	enc_add_hhooks(struct enc_softc *);
+static void	enc_remove_hhooks(struct enc_softc *);
 
-/*
- * Sysctls.
- */
+static const char encname[] = "enc";
 
 /*
  * Before and after are relative to when we are stripping the
  * outer IP header.
  */
-static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
+static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
+#define	V_filter_mask_in	VNET(filter_mask_in)
+#define	V_bpf_mask_in		VNET(bpf_mask_in)
+#define	V_filter_mask_out	VNET(filter_mask_out)
+#define	V_bpf_mask_out		VNET(bpf_mask_out)
 
+static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
-static int ipsec_filter_mask_in = ENC_BEFORE;
-SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
-	&ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
-static int ipsec_bpf_mask_in = ENC_BEFORE;
-SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
-	&ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
-
 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
-static int ipsec_filter_mask_out = ENC_BEFORE;
-SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
-	&ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
-static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
-SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
-	&ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
+SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
+    "IPsec input firewall filter mask");
+SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
+    "IPsec input bpf mask");
+SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
+    "IPsec output firewall filter mask");
+SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
+    "IPsec output bpf mask");
 
 static void
 enc_clone_destroy(struct ifnet *ifp)
 {
-	KASSERT(ifp != encif, ("%s: destroying encif", __func__));
+	struct enc_softc *sc;
 
+	sc = ifp->if_softc;
+	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
+
+	enc_remove_hhooks(sc);
 	bpfdetach(ifp);
 	if_detach(ifp);
 	if_free(ifp);
+	free(sc, M_DEVBUF);
+	V_enc_sc = NULL;
 }
 
 static int
@@ -137,234 +149,255 @@ enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 	struct ifnet *ifp;
 	struct enc_softc *sc;
 
-	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
+	sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
+	    M_WAITOK | M_ZERO);
 	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
 	if (ifp == NULL) {
 		free(sc, M_DEVBUF);
 		return (ENOSPC);
 	}
-
+	if (V_enc_sc != NULL) {
+		if_free(ifp);
+		free(sc, M_DEVBUF);
+		return (EEXIST);
+	}
+	V_enc_sc = sc;
 	if_initname(ifp, encname, unit);
 	ifp->if_mtu = ENCMTU;
 	ifp->if_ioctl = enc_ioctl;
 	ifp->if_output = enc_output;
-	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	ifp->if_softc = sc;
 	if_attach(ifp);
 	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
-
-	mtx_lock(&enc_mtx);
-	/* grab a pointer to enc0, ignore the rest */
-	if (encif == NULL)
-		encif = ifp;
-	mtx_unlock(&enc_mtx);
-
-	return (0);
-}
-
-static int
-enc_modevent(module_t mod, int type, void *data)
-{
-	switch (type) {
-	case MOD_LOAD:
-		mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
-		enc_cloner = if_clone_simple(encname, enc_clone_create,
-		    enc_clone_destroy, 1);
-		break;
-	case MOD_UNLOAD:
-		printf("enc module unload - not possible for this module\n");
-		return (EINVAL);
-	default:
-		return (EOPNOTSUPP);
+	if (enc_add_hhooks(sc) != 0) {
+		enc_clone_destroy(ifp);
+		return (ENXIO);
 	}
 	return (0);
 }
 
-static moduledata_t enc_mod = {
-	"if_enc",
-	enc_modevent,
-	0
-};
-
-DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
-
 static int
 enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
     struct route *ro)
 {
+
 	m_freem(m);
 	return (0);
 }
 
-/*
- * Process an ioctl request.
- */
-/* ARGSUSED */
 static int
 enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 {
-	int error = 0;
-
-	mtx_lock(&enc_mtx);
-
-	switch (cmd) {
-
-	case SIOCSIFFLAGS:
-		if (ifp->if_flags & IFF_UP)
-			ifp->if_drv_flags |= IFF_DRV_RUNNING;
-		else
-			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
-
-		break;
-
-	default:
-		error = EINVAL;
-	}
 
-	mtx_unlock(&enc_mtx);
-	return (error);
+	if (cmd != SIOCSIFFLAGS)
+		return (EINVAL);
+	if (ifp->if_flags & IFF_UP)
+		ifp->if_drv_flags |= IFF_DRV_RUNNING;
+	else
+		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+	return (0);
 }
 
-int
-ipsec_filter(struct mbuf **mp, int dir, int flags)
+/*
+ * One helper hook function is used by any hook points.
+ * + from hhook_type we can determine the packet direction:
+ *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
+ * + from hhook_id we can determine address family: AF_INET or AF_INET6;
+ * + udata contains pointer to enc_softc;
+ * + ctx_data contains pointer to struct ipsec_ctx_data.
+ */
+static int
+enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
+    void *hdata, struct osd *hosd)
 {
-	int error, i;
-	struct ip *ip;
-	struct ifnet *rcvif;
-
-	KASSERT(encif != NULL, ("%s: encif is null", __func__));
-	KASSERT(flags & (ENC_IN|ENC_OUT),
-		("%s: invalid flags: %04x", __func__, flags));
+	struct enchdr hdr;
+	struct ipsec_ctx_data *ctx;
+	struct enc_softc *sc;
+	struct ifnet *ifp, *rcvif;
+	struct pfil_head *ph;
+	int pdir;
 
-	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
+	sc = (struct enc_softc *)udata;
+	ifp = sc->sc_ifp;
+	if ((ifp->if_flags & IFF_UP) == 0)
 		return (0);
 
-	if (flags & ENC_IN) {
-		if ((flags & ipsec_filter_mask_in) == 0)
-			return (0);
-	} else {
-		if ((flags & ipsec_filter_mask_out) == 0)
-			return (0);
+	ctx = (struct ipsec_ctx_data *)ctx_data;
+	/* XXX: wrong hook point was used by caller? */
+	if (ctx->af != hhook_id)
+		return (EPFNOSUPPORT);
+
+	if (((hhook_type == HHOOK_TYPE_IPSEC_IN &&
+	    (ctx->enc & V_bpf_mask_in) != 0) ||
+	    (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
+	    (ctx->enc & V_bpf_mask_out) != 0)) &&
+	    bpf_peers_present(ifp->if_bpf) != 0) {
+		hdr.af = ctx->af;
+		hdr.spi = ctx->sav->spi;
+		hdr.flags = 0;
+		if (ctx->sav->alg_enc != SADB_EALG_NONE)
+			hdr.flags |= M_CONF;
+		if (ctx->sav->alg_auth != SADB_AALG_NONE)
+			hdr.flags |= M_AUTH;
+		bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp);
 	}
 
-	/* Skip pfil(9) if no filters are loaded */
-	if (1
+	switch (hhook_type) {
+	case HHOOK_TYPE_IPSEC_IN:
+		if (ctx->enc == IPSEC_ENC_BEFORE) {
+			/* Do accounting only once */
+			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
+			if_inc_counter(ifp, IFCOUNTER_IBYTES,
+			    (*ctx->mp)->m_pkthdr.len);
+		}
+		if ((ctx->enc & V_filter_mask_in) == 0)
+			return (0); /* skip pfil processing */
+		pdir = PFIL_IN;
+		break;
+	case HHOOK_TYPE_IPSEC_OUT:
+		if (ctx->enc == IPSEC_ENC_BEFORE) {
+			/* Do accounting only once */
+			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
+			if_inc_counter(ifp, IFCOUNTER_OBYTES,
+			    (*ctx->mp)->m_pkthdr.len);
+		}
+		if ((ctx->enc & V_filter_mask_out) == 0)
+			return (0); /* skip pfil processing */
+		pdir = PFIL_OUT;
+		break;
+	default:
+		return (EINVAL);
+	}
+
+	switch (hhook_id) {
 #ifdef INET
-	    && !PFIL_HOOKED(&V_inet_pfil_hook)
+	case AF_INET:
+		ph = &V_inet_pfil_hook;
+		break;
 #endif
 #ifdef INET6
-	    && !PFIL_HOOKED(&V_inet6_pfil_hook)
+	case AF_INET6:
+		ph = &V_inet6_pfil_hook;
+		break;
 #endif
-	    ) {
+	default:
+		ph = NULL;
+	}
+	if (ph == NULL || !PFIL_HOOKED(ph))
 		return (0);
+	/* Make a packet looks like it was received on enc(4) */
+	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
+	(*ctx->mp)->m_pkthdr.rcvif = ifp;
+	if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
+	    *ctx->mp == NULL) {
+		*ctx->mp = NULL; /* consumed by filter */
+		return (EACCES);
 	}
+	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
+	return (0);
+}
 
-	i = min((*mp)->m_pkthdr.len, max_protohdr);
-	if ((*mp)->m_len < i) {
-		*mp = m_pullup(*mp, i);
-		if (*mp == NULL) {
-			printf("%s: m_pullup failed\n", __func__);
-			return (-1);
-		}
-	}
+static int
+enc_add_hhooks(struct enc_softc *sc)
+{
+	struct hookinfo hki;
+	int error;
 
-	error = 0;
-	rcvif = (*mp)->m_pkthdr.rcvif;
-	(*mp)->m_pkthdr.rcvif = encif;
-	ip = mtod(*mp, struct ip *);
-	switch (ip->ip_v) {
+	error = EPFNOSUPPORT;
+	hki.hook_func = enc_hhook;
+	hki.hook_helper = NULL;
+	hki.hook_udata = sc;
 #ifdef INET
-		case 4:
-			error = pfil_run_hooks(&V_inet_pfil_hook, mp,
-			    encif, dir, NULL);
-			break;
+	hki.hook_id = AF_INET;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
+	    &hki, HHOOK_WAITOK);
+	if (error != 0)
+		return (error);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
+	    &hki, HHOOK_WAITOK);
+	if (error != 0)
+		return (error);
 #endif
 #ifdef INET6
-		case 6:
-			error = pfil_run_hooks(&V_inet6_pfil_hook, mp,
-			    encif, dir, NULL);
-			break;
-#endif
-		default:
-			printf("%s: unknown IP version\n", __func__);
-	}
-
-	/*
-	 * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
-	 * then error will be zero but we still want to return an error to our
-	 * caller so the null mbuf isn't forwarded further.
-	 */
-	if (*mp == NULL && error == 0)
-		return (-1);	/* Consumed by the filter */
-	if (*mp == NULL)
+	hki.hook_id = AF_INET6;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
+	    &hki, HHOOK_WAITOK);
+	if (error != 0)
 		return (error);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
+	    &hki, HHOOK_WAITOK);
 	if (error != 0)
-		goto bad;
-
-	(*mp)->m_pkthdr.rcvif = rcvif;
+		return (error);
+#endif
 	return (error);
+}
 
-bad:
-	m_freem(*mp);
-	*mp = NULL;
-	return (error);
+static void
+enc_remove_hhooks(struct enc_softc *sc)
+{
+	struct hookinfo hki;
+
+	hki.hook_func = enc_hhook;
+	hki.hook_helper = NULL;
+	hki.hook_udata = sc;
+#ifdef INET
+	hki.hook_id = AF_INET;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
+#endif
+#ifdef INET6
+	hki.hook_id = AF_INET6;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
+#endif
 }
 
-void
-ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
+static void
+vnet_enc_init(const void *unused __unused)
 {
-	int mflags;
-	struct enchdr hdr;
 
-	KASSERT(encif != NULL, ("%s: encif is null", __func__));
-	KASSERT(flags & (ENC_IN|ENC_OUT),
-		("%s: invalid flags: %04x", __func__, flags));
+	V_enc_sc = NULL;
+	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
+	    enc_clone_destroy, 1);
+}
+VNET_SYSINIT(vnet_enc_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
+    vnet_enc_init, NULL);
 
-	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
-		return;
+static void
+vnet_enc_uninit(const void *unused __unused)
+{
 
-	if (flags & ENC_IN) {
-		if ((flags & ipsec_bpf_mask_in) == 0)
-			return;
-	} else {
-		if ((flags & ipsec_bpf_mask_out) == 0)
-			return;
-	}
+	if_clone_detach(V_enc_cloner);
+}
+VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
+    vnet_enc_uninit, NULL);
 
-	if (bpf_peers_present(encif->if_bpf)) {
-		mflags = 0;
-		hdr.spi = 0;
-		if (!sav) {
-			struct m_tag *mtag;
-			mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
-			if (mtag != NULL) {
-				struct tdb_ident *tdbi;
-				tdbi = (struct tdb_ident *) (mtag + 1);
-				if (tdbi->alg_enc != SADB_EALG_NONE)
-					mflags |= M_CONF;
-				if (tdbi->alg_auth != SADB_AALG_NONE)
-					mflags |= M_AUTH;
-				hdr.spi = tdbi->spi;
-			}
-		} else {
-			if (sav->alg_enc != SADB_EALG_NONE)
-				mflags |= M_CONF;
-			if (sav->alg_auth != SADB_AALG_NONE)
-				mflags |= M_AUTH;
-			hdr.spi = sav->spi;
-		}
+static int
+enc_modevent(module_t mod, int type, void *data)
+{
 
-		/*
-		 * We need to prepend the address family as a four byte
-		 * field.  Cons up a dummy header to pacify bpf.  This
-		 * is safe because bpf will only read from the mbuf
-		 * (i.e., it won't try to free it or keep a pointer a
-		 * to it).
-		 */
-		hdr.af = af;
-		/* hdr.spi already set above */
-		hdr.flags = mflags;
-
-		bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
+	switch (type) {
+	case MOD_LOAD:
+	case MOD_UNLOAD:
+		break;
+	default:
+		return (EOPNOTSUPP);
 	}
+	return (0);
 }
+
+static moduledata_t enc_mod = {
+	"if_enc",
+	enc_modevent,
+	0
+};
+
+DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
diff --git a/sys/net/if_enc.h b/sys/net/if_enc.h
index 59a55fc..941ed12 100644
--- a/sys/net/if_enc.h
+++ b/sys/net/if_enc.h
@@ -30,6 +30,13 @@
 #ifndef _NET_IF_ENC_H
 #define _NET_IF_ENC_H
 
-extern struct ifnet	*encif;
+struct ipsec_ctx_data {
+	struct mbuf	**mp;
+	struct secasvar	*sav;
+	uint8_t		af;
+#define	IPSEC_ENC_BEFORE	0x01
+#define	IPSEC_ENC_AFTER		0x02
+	uint8_t		enc;
+};
 
 #endif /* _NET_IF_ENC_H */
diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index 9dfc459..5911cec 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -93,6 +93,14 @@ TAILQ_HEAD(ifgrouphead, ifg_group);
 #ifdef _KERNEL
 VNET_DECLARE(struct pfil_head, link_pfil_hook);	/* packet filter hooks */
 #define	V_link_pfil_hook	VNET(link_pfil_hook)
+
+#define	HHOOK_IPSEC_INET	0
+#define	HHOOK_IPSEC_INET6	1
+#define	HHOOK_IPSEC_COUNT	2
+VNET_DECLARE(struct hhook_head *, ipsec_hhh_in[HHOOK_IPSEC_COUNT]);
+VNET_DECLARE(struct hhook_head *, ipsec_hhh_out[HHOOK_IPSEC_COUNT]);
+#define	V_ipsec_hhh_in	VNET(ipsec_hhh_in)
+#define	V_ipsec_hhh_out	VNET(ipsec_hhh_out)
 #endif /* _KERNEL */
 
 typedef enum {