diff options
author | ae <ae@FreeBSD.org> | 2015-11-25 07:31:59 +0000 |
---|---|---|
committer | ae <ae@FreeBSD.org> | 2015-11-25 07:31:59 +0000 |
commit | d81208c9488e0efbf99f327d11bbd7bc055c5b1b (patch) | |
tree | 180d9bca9c02ba401375a447b28937f28cfb981d /sys/net | |
parent | da001d5bf7a7acfef070a8f605c3ec452d374d09 (diff) | |
download | FreeBSD-src-d81208c9488e0efbf99f327d11bbd7bc055c5b1b.zip FreeBSD-src-d81208c9488e0efbf99f327d11bbd7bc055c5b1b.tar.gz |
Overhaul if_enc(4) and make it loadable in run-time.
Use hhook(9) framework to achieve ability of loading and unloading
if_enc(4) kernel module. INET and INET6 code on initialization registers
two helper hooks points in the kernel. if_enc(4) module uses these helper
hook points and registers its hooks. IPSEC code uses these hhook points
to call helper hooks implemented in if_enc(4).
Diffstat (limited to 'sys/net')
-rw-r--r-- | sys/net/if.c | 4 | ||||
-rw-r--r-- | sys/net/if_enc.c | 425 | ||||
-rw-r--r-- | sys/net/if_enc.h | 9 | ||||
-rw-r--r-- | sys/net/if_var.h | 8 |
4 files changed, 249 insertions, 197 deletions
diff --git a/sys/net/if.c b/sys/net/if.c index ba326b7..b88c05e 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -183,6 +183,10 @@ static void if_detach_internal(struct ifnet *, int, struct if_clone **); extern void nd6_setmtu(struct ifnet *); #endif +/* ipsec helper hooks */ +VNET_DEFINE(struct hhook_head *, ipsec_hhh_in[HHOOK_IPSEC_COUNT]); +VNET_DEFINE(struct hhook_head *, ipsec_hhh_out[HHOOK_IPSEC_COUNT]); + VNET_DEFINE(int, if_index); int ifqmaxlen = IFQ_MAXLEN; VNET_DEFINE(struct ifnethead, ifnet); /* depend on static init XXX */ diff --git a/sys/net/if_enc.c b/sys/net/if_enc.c index b43b7d2..ffcfe64 100644 --- a/sys/net/if_enc.c +++ b/sys/net/if_enc.c @@ -1,5 +1,6 @@ /*- * Copyright (c) 2006 The FreeBSD Project. + * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org> * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -79,56 +80,67 @@ struct enchdr { u_int32_t spi; u_int32_t flags; }; - -struct ifnet *encif; -static struct mtx enc_mtx; - struct enc_softc { struct ifnet *sc_ifp; }; +static VNET_DEFINE(struct enc_softc *, enc_sc); +#define V_enc_sc VNET(enc_sc) +static VNET_DEFINE(struct if_clone *, enc_cloner); +#define V_enc_cloner VNET(enc_cloner) static int enc_ioctl(struct ifnet *, u_long, caddr_t); -static int enc_output(struct ifnet *ifp, struct mbuf *m, - const struct sockaddr *dst, struct route *ro); +static int enc_output(struct ifnet *, struct mbuf *, + const struct sockaddr *, struct route *); static int enc_clone_create(struct if_clone *, int, caddr_t); static void enc_clone_destroy(struct ifnet *); -static struct if_clone *enc_cloner; -static const char encname[] = "enc"; +static int enc_add_hhooks(struct enc_softc *); +static void enc_remove_hhooks(struct enc_softc *); -/* - * Sysctls. - */ +static const char encname[] = "enc"; /* * Before and after are relative to when we are stripping the * outer IP header. */ -static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl"); +static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE; +static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE; +static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE; +static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER; +#define V_filter_mask_in VNET(filter_mask_in) +#define V_bpf_mask_in VNET(bpf_mask_in) +#define V_filter_mask_out VNET(filter_mask_out) +#define V_bpf_mask_out VNET(bpf_mask_out) +static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl"); static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl"); -static int ipsec_filter_mask_in = ENC_BEFORE; -SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW, - &ipsec_filter_mask_in, 0, "IPsec input firewall filter mask"); -static int ipsec_bpf_mask_in = ENC_BEFORE; -SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW, - &ipsec_bpf_mask_in, 0, "IPsec input bpf mask"); - static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl"); -static int ipsec_filter_mask_out = ENC_BEFORE; -SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW, - &ipsec_filter_mask_out, 0, "IPsec output firewall filter mask"); -static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER; -SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW, - &ipsec_bpf_mask_out, 0, "IPsec output bpf mask"); +SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, + CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0, + "IPsec input firewall filter mask"); +SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, + CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0, + "IPsec input bpf mask"); +SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, + CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0, + "IPsec output firewall filter mask"); +SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, + CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0, + "IPsec output bpf mask"); static void enc_clone_destroy(struct ifnet *ifp) { - KASSERT(ifp != encif, ("%s: destroying encif", __func__)); + struct enc_softc *sc; + sc = ifp->if_softc; + KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc")); + + enc_remove_hhooks(sc); bpfdetach(ifp); if_detach(ifp); if_free(ifp); + free(sc, M_DEVBUF); + V_enc_sc = NULL; } static int @@ -137,234 +149,255 @@ enc_clone_create(struct if_clone *ifc, int unit, caddr_t params) struct ifnet *ifp; struct enc_softc *sc; - sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO); + sc = malloc(sizeof(struct enc_softc), M_DEVBUF, + M_WAITOK | M_ZERO); ifp = sc->sc_ifp = if_alloc(IFT_ENC); if (ifp == NULL) { free(sc, M_DEVBUF); return (ENOSPC); } - + if (V_enc_sc != NULL) { + if_free(ifp); + free(sc, M_DEVBUF); + return (EEXIST); + } + V_enc_sc = sc; if_initname(ifp, encname, unit); ifp->if_mtu = ENCMTU; ifp->if_ioctl = enc_ioctl; ifp->if_output = enc_output; - ifp->if_snd.ifq_maxlen = ifqmaxlen; ifp->if_softc = sc; if_attach(ifp); bpfattach(ifp, DLT_ENC, sizeof(struct enchdr)); - - mtx_lock(&enc_mtx); - /* grab a pointer to enc0, ignore the rest */ - if (encif == NULL) - encif = ifp; - mtx_unlock(&enc_mtx); - - return (0); -} - -static int -enc_modevent(module_t mod, int type, void *data) -{ - switch (type) { - case MOD_LOAD: - mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF); - enc_cloner = if_clone_simple(encname, enc_clone_create, - enc_clone_destroy, 1); - break; - case MOD_UNLOAD: - printf("enc module unload - not possible for this module\n"); - return (EINVAL); - default: - return (EOPNOTSUPP); + if (enc_add_hhooks(sc) != 0) { + enc_clone_destroy(ifp); + return (ENXIO); } return (0); } -static moduledata_t enc_mod = { - "if_enc", - enc_modevent, - 0 -}; - -DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY); - static int enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, struct route *ro) { + m_freem(m); return (0); } -/* - * Process an ioctl request. - */ -/* ARGSUSED */ static int enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) { - int error = 0; - - mtx_lock(&enc_mtx); - - switch (cmd) { - - case SIOCSIFFLAGS: - if (ifp->if_flags & IFF_UP) - ifp->if_drv_flags |= IFF_DRV_RUNNING; - else - ifp->if_drv_flags &= ~IFF_DRV_RUNNING; - - break; - - default: - error = EINVAL; - } - mtx_unlock(&enc_mtx); - return (error); + if (cmd != SIOCSIFFLAGS) + return (EINVAL); + if (ifp->if_flags & IFF_UP) + ifp->if_drv_flags |= IFF_DRV_RUNNING; + else + ifp->if_drv_flags &= ~IFF_DRV_RUNNING; + return (0); } -int -ipsec_filter(struct mbuf **mp, int dir, int flags) +/* + * One helper hook function is used by any hook points. + * + from hhook_type we can determine the packet direction: + * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT; + * + from hhook_id we can determine address family: AF_INET or AF_INET6; + * + udata contains pointer to enc_softc; + * + ctx_data contains pointer to struct ipsec_ctx_data. + */ +static int +enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data, + void *hdata, struct osd *hosd) { - int error, i; - struct ip *ip; - struct ifnet *rcvif; - - KASSERT(encif != NULL, ("%s: encif is null", __func__)); - KASSERT(flags & (ENC_IN|ENC_OUT), - ("%s: invalid flags: %04x", __func__, flags)); + struct enchdr hdr; + struct ipsec_ctx_data *ctx; + struct enc_softc *sc; + struct ifnet *ifp, *rcvif; + struct pfil_head *ph; + int pdir; - if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0) + sc = (struct enc_softc *)udata; + ifp = sc->sc_ifp; + if ((ifp->if_flags & IFF_UP) == 0) return (0); - if (flags & ENC_IN) { - if ((flags & ipsec_filter_mask_in) == 0) - return (0); - } else { - if ((flags & ipsec_filter_mask_out) == 0) - return (0); + ctx = (struct ipsec_ctx_data *)ctx_data; + /* XXX: wrong hook point was used by caller? */ + if (ctx->af != hhook_id) + return (EPFNOSUPPORT); + + if (((hhook_type == HHOOK_TYPE_IPSEC_IN && + (ctx->enc & V_bpf_mask_in) != 0) || + (hhook_type == HHOOK_TYPE_IPSEC_OUT && + (ctx->enc & V_bpf_mask_out) != 0)) && + bpf_peers_present(ifp->if_bpf) != 0) { + hdr.af = ctx->af; + hdr.spi = ctx->sav->spi; + hdr.flags = 0; + if (ctx->sav->alg_enc != SADB_EALG_NONE) + hdr.flags |= M_CONF; + if (ctx->sav->alg_auth != SADB_AALG_NONE) + hdr.flags |= M_AUTH; + bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp); } - /* Skip pfil(9) if no filters are loaded */ - if (1 + switch (hhook_type) { + case HHOOK_TYPE_IPSEC_IN: + if (ctx->enc == IPSEC_ENC_BEFORE) { + /* Do accounting only once */ + if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1); + if_inc_counter(ifp, IFCOUNTER_IBYTES, + (*ctx->mp)->m_pkthdr.len); + } + if ((ctx->enc & V_filter_mask_in) == 0) + return (0); /* skip pfil processing */ + pdir = PFIL_IN; + break; + case HHOOK_TYPE_IPSEC_OUT: + if (ctx->enc == IPSEC_ENC_BEFORE) { + /* Do accounting only once */ + if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); + if_inc_counter(ifp, IFCOUNTER_OBYTES, + (*ctx->mp)->m_pkthdr.len); + } + if ((ctx->enc & V_filter_mask_out) == 0) + return (0); /* skip pfil processing */ + pdir = PFIL_OUT; + break; + default: + return (EINVAL); + } + + switch (hhook_id) { #ifdef INET - && !PFIL_HOOKED(&V_inet_pfil_hook) + case AF_INET: + ph = &V_inet_pfil_hook; + break; #endif #ifdef INET6 - && !PFIL_HOOKED(&V_inet6_pfil_hook) + case AF_INET6: + ph = &V_inet6_pfil_hook; + break; #endif - ) { + default: + ph = NULL; + } + if (ph == NULL || !PFIL_HOOKED(ph)) return (0); + /* Make a packet looks like it was received on enc(4) */ + rcvif = (*ctx->mp)->m_pkthdr.rcvif; + (*ctx->mp)->m_pkthdr.rcvif = ifp; + if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 || + *ctx->mp == NULL) { + *ctx->mp = NULL; /* consumed by filter */ + return (EACCES); } + (*ctx->mp)->m_pkthdr.rcvif = rcvif; + return (0); +} - i = min((*mp)->m_pkthdr.len, max_protohdr); - if ((*mp)->m_len < i) { - *mp = m_pullup(*mp, i); - if (*mp == NULL) { - printf("%s: m_pullup failed\n", __func__); - return (-1); - } - } +static int +enc_add_hhooks(struct enc_softc *sc) +{ + struct hookinfo hki; + int error; - error = 0; - rcvif = (*mp)->m_pkthdr.rcvif; - (*mp)->m_pkthdr.rcvif = encif; - ip = mtod(*mp, struct ip *); - switch (ip->ip_v) { + error = EPFNOSUPPORT; + hki.hook_func = enc_hhook; + hki.hook_helper = NULL; + hki.hook_udata = sc; #ifdef INET - case 4: - error = pfil_run_hooks(&V_inet_pfil_hook, mp, - encif, dir, NULL); - break; + hki.hook_id = AF_INET; + hki.hook_type = HHOOK_TYPE_IPSEC_IN; + error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], + &hki, HHOOK_WAITOK); + if (error != 0) + return (error); + hki.hook_type = HHOOK_TYPE_IPSEC_OUT; + error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], + &hki, HHOOK_WAITOK); + if (error != 0) + return (error); #endif #ifdef INET6 - case 6: - error = pfil_run_hooks(&V_inet6_pfil_hook, mp, - encif, dir, NULL); - break; -#endif - default: - printf("%s: unknown IP version\n", __func__); - } - - /* - * If the mbuf was consumed by the filter for requeueing (dummynet, etc) - * then error will be zero but we still want to return an error to our - * caller so the null mbuf isn't forwarded further. - */ - if (*mp == NULL && error == 0) - return (-1); /* Consumed by the filter */ - if (*mp == NULL) + hki.hook_id = AF_INET6; + hki.hook_type = HHOOK_TYPE_IPSEC_IN; + error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], + &hki, HHOOK_WAITOK); + if (error != 0) return (error); + hki.hook_type = HHOOK_TYPE_IPSEC_OUT; + error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], + &hki, HHOOK_WAITOK); if (error != 0) - goto bad; - - (*mp)->m_pkthdr.rcvif = rcvif; + return (error); +#endif return (error); +} -bad: - m_freem(*mp); - *mp = NULL; - return (error); +static void +enc_remove_hhooks(struct enc_softc *sc) +{ + struct hookinfo hki; + + hki.hook_func = enc_hhook; + hki.hook_helper = NULL; + hki.hook_udata = sc; +#ifdef INET + hki.hook_id = AF_INET; + hki.hook_type = HHOOK_TYPE_IPSEC_IN; + hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki); + hki.hook_type = HHOOK_TYPE_IPSEC_OUT; + hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki); +#endif +#ifdef INET6 + hki.hook_id = AF_INET6; + hki.hook_type = HHOOK_TYPE_IPSEC_IN; + hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki); + hki.hook_type = HHOOK_TYPE_IPSEC_OUT; + hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki); +#endif } -void -ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags) +static void +vnet_enc_init(const void *unused __unused) { - int mflags; - struct enchdr hdr; - KASSERT(encif != NULL, ("%s: encif is null", __func__)); - KASSERT(flags & (ENC_IN|ENC_OUT), - ("%s: invalid flags: %04x", __func__, flags)); + V_enc_sc = NULL; + V_enc_cloner = if_clone_simple(encname, enc_clone_create, + enc_clone_destroy, 1); +} +VNET_SYSINIT(vnet_enc_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY, + vnet_enc_init, NULL); - if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0) - return; +static void +vnet_enc_uninit(const void *unused __unused) +{ - if (flags & ENC_IN) { - if ((flags & ipsec_bpf_mask_in) == 0) - return; - } else { - if ((flags & ipsec_bpf_mask_out) == 0) - return; - } + if_clone_detach(V_enc_cloner); +} +VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY, + vnet_enc_uninit, NULL); - if (bpf_peers_present(encif->if_bpf)) { - mflags = 0; - hdr.spi = 0; - if (!sav) { - struct m_tag *mtag; - mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL); - if (mtag != NULL) { - struct tdb_ident *tdbi; - tdbi = (struct tdb_ident *) (mtag + 1); - if (tdbi->alg_enc != SADB_EALG_NONE) - mflags |= M_CONF; - if (tdbi->alg_auth != SADB_AALG_NONE) - mflags |= M_AUTH; - hdr.spi = tdbi->spi; - } - } else { - if (sav->alg_enc != SADB_EALG_NONE) - mflags |= M_CONF; - if (sav->alg_auth != SADB_AALG_NONE) - mflags |= M_AUTH; - hdr.spi = sav->spi; - } +static int +enc_modevent(module_t mod, int type, void *data) +{ - /* - * We need to prepend the address family as a four byte - * field. Cons up a dummy header to pacify bpf. This - * is safe because bpf will only read from the mbuf - * (i.e., it won't try to free it or keep a pointer a - * to it). - */ - hdr.af = af; - /* hdr.spi already set above */ - hdr.flags = mflags; - - bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m); + switch (type) { + case MOD_LOAD: + case MOD_UNLOAD: + break; + default: + return (EOPNOTSUPP); } + return (0); } + +static moduledata_t enc_mod = { + "if_enc", + enc_modevent, + 0 +}; + +DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY); diff --git a/sys/net/if_enc.h b/sys/net/if_enc.h index 59a55fc..941ed12 100644 --- a/sys/net/if_enc.h +++ b/sys/net/if_enc.h @@ -30,6 +30,13 @@ #ifndef _NET_IF_ENC_H #define _NET_IF_ENC_H -extern struct ifnet *encif; +struct ipsec_ctx_data { + struct mbuf **mp; + struct secasvar *sav; + uint8_t af; +#define IPSEC_ENC_BEFORE 0x01 +#define IPSEC_ENC_AFTER 0x02 + uint8_t enc; +}; #endif /* _NET_IF_ENC_H */ diff --git a/sys/net/if_var.h b/sys/net/if_var.h index 9dfc459..5911cec 100644 --- a/sys/net/if_var.h +++ b/sys/net/if_var.h @@ -93,6 +93,14 @@ TAILQ_HEAD(ifgrouphead, ifg_group); #ifdef _KERNEL VNET_DECLARE(struct pfil_head, link_pfil_hook); /* packet filter hooks */ #define V_link_pfil_hook VNET(link_pfil_hook) + +#define HHOOK_IPSEC_INET 0 +#define HHOOK_IPSEC_INET6 1 +#define HHOOK_IPSEC_COUNT 2 +VNET_DECLARE(struct hhook_head *, ipsec_hhh_in[HHOOK_IPSEC_COUNT]); +VNET_DECLARE(struct hhook_head *, ipsec_hhh_out[HHOOK_IPSEC_COUNT]); +#define V_ipsec_hhh_in VNET(ipsec_hhh_in) +#define V_ipsec_hhh_out VNET(ipsec_hhh_out) #endif /* _KERNEL */ typedef enum { |