Convert ipfw to use PFIL_HOOKS. This is change is transparent to userland

and preserves the ipfw ABI.  The ipfw core packet inspection and filtering
functions have not been changed, only how ipfw is invoked is different.

However there are many changes how ipfw is and its add-on's are handled:

 In general ipfw is now called through the PFIL_HOOKS and most associated
 magic, that was in ip_input() or ip_output() previously, is now done in
 ipfw_check_[in|out]() in the ipfw PFIL handler.

 IPDIVERT is entirely handled within the ipfw PFIL handlers.  A packet to
 be diverted is checked if it is fragmented, if yes, ip_reass() gets in for
 reassembly.  If not, or all fragments arrived and the packet is complete,
 divert_packet is called directly.  For 'tee' no reassembly attempt is made
 and a copy of the packet is sent to the divert socket unmodified.  The
 original packet continues its way through ip_input/output().

 ipfw 'forward' is done via m_tag's.  The ipfw PFIL handlers tag the packet
 with the new destination sockaddr_in.  A check if the new destination is a
 local IP address is made and the m_flags are set appropriately.  ip_input()
 and ip_output() have some more work to do here.  For ip_input() the m_flags
 are checked and a packet for us is directly sent to the 'ours' section for
 further processing.  Destination changes on the input path are only tagged
 and the 'srcrt' flag to ip_forward() is set to disable destination checks
 and ICMP replies at this stage.  The tag is going to be handled on output.
 ip_output() again checks for m_flags and the 'ours' tag.  If found, the
 packet will be dropped back to the IP netisr where it is going to be picked
 up by ip_input() again and the directly sent to the 'ours' section.  When
 only the destination changes, the route's 'dst' is overwritten with the
 new destination from the forward m_tag.  Then it jumps back at the route
 lookup again and skips the firewall check because it has been marked with
 M_SKIP_FIREWALL.  ipfw 'forward' has to be compiled into the kernel with
 'option IPFIREWALL_FORWARD' to enable it.

 DUMMYNET is entirely handled within the ipfw PFIL handlers.  A packet for
 a dummynet pipe or queue is directly sent to dummynet_io().  Dummynet will
 then inject it back into ip_input/ip_output() after it has served its time.
 Dummynet packets are tagged and will continue from the next rule when they
 hit the ipfw PFIL handlers again after re-injection.

 BRIDGING and IPFW_ETHER are not changed yet and use ipfw_chk() directly as
 they did before.  Later this will be changed to dedicated ETHER PFIL_HOOKS.

More detailed changes to the code:

 conf/files
	Add netinet/ip_fw_pfil.c.

 conf/options
	Add IPFIREWALL_FORWARD option.

 modules/ipfw/Makefile
	Add ip_fw_pfil.c.

 net/bridge.c
	Disable PFIL_HOOKS if ipfw for bridging is active.  Bridging ipfw
	is still directly invoked to handle layer2 headers and packets would
	get a double ipfw when run through PFIL_HOOKS as well.

 netinet/ip_divert.c
	Removed divert_clone() function.  It is no longer used.

 netinet/ip_dummynet.[ch]
	Neither the route 'ro' nor the destination 'dst' need to be stored
	while in dummynet transit.  Structure members and associated macros
	are removed.

 netinet/ip_fastfwd.c
	Removed all direct ipfw handling code and replace it with the new
	'ipfw forward' handling code.

 netinet/ip_fw.h
	Removed 'ro' and 'dst' from struct ip_fw_args.

 netinet/ip_fw2.c
	(Re)moved some global variables and the module handling.

 netinet/ip_fw_pfil.c
	New file containing the ipfw PFIL handlers and module initialization.

 netinet/ip_input.c
	Removed all direct ipfw handling code and replace it with the new
	'ipfw forward' handling code.  ip_forward() does not longer require
	the 'next_hop' struct sockaddr_in argument.  Disable early checks
	if 'srcrt' is set.

 netinet/ip_output.c
	Removed all direct ipfw handling code and replace it with the new
	'ipfw forward' handling code.

 netinet/ip_var.h
	Add ip_reass() as general function.  (Used from ipfw PFIL handlers
	for IPDIVERT.)

 netinet/raw_ip.c
	Directly check if ipfw and dummynet control pointers are active.

 netinet/tcp_input.c
	Rework the 'ipfw forward' to local code to work with the new way of
	forward tags.

 netinet/tcp_sack.c
	Remove include 'opt_ipfw.h' which is not needed here.

 sys/mbuf.h
	Remove m_claim_next() macro which was exclusively for ipfw 'forward'
	and is no longer needed.

Approved by:	re (scottl)

1 files changed, 402 insertions, 0 deletions

diff --git a/sys/netinet/ip_fw_pfil.c b/sys/netinet/ip_fw_pfil.c
new file mode 100644
index 0000000..9056ab6
--- /dev/null
+++ b/sys/netinet/ip_fw_pfil.c
@@ -0,0 +1,402 @@
+/*
+ * Copyright (c) 2004 Andre Oppermann, Internet Business Solutions AG
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#if !defined(KLD_MODULE)
+#include "opt_ipfw.h"
+#include "opt_ipdn.h"
+#include "opt_ipdivert.h"
+#include "opt_inet.h"
+#ifndef INET
+#error IPFIREWALL requires INET.
+#endif /* INET */
+#endif
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/mbuf.h>
+#include <sys/module.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/sysctl.h>
+#include <sys/ucred.h>
+
+#include <net/if.h>
+#include <net/route.h>
+#include <net/pfil.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/in_var.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/ip_fw.h>
+#include <netinet/ip_divert.h>
+#include <netinet/ip_dummynet.h>
+
+#include <machine/in_cksum.h>
+
+static	int ipfw_pfil_hooked = 0;
+
+/* Dummynet hooks. */
+ip_dn_ruledel_t	*ip_dn_ruledel_ptr = NULL;
+
+#define	DIV_DIR_IN	1
+#define	DIV_DIR_OUT	0
+
+static int	ipfw_divert(struct mbuf **, int, int);
+
+int
+ipfw_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
+{
+	struct ip_fw_args args;
+	struct m_tag *dn_tag;
+	int ipfw = 0;
+	int divert;
+#ifdef IPFIREWALL_FORWARD
+	struct m_tag *fwd_tag;
+#endif
+
+	KASSERT(dir == PFIL_IN, ("ipfw_check_in wrong direction!"));
+
+	bzero(&args, sizeof(args));
+
+	dn_tag = m_tag_find(*m0, PACKET_TAG_DUMMYNET, NULL);
+	if (dn_tag != NULL){
+		struct dn_pkt_tag *dt;
+
+		dt = (struct dn_pkt_tag *)(dn_tag+1);
+		args.rule = dt->rule;
+
+		m_tag_delete(*m0, dn_tag);
+	}
+
+	args.m = *m0;
+	ipfw = ipfw_chk(&args);
+	*m0 = args.m;
+
+	if ((ipfw & IP_FW_PORT_DENY_FLAG) || *m0 == NULL)
+		goto drop;
+
+	if (ipfw == 0 && args.next_hop == NULL)
+		goto pass;
+
+	if (DUMMYNET_LOADED && (ipfw & IP_FW_PORT_DYNT_FLAG) != 0) {
+		ip_dn_io_ptr(*m0, ipfw & 0xffff, DN_TO_IP_IN, &args);
+		*m0 = NULL;
+		return 0;		/* packet consumed */
+	}
+
+	if (ipfw != 0 && (ipfw & IP_FW_PORT_DYNT_FLAG) == 0) {
+		if ((ipfw & IP_FW_PORT_TEE_FLAG) != 0)
+			divert = ipfw_divert(m0, DIV_DIR_IN, 1);
+		else
+			divert = ipfw_divert(m0, DIV_DIR_IN, 0);
+
+		/* tee should continue again with the firewall. */
+		if (divert) {
+			*m0 = NULL;
+			return 0;	/* packet consumed */
+		} else
+			goto pass;	/* continue with packet */
+	}
+
+#ifdef IPFIREWALL_FORWARD
+	if (ipfw == 0 && args.next_hop != NULL) {
+		fwd_tag = m_tag_get(PACKET_TAG_IPFORWARD,
+				sizeof(struct sockaddr_in), M_NOWAIT);
+		if (fwd_tag == NULL)
+			goto drop;
+		bcopy(args.next_hop, (fwd_tag+1), sizeof(struct sockaddr_in));
+		m_tag_prepend(*m0, fwd_tag);
+
+		if (in_localip(args.next_hop->sin_addr))
+			(*m0)->m_flags |= M_FASTFWD_OURS;
+		goto pass;
+	}
+#endif
+
+drop:
+	if (*m0)
+		m_freem(*m0);
+	*m0 = NULL;
+	return (EACCES);
+pass:
+	return 0;	/* not filtered */
+}
+
+int
+ipfw_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
+{
+	struct ip_fw_args args;
+	struct m_tag *dn_tag;
+	int ipfw = 0;
+	int divert;
+#ifdef IPFIREWALL_FORWARD
+	struct m_tag *fwd_tag;
+#endif
+
+	KASSERT(dir == PFIL_OUT, ("ipfw_check_out wrong direction!"));
+
+	bzero(&args, sizeof(args));
+
+	dn_tag = m_tag_find(*m0, PACKET_TAG_DUMMYNET, NULL);
+	if (dn_tag != NULL) {
+		struct dn_pkt_tag *dt;
+
+		dt = (struct dn_pkt_tag *)(dn_tag+1);
+		args.rule = dt->rule;
+
+		m_tag_delete(*m0, dn_tag);
+	}
+
+	args.m = *m0;
+	args.oif = ifp;
+	ipfw = ipfw_chk(&args);
+	*m0 = args.m;
+
+	if ((ipfw & IP_FW_PORT_DENY_FLAG) || *m0 == NULL)
+		goto drop;
+
+	if (ipfw == 0 && args.next_hop == NULL)
+		goto pass;
+
+	if (DUMMYNET_LOADED && (ipfw & IP_FW_PORT_DYNT_FLAG) != 0) {
+		ip_dn_io_ptr(*m0, ipfw & 0xffff, DN_TO_IP_OUT, &args);
+		*m0 = NULL;
+		return 0;		/* packet consumed */
+	}
+
+	if (ipfw != 0 && (ipfw & IP_FW_PORT_DYNT_FLAG) == 0) {
+		if ((ipfw & IP_FW_PORT_TEE_FLAG) != 0)
+			divert = ipfw_divert(m0, DIV_DIR_OUT, 1);
+		else
+			divert = ipfw_divert(m0, DIV_DIR_OUT, 0);
+
+		if (divert) {
+			*m0 = NULL;
+			return 0;	/* packet consumed */
+		} else
+			goto pass;	/* continue with packet */
+        }
+
+#ifdef IPFIREWALL_FORWARD
+	if (ipfw == 0 && args.next_hop != NULL) {
+		/* Overwrite existing tag. */
+		fwd_tag = m_tag_find(*m0, PACKET_TAG_IPFORWARD, NULL);
+		if (fwd_tag == NULL)
+			fwd_tag = m_tag_get(PACKET_TAG_IPFORWARD,
+				sizeof(struct sockaddr_in), M_NOWAIT);
+		if (fwd_tag == NULL)
+			goto drop;
+		bcopy(args.next_hop, (fwd_tag+1), sizeof(struct sockaddr_in));
+		m_tag_prepend(*m0, fwd_tag);
+
+		if (in_localip(args.next_hop->sin_addr))
+			(*m0)->m_flags |= M_FASTFWD_OURS;
+		goto pass;
+	}
+#endif
+
+drop:
+	if (*m0)
+		m_freem(*m0);
+	*m0 = NULL;
+	return (EACCES);
+pass:
+	return 0;	/* not filtered */
+}
+
+static int
+ipfw_divert(struct mbuf **m, int incoming, int tee)
+{
+	/*
+	 * ipfw_chk() has already tagged the packet with the divert
+	 * tag.  For tee we need to remove the tag.
+	 * If tee is set, copy packet and return original.
+	 * If not tee, consume packet and send it to divert socket.
+	 */
+#ifdef IPDIVERT
+	struct mbuf *clone, *reass;
+	struct m_tag *mtag;
+	struct ip *ip;
+	int hlen;
+
+	reass = NULL;
+
+	/* Cloning needed for tee? */
+	if (tee)
+		clone = m_dup(*m, M_DONTWAIT);
+	else
+		clone = *m;
+
+	/* In case m_dup was unable to allocate mbufs. */
+	if (clone == NULL)
+		goto teeout;
+
+	/*
+	 * Divert listeners can only handle non-fragmented packets.
+	 * However when tee is set we will *not* de-fragment the packets;
+	 * Doing do would put the reassembly into double-jeopardy.  On top
+	 * of that someone doing a tee will probably want to get the packet
+	 * in its original form.
+	 */
+	ip = mtod(clone, struct ip *);
+	if (!tee && ip->ip_off & (IP_MF | IP_OFFMASK)) {
+
+		/* Reassemble packet. */
+		reass = ip_reass(clone);
+
+		/*
+		 * IP header checksum fixup after reassembly and leave header
+		 * in network byte order.
+		 */
+		if (reass != NULL) {
+			ip = mtod(reass, struct ip *);
+			hlen = ip->ip_hl << 2;
+			ip->ip_len = htons(ip->ip_len);
+			ip->ip_off = htons(ip->ip_off);
+			ip->ip_sum = 0;
+			if (hlen == sizeof(struct ip))
+				ip->ip_sum = in_cksum_hdr(ip);
+			else
+				ip->ip_sum = in_cksum(reass, hlen);
+			clone = reass;
+		} else
+			clone = NULL;
+	} else {
+		/* Convert header to network byte order. */
+		ip->ip_len = htons(ip->ip_len);
+		ip->ip_off = htons(ip->ip_off);
+	}
+
+	/* Do the dirty job... */
+	if (clone)
+		divert_packet(clone, incoming);
+
+teeout:
+	if (tee) {
+		mtag = m_tag_find(*m, PACKET_TAG_DIVERT, NULL);
+		if (mtag != NULL)
+			m_tag_delete(*m, mtag);
+		return 0;	/* continue with original packet. */
+	}
+
+	/* Packet diverted and consumed */
+	return 1;
+#else
+	m_freem(*m);
+	return 1;
+#endif	/* ipdivert */
+}
+
+static int
+ipfw_hook(void)
+{
+	struct pfil_head *pfh_inet;
+
+	if (ipfw_pfil_hooked)
+		return EEXIST;
+
+	pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
+	if (pfh_inet == NULL)
+		return ENOENT;
+
+	pfil_add_hook(ipfw_check_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet);
+	pfil_add_hook(ipfw_check_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet);
+
+	return 0;
+}
+
+static int
+ipfw_unhook(void)
+{
+	struct pfil_head *pfh_inet;
+
+	if (!ipfw_pfil_hooked)
+		return ENOENT;
+
+	pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
+	if (pfh_inet == NULL)
+		return ENOENT;
+
+	pfil_remove_hook(ipfw_check_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet);
+	pfil_remove_hook(ipfw_check_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet);
+
+	return 0;
+}
+
+static int
+ipfw_modevent(module_t mod, int type, void *unused)
+{
+	int err = 0;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (ipfw_pfil_hooked) {
+			printf("IP firewall already loaded\n");
+			err = EEXIST;
+		} else {
+			if ((err = ipfw_init()) != 0) {
+				printf("ipfw_init() error\n");
+				break;
+			}
+			if ((err = ipfw_hook()) != 0) {
+				printf("ipfw_hook() error\n");
+				break;
+			}
+			ipfw_pfil_hooked = 1;
+		}
+		break;
+
+	case MOD_UNLOAD:
+		if (ipfw_pfil_hooked) {
+			if ((err = ipfw_unhook()) > 0);
+				break;
+			ipfw_destroy();
+			ipfw_pfil_hooked = 0;
+		} else {
+			printf("IP firewall already unloaded\n");
+		}
+		break;
+
+	default:
+		return EOPNOTSUPP;
+		break;
+	}
+	return err;
+}
+
+static moduledata_t ipfwmod = {
+	"ipfw",
+	ipfw_modevent,
+	0
+};
+DECLARE_MODULE(ipfw, ipfwmod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
+MODULE_VERSION(ipfw, 2);