Changeset View
Standalone View
sys/net/pfil.h
/* $FreeBSD$ */ | /* $FreeBSD$ */ | ||||
/* $NetBSD: pfil.h,v 1.22 2003/06/23 12:57:08 martin Exp $ */ | /* $NetBSD: pfil.h,v 1.22 2003/06/23 12:57:08 martin Exp $ */ | ||||
/*- | /*- | ||||
* SPDX-License-Identifier: BSD-3-Clause | * SPDX-License-Identifier: BSD-3-Clause | ||||
* | * | ||||
* Copyright (c) 2019 Gleb Smirnoff <glebius@FreeBSD.org> | |||||
* Copyright (c) 1996 Matthew R. Green | * Copyright (c) 1996 Matthew R. Green | ||||
* All rights reserved. | * All rights reserved. | ||||
* | * | ||||
* Redistribution and use in source and binary forms, with or without | * Redistribution and use in source and binary forms, with or without | ||||
* modification, are permitted provided that the following conditions | * modification, are permitted provided that the following conditions | ||||
* are met: | * are met: | ||||
* 1. Redistributions of source code must retain the above copyright | * 1. Redistributions of source code must retain the above copyright | ||||
* notice, this list of conditions and the following disclaimer. | * notice, this list of conditions and the following disclaimer. | ||||
Show All 14 Lines | |||||
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | ||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | ||||
* SUCH DAMAGE. | * SUCH DAMAGE. | ||||
*/ | */ | ||||
#ifndef _NET_PFIL_H_ | #ifndef _NET_PFIL_H_ | ||||
#define _NET_PFIL_H_ | #define _NET_PFIL_H_ | ||||
#include <sys/systm.h> | #include <sys/ioccom.h> | ||||
#include <sys/queue.h> | |||||
#include <sys/_lock.h> | |||||
#include <sys/_mutex.h> | |||||
#include <sys/lock.h> | |||||
#include <sys/rmlock.h> | |||||
enum pfil_types { | |||||
PFIL_TYPE_IP4, | |||||
PFIL_TYPE_IP6, | |||||
PFIL_TYPE_ETHERNET, | |||||
}; | |||||
#define MAXPFILNAME 64 | |||||
struct pfilioc_head { | |||||
char pio_name[MAXPFILNAME]; | |||||
int pio_nhooksin; | |||||
int pio_nhooksout; | |||||
enum pfil_types pio_type; | |||||
}; | |||||
ae: maybe it would be better to use MAXMODNAME from <sys/module.h>? | |||||
Done Inline ActionsWould require including sys/module.h into userland utility to manipulate pfil(9), which is ugly, since purpose of sys/module.h is completely different. I created MAXPFILNAME equal to 64. This is longest name of a pf queue. In ipfw we don't have long string constants yet. 64 should be enough for anyone :) We can't go too big, e.g. MAXPATHLEN, because pfilioc_link is used internally in the kernel. glebius: Would require including sys/module.h into userland utility to manipulate pfil(9), which is ugly… | |||||
struct pfilioc_hook { | |||||
Done Inline ActionsMaybe we can reserve a bit more bytes for this name to be able store some meaning descriptions here? ae: Maybe we can reserve a bit more bytes for this name to be able store some meaning descriptions… | |||||
char pio_module[MAXPFILNAME]; | |||||
char pio_ruleset[MAXPFILNAME]; | |||||
int pio_flags; | |||||
enum pfil_types pio_type; | |||||
}; | |||||
struct pfilioc_list { | |||||
u_int pio_nheads; | |||||
u_int pio_nhooks; | |||||
struct pfilioc_head *pio_heads; | |||||
struct pfilioc_hook *pio_hooks; | |||||
}; | |||||
struct pfilioc_link { | |||||
char pio_name[MAXPFILNAME]; | |||||
char pio_module[MAXPFILNAME]; | |||||
char pio_ruleset[MAXPFILNAME]; | |||||
int pio_flags; | |||||
}; | |||||
#define PFILDEV "pfil" | |||||
#define PFILIOC_LISTHEADS _IOWR('P', 1, struct pfilioc_list) | |||||
#define PFILIOC_LISTHOOKS _IOWR('P', 2, struct pfilioc_list) | |||||
#define PFILIOC_LINK _IOW('P', 3, struct pfilioc_link) | |||||
#define PFIL_IN 0x00010000 | |||||
#define PFIL_OUT 0x00020000 | |||||
Done Inline Actionss/ /\t/ ae: s/ /\t/ | |||||
#define PFIL_FWD 0x00040000 | |||||
#define PFIL_DIR(f) ((f) & (PFIL_IN|PFIL_OUT)) | |||||
#define PFIL_MEMPTR 0x00080000 | |||||
#define PFIL_HEADPTR 0x00100000 | |||||
#define PFIL_HOOKPTR 0x00200000 | |||||
#define PFIL_APPEND 0x00400000 | |||||
#define PFIL_UNLINK 0x00800000 | |||||
#define PFIL_LENMASK 0x0000ffff | |||||
#define PFIL_LENGTH(f) ((f) & PFIL_LENMASK) | |||||
#ifdef _KERNEL | |||||
struct mbuf; | struct mbuf; | ||||
struct ifnet; | struct ifnet; | ||||
struct inpcb; | struct inpcb; | ||||
typedef int (*pfil_func_t)(void *, struct mbuf **, struct ifnet *, int, | typedef union { | ||||
struct inpcb *); | struct mbuf **m; | ||||
typedef int (*pfil_func_flags_t)(void *, struct mbuf **, struct ifnet *, | void *mem; | ||||
int, int, struct inpcb *); | } pfil_packet_t __attribute__((__transparent_union__)); | ||||
typedef enum { | |||||
PFIL_PASS = 0, | |||||
PFIL_DROPPED, | |||||
PFIL_CONSUMED, | |||||
Done Inline ActionsIt seems there is not any difference between DROPPED and CONSUMED. Also, note that the code that calls pfil_run_hooks() expects that the return value is an error from errno(2), where 1 corresponds to EPERM, but another values can be passed to userlevel and ENOENT=2, ESRCH=3 can confuse. If you want to change this protocol, you need to inspect the code around the pfil_run_hook(). ae: It seems there is not any difference between DROPPED and CONSUMED. Also, note that the code… | |||||
Done Inline ActionsWill double check that. glebius: Will double check that. | |||||
PFIL_REALLOCED, | |||||
} pfil_return_t; | |||||
typedef pfil_return_t (*pfil_func_t)(pfil_packet_t, struct ifnet *, int, | |||||
void *, struct inpcb *); | |||||
/* | /* | ||||
* The packet filter hooks are designed for anything to call them to | * A pfil head is created by a packet intercept point. | ||||
* possibly intercept the packet. Multiple filter hooks are chained | * | ||||
* together and after each other in the specified order. | * A pfil hook is created by a packet filter. | ||||
* | |||||
* Hooks are chained on heads. Historically some hooking happens | |||||
* automatically, e.g. ipfw(4), pf(4) and ipfilter(4) would register | |||||
* theirselves on IPv4 and IPv6 input/output. | |||||
*/ | */ | ||||
struct packet_filter_hook { | |||||
TAILQ_ENTRY(packet_filter_hook) pfil_chain; | |||||
pfil_func_t pfil_func; | |||||
pfil_func_flags_t pfil_func_flags; | |||||
void *pfil_arg; | |||||
}; | |||||
#define PFIL_IN 0x00000001 | typedef struct pfil_hook * pfil_hook_t; | ||||
#define PFIL_OUT 0x00000002 | typedef struct pfil_head * pfil_head_t; | ||||
#define PFIL_WAITOK 0x00000004 | |||||
#define PFIL_FWD 0x00000008 | |||||
#define PFIL_ALL (PFIL_IN|PFIL_OUT) | |||||
typedef TAILQ_HEAD(pfil_chain, packet_filter_hook) pfil_chain_t; | /* | ||||
* Give us a chance to modify pfil_xxx_args structures in future. | |||||
*/ | |||||
#define PFIL_VERSION 1 | |||||
#define PFIL_TYPE_AF 1 /* key is AF_* type */ | /* Argument structure used by packet filters to register themselves. */ | ||||
#define PFIL_TYPE_IFNET 2 /* key is ifnet pointer */ | struct pfil_hook_args { | ||||
int pa_version; | |||||
int pa_flags; | |||||
enum pfil_types pa_type; | |||||
pfil_func_t pa_func; | |||||
void *pa_ruleset; | |||||
const char *pa_modname; | |||||
const char *pa_rulname; | |||||
}; | |||||
#define PFIL_FLAG_PRIVATE_LOCK 0x01 /* Personal lock instead of global */ | /* Public functions for pfil hook management by packet filters. */ | ||||
pfil_hook_t pfil_add_hook(struct pfil_hook_args *); | |||||
void pfil_remove_hook(pfil_hook_t); | |||||
/* | /* Argument structure used by ioctl() and packet filters to set filters. */ | ||||
* A pfil head is created by each protocol or packet intercept point. | struct pfil_link_args { | ||||
* For packet is then run through the hook chain for inspection. | int pa_version; | ||||
*/ | int pa_flags; | ||||
struct pfil_head { | |||||
pfil_chain_t ph_in; | |||||
pfil_chain_t ph_out; | |||||
int ph_type; | |||||
int ph_nhooks; | |||||
#if defined( __linux__ ) || defined( _WIN32 ) | |||||
rwlock_t ph_mtx; | |||||
#else | |||||
struct rmlock *ph_plock; /* Pointer to the used lock */ | |||||
struct rmlock ph_lock; /* Private lock storage */ | |||||
int flags; | |||||
#endif | |||||
union { | union { | ||||
u_long phu_val; | const char *pa_headname; | ||||
void *phu_ptr; | pfil_head_t pa_head; | ||||
} ph_un; | |||||
#define ph_af ph_un.phu_val | |||||
#define ph_ifnet ph_un.phu_ptr | |||||
LIST_ENTRY(pfil_head) ph_list; | |||||
}; | }; | ||||
union { | |||||
struct { | |||||
const char *pa_modname; | |||||
const char *pa_rulname; | |||||
}; | |||||
pfil_hook_t pa_hook; | |||||
}; | |||||
}; | |||||
/* Public functions for pfil hook management by packet filters. */ | /* Public function to configure filter chains. Used by ioctl() and filters. */ | ||||
struct pfil_head *pfil_head_get(int, u_long); | int pfil_link(struct pfil_link_args *); | ||||
int pfil_add_hook_flags(pfil_func_flags_t, void *, int, struct pfil_head *); | |||||
int pfil_add_hook(pfil_func_t, void *, int, struct pfil_head *); | |||||
int pfil_remove_hook_flags(pfil_func_flags_t, void *, int, struct pfil_head *); | |||||
int pfil_remove_hook(pfil_func_t, void *, int, struct pfil_head *); | |||||
#define PFIL_HOOKED(p) ((p)->ph_nhooks > 0) | |||||
/* Public functions to run the packet inspection by protocols. */ | /* Argument structure used by inspection points to register themselves. */ | ||||
int pfil_run_hooks(struct pfil_head *, struct mbuf **, struct ifnet *, int, | struct pfil_head_args { | ||||
int, struct inpcb *inp); | int pa_version; | ||||
int pa_flags; | |||||
enum pfil_types pa_type; | |||||
const char *pa_headname; | |||||
}; | |||||
/* Public functions for pfil head management by protocols. */ | /* Public functions for pfil head management by inspection points. */ | ||||
int pfil_head_register(struct pfil_head *); | pfil_head_t pfil_head_register(struct pfil_head_args *); | ||||
int pfil_head_unregister(struct pfil_head *); | void pfil_head_unregister(pfil_head_t); | ||||
/* Public pfil locking functions for self managed locks by packet filters. */ | /* Public functions to run the packet inspection by inspection points. */ | ||||
int pfil_try_rlock(struct pfil_head *, struct rm_priotracker *); | int pfil_run_hooks(struct pfil_head *, pfil_packet_t, struct ifnet *, int, | ||||
void pfil_rlock(struct pfil_head *, struct rm_priotracker *); | struct inpcb *inp); | ||||
void pfil_runlock(struct pfil_head *, struct rm_priotracker *); | /* | ||||
void pfil_wlock(struct pfil_head *); | * Minimally exposed structure to avoid function call in case of absence | ||||
void pfil_wunlock(struct pfil_head *); | * of any filters by protocols and macros to do the check. | ||||
int pfil_wowned(struct pfil_head *ph); | */ | ||||
struct _pfil_head { | |||||
int head_nhooksin; | |||||
int head_nhooksout; | |||||
}; | |||||
#define PFIL_HOOKED_IN(p) (((struct _pfil_head *)(p))->head_nhooksin > 0) | |||||
#define PFIL_HOOKED_OUT(p) (((struct _pfil_head *)(p))->head_nhooksout > 0) | |||||
#endif /* _KERNEL */ | |||||
#endif /* _NET_PFIL_H_ */ | #endif /* _NET_PFIL_H_ */ |
maybe it would be better to use MAXMODNAME from <sys/module.h>?