1/*-
2 * Copyright (c) 2004-2005 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. The name of the author may not be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * Alternatively, this software may be distributed under the terms of the
17 * GNU General Public License ("GPL") version 2 as published by the Free
18 * Software Foundation.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
| 1/*-
2 * Copyright (c) 2004-2005 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. The name of the author may not be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * Alternatively, this software may be distributed under the terms of the
17 * GNU General Public License ("GPL") version 2 as published by the Free
18 * Software Foundation.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
|
33__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_acl.c 139530 2004-12-31 22:42:38Z sam $");
| 33__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_acl.c 149028 2005-08-13 17:31:48Z sam $");
|
34
35/*
36 * IEEE 802.11 MAC ACL support.
37 *
38 * When this module is loaded the sender address of each received
39 * frame is passed to the iac_check method and the module indicates
40 * if the frame should be accepted or rejected. If the policy is
41 * set to ACL_POLICY_OPEN then all frames are accepted w/o checking
42 * the address. Otherwise, the address is looked up in the database
43 * and if found the frame is either accepted (ACL_POLICY_ALLOW)
44 * or rejected (ACL_POLICY_DENT).
45 */
46#include <sys/param.h>
47#include <sys/kernel.h>
48#include <sys/systm.h>
49#include <sys/mbuf.h>
50#include <sys/module.h>
51#include <sys/queue.h>
52
53#include <sys/socket.h>
54
55#include <net/if.h>
56#include <net/if_media.h>
57#include <net/ethernet.h>
58#include <net/route.h>
59
60#include <net80211/ieee80211_var.h>
61
62enum {
63 ACL_POLICY_OPEN = 0, /* open, don't check ACL's */
64 ACL_POLICY_ALLOW = 1, /* allow traffic from MAC */
65 ACL_POLICY_DENY = 2, /* deny traffic from MAC */
66};
67
68#define ACL_HASHSIZE 32
69
70struct acl {
71 TAILQ_ENTRY(acl) acl_list;
72 LIST_ENTRY(acl) acl_hash;
73 u_int8_t acl_macaddr[IEEE80211_ADDR_LEN];
74};
75struct aclstate {
76 acl_lock_t as_lock;
77 int as_policy;
| 34
35/*
36 * IEEE 802.11 MAC ACL support.
37 *
38 * When this module is loaded the sender address of each received
39 * frame is passed to the iac_check method and the module indicates
40 * if the frame should be accepted or rejected. If the policy is
41 * set to ACL_POLICY_OPEN then all frames are accepted w/o checking
42 * the address. Otherwise, the address is looked up in the database
43 * and if found the frame is either accepted (ACL_POLICY_ALLOW)
44 * or rejected (ACL_POLICY_DENT).
45 */
46#include <sys/param.h>
47#include <sys/kernel.h>
48#include <sys/systm.h>
49#include <sys/mbuf.h>
50#include <sys/module.h>
51#include <sys/queue.h>
52
53#include <sys/socket.h>
54
55#include <net/if.h>
56#include <net/if_media.h>
57#include <net/ethernet.h>
58#include <net/route.h>
59
60#include <net80211/ieee80211_var.h>
61
62enum {
63 ACL_POLICY_OPEN = 0, /* open, don't check ACL's */
64 ACL_POLICY_ALLOW = 1, /* allow traffic from MAC */
65 ACL_POLICY_DENY = 2, /* deny traffic from MAC */
66};
67
68#define ACL_HASHSIZE 32
69
70struct acl {
71 TAILQ_ENTRY(acl) acl_list;
72 LIST_ENTRY(acl) acl_hash;
73 u_int8_t acl_macaddr[IEEE80211_ADDR_LEN];
74};
75struct aclstate {
76 acl_lock_t as_lock;
77 int as_policy;
|
| 78 int as_nacls;
|
78 TAILQ_HEAD(, acl) as_list; /* list of all ACL's */
79 LIST_HEAD(, acl) as_hash[ACL_HASHSIZE];
80 struct ieee80211com *as_ic;
81};
82
83/* simple hash is enough for variation of macaddr */
84#define ACL_HASH(addr) \
85 (((const u_int8_t *)(addr))[IEEE80211_ADDR_LEN - 1] % ACL_HASHSIZE)
86
87MALLOC_DEFINE(M_80211_ACL, "acl", "802.11 station acl");
88
89static int acl_free_all(struct ieee80211com *);
90
91static int
92acl_attach(struct ieee80211com *ic)
93{
94 struct aclstate *as;
95
96 MALLOC(as, struct aclstate *, sizeof(struct aclstate),
| 79 TAILQ_HEAD(, acl) as_list; /* list of all ACL's */
80 LIST_HEAD(, acl) as_hash[ACL_HASHSIZE];
81 struct ieee80211com *as_ic;
82};
83
84/* simple hash is enough for variation of macaddr */
85#define ACL_HASH(addr) \
86 (((const u_int8_t *)(addr))[IEEE80211_ADDR_LEN - 1] % ACL_HASHSIZE)
87
88MALLOC_DEFINE(M_80211_ACL, "acl", "802.11 station acl");
89
90static int acl_free_all(struct ieee80211com *);
91
92static int
93acl_attach(struct ieee80211com *ic)
94{
95 struct aclstate *as;
96
97 MALLOC(as, struct aclstate *, sizeof(struct aclstate),
|
97 M_DEVBUF, M_NOWAIT | M_ZERO);
| 98 M_80211_ACL, M_NOWAIT | M_ZERO);
|
98 if (as == NULL)
99 return 0;
100 ACL_LOCK_INIT(as, "acl");
101 TAILQ_INIT(&as->as_list);
102 as->as_policy = ACL_POLICY_OPEN;
103 as->as_ic = ic;
104 ic->ic_as = as;
105 return 1;
106}
107
108static void
109acl_detach(struct ieee80211com *ic)
110{
111 struct aclstate *as = ic->ic_as;
112
113 acl_free_all(ic);
114 ic->ic_as = NULL;
115 ACL_LOCK_DESTROY(as);
116 FREE(as, M_DEVBUF);
117}
118
119static __inline struct acl *
120_find_acl(struct aclstate *as, const u_int8_t *macaddr)
121{
122 struct acl *acl;
123 int hash;
124
125 hash = ACL_HASH(macaddr);
126 LIST_FOREACH(acl, &as->as_hash[hash], acl_hash) {
127 if (IEEE80211_ADDR_EQ(acl->acl_macaddr, macaddr))
128 return acl;
129 }
130 return NULL;
131}
132
133static void
134_acl_free(struct aclstate *as, struct acl *acl)
135{
136 ACL_LOCK_ASSERT(as);
137
138 TAILQ_REMOVE(&as->as_list, acl, acl_list);
139 LIST_REMOVE(acl, acl_hash);
140 FREE(acl, M_80211_ACL);
| 99 if (as == NULL)
100 return 0;
101 ACL_LOCK_INIT(as, "acl");
102 TAILQ_INIT(&as->as_list);
103 as->as_policy = ACL_POLICY_OPEN;
104 as->as_ic = ic;
105 ic->ic_as = as;
106 return 1;
107}
108
109static void
110acl_detach(struct ieee80211com *ic)
111{
112 struct aclstate *as = ic->ic_as;
113
114 acl_free_all(ic);
115 ic->ic_as = NULL;
116 ACL_LOCK_DESTROY(as);
117 FREE(as, M_DEVBUF);
118}
119
120static __inline struct acl *
121_find_acl(struct aclstate *as, const u_int8_t *macaddr)
122{
123 struct acl *acl;
124 int hash;
125
126 hash = ACL_HASH(macaddr);
127 LIST_FOREACH(acl, &as->as_hash[hash], acl_hash) {
128 if (IEEE80211_ADDR_EQ(acl->acl_macaddr, macaddr))
129 return acl;
130 }
131 return NULL;
132}
133
134static void
135_acl_free(struct aclstate *as, struct acl *acl)
136{
137 ACL_LOCK_ASSERT(as);
138
139 TAILQ_REMOVE(&as->as_list, acl, acl_list);
140 LIST_REMOVE(acl, acl_hash);
141 FREE(acl, M_80211_ACL);
|
| 142 as->as_nacls--;
|
141}
142
143static int
144acl_check(struct ieee80211com *ic, const u_int8_t mac[IEEE80211_ADDR_LEN])
145{
146 struct aclstate *as = ic->ic_as;
147
148 switch (as->as_policy) {
149 case ACL_POLICY_OPEN:
150 return 1;
151 case ACL_POLICY_ALLOW:
152 return _find_acl(as, mac) != NULL;
153 case ACL_POLICY_DENY:
154 return _find_acl(as, mac) == NULL;
155 }
156 return 0; /* should not happen */
157}
158
159static int
160acl_add(struct ieee80211com *ic, const u_int8_t mac[IEEE80211_ADDR_LEN])
161{
162 struct aclstate *as = ic->ic_as;
163 struct acl *acl, *new;
164 int hash;
165
166 MALLOC(new, struct acl *, sizeof(struct acl), M_80211_ACL, M_NOWAIT | M_ZERO);
167 if (new == NULL) {
168 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
169 "ACL: add %s failed, no memory\n", ether_sprintf(mac));
170 /* XXX statistic */
171 return ENOMEM;
172 }
173
174 ACL_LOCK(as);
175 hash = ACL_HASH(mac);
176 LIST_FOREACH(acl, &as->as_hash[hash], acl_hash) {
177 if (IEEE80211_ADDR_EQ(acl->acl_macaddr, mac)) {
178 ACL_UNLOCK(as);
179 FREE(new, M_80211_ACL);
180 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
181 "ACL: add %s failed, already present\n",
182 ether_sprintf(mac));
183 return EEXIST;
184 }
185 }
186 IEEE80211_ADDR_COPY(new->acl_macaddr, mac);
187 TAILQ_INSERT_TAIL(&as->as_list, new, acl_list);
188 LIST_INSERT_HEAD(&as->as_hash[hash], new, acl_hash);
| 143}
144
145static int
146acl_check(struct ieee80211com *ic, const u_int8_t mac[IEEE80211_ADDR_LEN])
147{
148 struct aclstate *as = ic->ic_as;
149
150 switch (as->as_policy) {
151 case ACL_POLICY_OPEN:
152 return 1;
153 case ACL_POLICY_ALLOW:
154 return _find_acl(as, mac) != NULL;
155 case ACL_POLICY_DENY:
156 return _find_acl(as, mac) == NULL;
157 }
158 return 0; /* should not happen */
159}
160
161static int
162acl_add(struct ieee80211com *ic, const u_int8_t mac[IEEE80211_ADDR_LEN])
163{
164 struct aclstate *as = ic->ic_as;
165 struct acl *acl, *new;
166 int hash;
167
168 MALLOC(new, struct acl *, sizeof(struct acl), M_80211_ACL, M_NOWAIT | M_ZERO);
169 if (new == NULL) {
170 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
171 "ACL: add %s failed, no memory\n", ether_sprintf(mac));
172 /* XXX statistic */
173 return ENOMEM;
174 }
175
176 ACL_LOCK(as);
177 hash = ACL_HASH(mac);
178 LIST_FOREACH(acl, &as->as_hash[hash], acl_hash) {
179 if (IEEE80211_ADDR_EQ(acl->acl_macaddr, mac)) {
180 ACL_UNLOCK(as);
181 FREE(new, M_80211_ACL);
182 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
183 "ACL: add %s failed, already present\n",
184 ether_sprintf(mac));
185 return EEXIST;
186 }
187 }
188 IEEE80211_ADDR_COPY(new->acl_macaddr, mac);
189 TAILQ_INSERT_TAIL(&as->as_list, new, acl_list);
190 LIST_INSERT_HEAD(&as->as_hash[hash], new, acl_hash);
|
| 191 as->as_nacls++;
|
189 ACL_UNLOCK(as);
190
191 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
192 "ACL: add %s\n", ether_sprintf(mac));
193 return 0;
194}
195
196static int
197acl_remove(struct ieee80211com *ic, const u_int8_t mac[IEEE80211_ADDR_LEN])
198{
199 struct aclstate *as = ic->ic_as;
200 struct acl *acl;
201
202 ACL_LOCK(as);
203 acl = _find_acl(as, mac);
204 if (acl != NULL)
205 _acl_free(as, acl);
206 ACL_UNLOCK(as);
207
208 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
209 "ACL: remove %s%s\n", ether_sprintf(mac),
210 acl == NULL ? ", not present" : "");
211
212 return (acl == NULL ? ENOENT : 0);
213}
214
215static int
216acl_free_all(struct ieee80211com *ic)
217{
218 struct aclstate *as = ic->ic_as;
219 struct acl *acl;
220
221 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL, "ACL: %s\n", "free all");
222
223 ACL_LOCK(as);
224 while ((acl = TAILQ_FIRST(&as->as_list)) != NULL)
225 _acl_free(as, acl);
226 ACL_UNLOCK(as);
227
228 return 0;
229}
230
231static int
232acl_setpolicy(struct ieee80211com *ic, int policy)
233{
234 struct aclstate *as = ic->ic_as;
235
236 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
237 "ACL: set policy to %u\n", policy);
238
239 switch (policy) {
240 case IEEE80211_MACCMD_POLICY_OPEN:
241 as->as_policy = ACL_POLICY_OPEN;
242 break;
243 case IEEE80211_MACCMD_POLICY_ALLOW:
244 as->as_policy = ACL_POLICY_ALLOW;
245 break;
246 case IEEE80211_MACCMD_POLICY_DENY:
247 as->as_policy = ACL_POLICY_DENY;
248 break;
249 default:
250 return EINVAL;
251 }
252 return 0;
253}
254
255static int
256acl_getpolicy(struct ieee80211com *ic)
257{
258 struct aclstate *as = ic->ic_as;
259
260 return as->as_policy;
261}
262
| 192 ACL_UNLOCK(as);
193
194 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
195 "ACL: add %s\n", ether_sprintf(mac));
196 return 0;
197}
198
199static int
200acl_remove(struct ieee80211com *ic, const u_int8_t mac[IEEE80211_ADDR_LEN])
201{
202 struct aclstate *as = ic->ic_as;
203 struct acl *acl;
204
205 ACL_LOCK(as);
206 acl = _find_acl(as, mac);
207 if (acl != NULL)
208 _acl_free(as, acl);
209 ACL_UNLOCK(as);
210
211 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
212 "ACL: remove %s%s\n", ether_sprintf(mac),
213 acl == NULL ? ", not present" : "");
214
215 return (acl == NULL ? ENOENT : 0);
216}
217
218static int
219acl_free_all(struct ieee80211com *ic)
220{
221 struct aclstate *as = ic->ic_as;
222 struct acl *acl;
223
224 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL, "ACL: %s\n", "free all");
225
226 ACL_LOCK(as);
227 while ((acl = TAILQ_FIRST(&as->as_list)) != NULL)
228 _acl_free(as, acl);
229 ACL_UNLOCK(as);
230
231 return 0;
232}
233
234static int
235acl_setpolicy(struct ieee80211com *ic, int policy)
236{
237 struct aclstate *as = ic->ic_as;
238
239 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ACL,
240 "ACL: set policy to %u\n", policy);
241
242 switch (policy) {
243 case IEEE80211_MACCMD_POLICY_OPEN:
244 as->as_policy = ACL_POLICY_OPEN;
245 break;
246 case IEEE80211_MACCMD_POLICY_ALLOW:
247 as->as_policy = ACL_POLICY_ALLOW;
248 break;
249 case IEEE80211_MACCMD_POLICY_DENY:
250 as->as_policy = ACL_POLICY_DENY;
251 break;
252 default:
253 return EINVAL;
254 }
255 return 0;
256}
257
258static int
259acl_getpolicy(struct ieee80211com *ic)
260{
261 struct aclstate *as = ic->ic_as;
262
263 return as->as_policy;
264}
265
|
| 266static int
267acl_setioctl(struct ieee80211com *ic, struct ieee80211req *ireq)
268{
269
270 return EINVAL;
271}
272
273static int
274acl_getioctl(struct ieee80211com *ic, struct ieee80211req *ireq)
275{
276 struct aclstate *as = ic->ic_as;
277 struct acl *acl;
278 struct ieee80211req_maclist *ap;
279 int error, space, i;
280
281 switch (ireq->i_val) {
282 case IEEE80211_MACCMD_POLICY:
283 ireq->i_val = as->as_policy;
284 return 0;
285 case IEEE80211_MACCMD_LIST:
286 space = as->as_nacls * IEEE80211_ADDR_LEN;
287 if (ireq->i_len == 0) {
288 ireq->i_len = space; /* return required space */
289 return 0; /* NB: must not error */
290 }
291 MALLOC(ap, struct ieee80211req_maclist *, space,
292 M_TEMP, M_NOWAIT);
293 if (ap == NULL)
294 return ENOMEM;
295 i = 0;
296 ACL_LOCK(as);
297 TAILQ_FOREACH(acl, &as->as_list, acl_list) {
298 IEEE80211_ADDR_COPY(ap[i].ml_macaddr, acl->acl_macaddr);
299 i++;
300 }
301 ACL_UNLOCK(as);
302 if (ireq->i_len >= space) {
303 error = copyout(ap, ireq->i_data, space);
304 ireq->i_len = space;
305 } else
306 error = copyout(ap, ireq->i_data, ireq->i_len);
307 FREE(ap, M_TEMP);
308 return error;
309 }
310 return EINVAL;
311}
312
|
263static const struct ieee80211_aclator mac = {
264 .iac_name = "mac",
265 .iac_attach = acl_attach,
266 .iac_detach = acl_detach,
267 .iac_check = acl_check,
268 .iac_add = acl_add,
269 .iac_remove = acl_remove,
270 .iac_flush = acl_free_all,
271 .iac_setpolicy = acl_setpolicy,
272 .iac_getpolicy = acl_getpolicy,
| 313static const struct ieee80211_aclator mac = {
314 .iac_name = "mac",
315 .iac_attach = acl_attach,
316 .iac_detach = acl_detach,
317 .iac_check = acl_check,
318 .iac_add = acl_add,
319 .iac_remove = acl_remove,
320 .iac_flush = acl_free_all,
321 .iac_setpolicy = acl_setpolicy,
322 .iac_getpolicy = acl_getpolicy,
|
| 323 .iac_setioctl = acl_setioctl,
324 .iac_getioctl = acl_getioctl,
|
273};
274
275/*
276 * Module glue.
277 */
278static int
279wlan_acl_modevent(module_t mod, int type, void *unused)
280{
281 switch (type) {
282 case MOD_LOAD:
283 if (bootverbose)
284 printf("wlan: <802.11 MAC ACL support>\n");
285 ieee80211_aclator_register(&mac);
286 return 0;
287 case MOD_UNLOAD:
288 ieee80211_aclator_unregister(&mac);
289 return 0;
290 }
291 return EINVAL;
292}
293
294static moduledata_t wlan_acl_mod = {
295 "wlan_acl",
296 wlan_acl_modevent,
297 0
298};
299DECLARE_MODULE(wlan_acl, wlan_acl_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST);
300MODULE_VERSION(wlan_acl, 1);
301MODULE_DEPEND(wlan_acl, wlan, 1, 1, 1);
| 325};
326
327/*
328 * Module glue.
329 */
330static int
331wlan_acl_modevent(module_t mod, int type, void *unused)
332{
333 switch (type) {
334 case MOD_LOAD:
335 if (bootverbose)
336 printf("wlan: <802.11 MAC ACL support>\n");
337 ieee80211_aclator_register(&mac);
338 return 0;
339 case MOD_UNLOAD:
340 ieee80211_aclator_unregister(&mac);
341 return 0;
342 }
343 return EINVAL;
344}
345
346static moduledata_t wlan_acl_mod = {
347 "wlan_acl",
348 wlan_acl_modevent,
349 0
350};
351DECLARE_MODULE(wlan_acl, wlan_acl_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST);
352MODULE_VERSION(wlan_acl, 1);
353MODULE_DEPEND(wlan_acl, wlan, 1, 1, 1);
|