1/*- 2 * Copyright (c) 2004 Andre Oppermann, Internet Business Solutions AG 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27#include <sys/cdefs.h> 28__FBSDID("$FreeBSD: stable/11/sys/netpfil/ipfw/ip_fw_pfil.c 346210 2019-04-14 12:34:30Z ae $"); 29 30#include "opt_ipfw.h" 31#include "opt_inet.h" 32#include "opt_inet6.h" 33#ifndef INET 34#error IPFIREWALL requires INET. 35#endif /* INET */ 36 37#include <sys/param.h> 38#include <sys/systm.h> 39#include <sys/malloc.h> 40#include <sys/mbuf.h> 41#include <sys/module.h> 42#include <sys/kernel.h> 43#include <sys/lock.h> 44#include <sys/rwlock.h> 45#include <sys/socket.h> 46#include <sys/sysctl.h> 47 48#include <net/if.h> 49#include <net/route.h> 50#include <net/ethernet.h> 51#include <net/pfil.h> 52#include <net/vnet.h> 53 54#include <netinet/in.h> 55#include <netinet/in_systm.h> 56#include <netinet/ip.h> 57#include <netinet/ip_var.h> 58#include <netinet/ip_fw.h> 59#ifdef INET6 60#include <netinet/ip6.h> 61#include <netinet6/ip6_var.h> 62#include <netinet6/scope6_var.h> 63#endif 64 65#include <netgraph/ng_ipfw.h> 66 67#include <netpfil/ipfw/ip_fw_private.h> 68 69#include <machine/in_cksum.h> 70 71static VNET_DEFINE(int, fw_enable) = 1; 72#define V_fw_enable VNET(fw_enable) 73 74#ifdef INET6 75static VNET_DEFINE(int, fw6_enable) = 1; 76#define V_fw6_enable VNET(fw6_enable) 77#endif 78 79static VNET_DEFINE(int, fwlink_enable) = 0; 80#define V_fwlink_enable VNET(fwlink_enable) 81 82int ipfw_chg_hook(SYSCTL_HANDLER_ARGS); 83 84/* Forward declarations. */ 85static int ipfw_divert(struct mbuf **, int, struct ipfw_rule_ref *, int); 86int ipfw_check_packet(void *, struct mbuf **, struct ifnet *, int, 87 struct inpcb *); 88int ipfw_check_frame(void *, struct mbuf **, struct ifnet *, int, 89 struct inpcb *); 90 91#ifdef SYSCTL_NODE 92 93SYSBEGIN(f1) 94 95SYSCTL_DECL(_net_inet_ip_fw); 96SYSCTL_PROC(_net_inet_ip_fw, OID_AUTO, enable, 97 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE3, 98 &VNET_NAME(fw_enable), 0, ipfw_chg_hook, "I", "Enable ipfw"); 99#ifdef INET6 100SYSCTL_DECL(_net_inet6_ip6_fw); 101SYSCTL_PROC(_net_inet6_ip6_fw, OID_AUTO, enable, 102 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE3, 103 &VNET_NAME(fw6_enable), 0, ipfw_chg_hook, "I", "Enable ipfw+6"); 104#endif /* INET6 */ 105 106SYSCTL_DECL(_net_link_ether); 107SYSCTL_PROC(_net_link_ether, OID_AUTO, ipfw, 108 CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE3, 109 &VNET_NAME(fwlink_enable), 0, ipfw_chg_hook, "I", 110 "Pass ether pkts through firewall"); 111 112SYSEND 113 114#endif /* SYSCTL_NODE */ 115 116/* 117 * The pfilter hook to pass packets to ipfw_chk and then to 118 * dummynet, divert, netgraph or other modules. 119 * The packet may be consumed. 120 */ 121int 122ipfw_check_packet(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir, 123 struct inpcb *inp) 124{ 125 struct ip_fw_args args; 126 struct m_tag *tag; 127 int ipfw, ret; 128 129 /* convert dir to IPFW values */ 130 dir = (dir == PFIL_IN) ? DIR_IN : DIR_OUT; 131 args.flags = 0; 132again: 133 /* 134 * extract and remove the tag if present. If we are left 135 * with onepass, optimize the outgoing path. 136 */ 137 tag = m_tag_locate(*m0, MTAG_IPFW_RULE, 0, NULL); 138 if (tag != NULL) { 139 args.rule = *((struct ipfw_rule_ref *)(tag+1)); 140 m_tag_delete(*m0, tag); 141 if (args.rule.info & IPFW_ONEPASS) 142 return (0); 143 args.flags |= IPFW_ARGS_REF; 144 } 145 146 args.m = *m0; 147 args.oif = dir == DIR_OUT ? ifp : NULL; 148 args.inp = inp; 149 150 ipfw = ipfw_chk(&args); 151 *m0 = args.m; 152 153 KASSERT(*m0 != NULL || ipfw == IP_FW_DENY || 154 ipfw == IP_FW_NAT64, ("%s: m0 is NULL", __func__)); 155 156 /* breaking out of the switch means drop */ 157 switch (ipfw) { 158 case IP_FW_PASS: 159 /* next_hop may be set by ipfw_chk */ 160 if ((args.flags & (IPFW_ARGS_NH4 | IPFW_ARGS_NH4PTR | 161 IPFW_ARGS_NH6 | IPFW_ARGS_NH6PTR)) == 0) { 162 ret = 0; 163 break; 164 } 165#if (!defined(INET6) && !defined(INET)) 166 ret = EACCES; 167#else 168 { 169 void *psa; 170 size_t len; 171#ifdef INET 172 if (args.flags & (IPFW_ARGS_NH4 | IPFW_ARGS_NH4PTR)) { 173 MPASS((args.flags & (IPFW_ARGS_NH4 | 174 IPFW_ARGS_NH4PTR)) != (IPFW_ARGS_NH4 | 175 IPFW_ARGS_NH4PTR)); 176 MPASS((args.flags & (IPFW_ARGS_NH6 | 177 IPFW_ARGS_NH6PTR)) == 0); 178 len = sizeof(struct sockaddr_in); 179 psa = (args.flags & IPFW_ARGS_NH4) ? 180 &args.hopstore : args.next_hop; 181 if (in_localip(satosin(psa)->sin_addr)) 182 (*m0)->m_flags |= M_FASTFWD_OURS; 183 (*m0)->m_flags |= M_IP_NEXTHOP; 184 } 185#endif /* INET */ 186#ifdef INET6 187 if (args.flags & (IPFW_ARGS_NH6 | IPFW_ARGS_NH6PTR)) { 188 MPASS((args.flags & (IPFW_ARGS_NH6 | 189 IPFW_ARGS_NH6PTR)) != (IPFW_ARGS_NH6 | 190 IPFW_ARGS_NH6PTR)); 191 MPASS((args.flags & (IPFW_ARGS_NH4 | 192 IPFW_ARGS_NH4PTR)) == 0); 193 len = sizeof(struct sockaddr_in6); 194 psa = args.next_hop6; 195 (*m0)->m_flags |= M_IP6_NEXTHOP; 196 } 197#endif /* INET6 */ 198 /* 199 * Incoming packets should not be tagged so we do not 200 * m_tag_find. Outgoing packets may be tagged, so we 201 * reuse the tag if present. 202 */ 203 tag = (dir == DIR_IN) ? NULL : 204 m_tag_find(*m0, PACKET_TAG_IPFORWARD, NULL); 205 if (tag != NULL) { 206 m_tag_unlink(*m0, tag); 207 } else { 208 tag = m_tag_get(PACKET_TAG_IPFORWARD, len, 209 M_NOWAIT); 210 if (tag == NULL) { 211 ret = EACCES; 212 break; /* i.e. drop */ 213 } 214 } 215 if ((args.flags & IPFW_ARGS_NH6) == 0) 216 bcopy(psa, tag + 1, len); 217 m_tag_prepend(*m0, tag); 218 ret = 0; 219#ifdef INET6 220 /* IPv6 next hop needs additional handling */ 221 if (args.flags & (IPFW_ARGS_NH6 | IPFW_ARGS_NH6PTR)) { 222 struct sockaddr_in6 *sa6; 223 224 sa6 = satosin6(tag + 1); 225 if (args.flags & IPFW_ARGS_NH6) { 226 sa6->sin6_family = AF_INET6; 227 sa6->sin6_len = sizeof(*sa6); 228 sa6->sin6_addr = args.hopstore6.sin6_addr; 229 sa6->sin6_port = args.hopstore6.sin6_port; 230 sa6->sin6_scope_id = 231 args.hopstore6.sin6_scope_id; 232 } 233 /* 234 * If nh6 address is link-local we should convert 235 * it to kernel internal form before doing any 236 * comparisons. 237 */ 238 if (sa6_embedscope(sa6, V_ip6_use_defzone) != 0) { 239 ret = EACCES; 240 break; 241 } 242 if (in6_localip(&sa6->sin6_addr)) 243 (*m0)->m_flags |= M_FASTFWD_OURS; 244 } 245#endif /* INET6 */ 246 } 247#endif /* INET || INET6 */ 248 break; 249 250 case IP_FW_DENY: 251 ret = EACCES; 252 break; /* i.e. drop */ 253 254 case IP_FW_DUMMYNET: 255 ret = EACCES; 256 if (ip_dn_io_ptr == NULL) 257 break; /* i.e. drop */ 258 MPASS(args.flags & IPFW_ARGS_REF); 259 if (mtod(*m0, struct ip *)->ip_v == 4) 260 ret = ip_dn_io_ptr(m0, dir, &args); 261 else if (mtod(*m0, struct ip *)->ip_v == 6) 262 ret = ip_dn_io_ptr(m0, dir | PROTO_IPV6, &args); 263 else 264 break; /* drop it */ 265 /* 266 * XXX should read the return value. 267 * dummynet normally eats the packet and sets *m0=NULL 268 * unless the packet can be sent immediately. In this 269 * case args is updated and we should re-run the 270 * check without clearing args. 271 */ 272 if (*m0 != NULL) 273 goto again; 274 break; 275 276 case IP_FW_TEE: 277 case IP_FW_DIVERT: 278 if (ip_divert_ptr == NULL) { 279 ret = EACCES; 280 break; /* i.e. drop */ 281 } 282 MPASS(args.flags & IPFW_ARGS_REF); 283 ret = ipfw_divert(m0, dir, &args.rule, 284 (ipfw == IP_FW_TEE) ? 1 : 0); 285 /* continue processing for the original packet (tee). */ 286 if (*m0) 287 goto again; 288 break; 289 290 case IP_FW_NGTEE: 291 case IP_FW_NETGRAPH: 292 if (ng_ipfw_input_p == NULL) { 293 ret = EACCES; 294 break; /* i.e. drop */ 295 } 296 MPASS(args.flags & IPFW_ARGS_REF); 297 ret = ng_ipfw_input_p(m0, dir, &args, 298 (ipfw == IP_FW_NGTEE) ? 1 : 0); 299 if (ipfw == IP_FW_NGTEE) /* ignore errors for NGTEE */ 300 goto again; /* continue with packet */ 301 break; 302 303 case IP_FW_NAT: 304 /* honor one-pass in case of successful nat */ 305 if (V_fw_one_pass) { 306 ret = 0; 307 break; 308 } 309 goto again; 310 311 case IP_FW_REASS: 312 goto again; /* continue with packet */ 313 314 case IP_FW_NAT64: 315 ret = 0; 316 break; 317 318 default: 319 KASSERT(0, ("%s: unknown retval", __func__)); 320 } 321 322 if (ret != 0) { 323 if (*m0) 324 FREE_PKT(*m0); 325 *m0 = NULL; 326 } 327 328 return (ret); 329} 330 331/* 332 * ipfw processing for ethernet packets (in and out). 333 */ 334int 335ipfw_check_frame(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir, 336 struct inpcb *inp) 337{ 338 struct ip_fw_args args; 339 struct ether_header save_eh; 340 struct ether_header *eh; 341 struct m_tag *mtag; 342 struct mbuf *m; 343 int i, ret; 344 345 args.flags = IPFW_ARGS_ETHER; 346again: 347 /* fetch start point from rule, if any. remove the tag if present. */ 348 mtag = m_tag_locate(*m0, MTAG_IPFW_RULE, 0, NULL); 349 if (mtag != NULL) { 350 args.rule = *((struct ipfw_rule_ref *)(mtag+1)); 351 m_tag_delete(*m0, mtag); 352 if (args.rule.info & IPFW_ONEPASS) 353 return (0); 354 args.flags |= IPFW_ARGS_REF; 355 } 356 357 /* I need some amt of data to be contiguous */ 358 m = *m0; 359 i = min(m->m_pkthdr.len, max_protohdr); 360 if (m->m_len < i) { 361 m = m_pullup(m, i); 362 if (m == NULL) { 363 *m0 = m; 364 return (0); 365 } 366 } 367 eh = mtod(m, struct ether_header *); 368 save_eh = *eh; /* save copy for restore below */ 369 m_adj(m, ETHER_HDR_LEN); /* strip ethernet header */ 370 371 args.m = m; /* the packet we are looking at */ 372 args.oif = dir == PFIL_OUT ? ifp: NULL; /* destination, if any */ 373 args.eh = &save_eh; /* MAC header for bridged/MAC packets */ 374 args.inp = inp; /* used by ipfw uid/gid/jail rules */ 375 i = ipfw_chk(&args); 376 m = args.m; 377 if (m != NULL) { 378 /* 379 * Restore Ethernet header, as needed, in case the 380 * mbuf chain was replaced by ipfw. 381 */ 382 M_PREPEND(m, ETHER_HDR_LEN, M_NOWAIT); 383 if (m == NULL) { 384 *m0 = NULL; 385 return (0); 386 } 387 if (eh != mtod(m, struct ether_header *)) 388 bcopy(&save_eh, mtod(m, struct ether_header *), 389 ETHER_HDR_LEN); 390 } 391 *m0 = m; 392 393 ret = 0; 394 /* Check result of ipfw_chk() */ 395 switch (i) { 396 case IP_FW_PASS: 397 break; 398 399 case IP_FW_DENY: 400 ret = EACCES; 401 break; /* i.e. drop */ 402 403 case IP_FW_DUMMYNET: 404 ret = EACCES; 405 406 if (ip_dn_io_ptr == NULL) 407 break; /* i.e. drop */ 408 409 *m0 = NULL; 410 dir = (dir == PFIL_IN) ? DIR_IN : DIR_OUT; 411 MPASS(args.flags & IPFW_ARGS_REF); 412 ip_dn_io_ptr(&m, dir | PROTO_LAYER2, &args); 413 return 0; 414 415 case IP_FW_NGTEE: 416 case IP_FW_NETGRAPH: 417 if (ng_ipfw_input_p == NULL) { 418 ret = EACCES; 419 break; /* i.e. drop */ 420 } 421 MPASS(args.flags & IPFW_ARGS_REF); 422 ret = ng_ipfw_input_p(m0, (dir == PFIL_IN) ? DIR_IN : DIR_OUT, 423 &args, (i == IP_FW_NGTEE) ? 1 : 0); 424 if (i == IP_FW_NGTEE) /* ignore errors for NGTEE */ 425 goto again; /* continue with packet */ 426 break; 427 428 default: 429 KASSERT(0, ("%s: unknown retval", __func__)); 430 } 431 432 if (ret != 0) { 433 if (*m0) 434 FREE_PKT(*m0); 435 *m0 = NULL; 436 } 437 438 return (ret); 439} 440 441/* do the divert, return 1 on error 0 on success */ 442static int 443ipfw_divert(struct mbuf **m0, int incoming, struct ipfw_rule_ref *rule, 444 int tee) 445{ 446 /* 447 * ipfw_chk() has already tagged the packet with the divert tag. 448 * If tee is set, copy packet and return original. 449 * If not tee, consume packet and send it to divert socket. 450 */ 451 struct mbuf *clone; 452 struct ip *ip = mtod(*m0, struct ip *); 453 struct m_tag *tag; 454 455 /* Cloning needed for tee? */ 456 if (tee == 0) { 457 clone = *m0; /* use the original mbuf */ 458 *m0 = NULL; 459 } else { 460 clone = m_dup(*m0, M_NOWAIT); 461 /* If we cannot duplicate the mbuf, we sacrifice the divert 462 * chain and continue with the tee-ed packet. 463 */ 464 if (clone == NULL) 465 return 1; 466 } 467 468 /* 469 * Divert listeners can normally handle non-fragmented packets, 470 * but we can only reass in the non-tee case. 471 * This means that listeners on a tee rule may get fragments, 472 * and have to live with that. 473 * Note that we now have the 'reass' ipfw option so if we care 474 * we can do it before a 'tee'. 475 */ 476 if (!tee) switch (ip->ip_v) { 477 case IPVERSION: 478 if (ntohs(ip->ip_off) & (IP_MF | IP_OFFMASK)) { 479 int hlen; 480 struct mbuf *reass; 481 482 reass = ip_reass(clone); /* Reassemble packet. */ 483 if (reass == NULL) 484 return 0; /* not an error */ 485 /* if reass = NULL then it was consumed by ip_reass */ 486 /* 487 * IP header checksum fixup after reassembly and leave header 488 * in network byte order. 489 */ 490 ip = mtod(reass, struct ip *); 491 hlen = ip->ip_hl << 2; 492 ip->ip_sum = 0; 493 if (hlen == sizeof(struct ip)) 494 ip->ip_sum = in_cksum_hdr(ip); 495 else 496 ip->ip_sum = in_cksum(reass, hlen); 497 clone = reass; 498 } 499 break; 500#ifdef INET6 501 case IPV6_VERSION >> 4: 502 { 503 struct ip6_hdr *const ip6 = mtod(clone, struct ip6_hdr *); 504 505 if (ip6->ip6_nxt == IPPROTO_FRAGMENT) { 506 int nxt, off; 507 508 off = sizeof(struct ip6_hdr); 509 nxt = frag6_input(&clone, &off, 0); 510 if (nxt == IPPROTO_DONE) 511 return (0); 512 } 513 break; 514 } 515#endif 516 } 517 518 /* attach a tag to the packet with the reinject info */ 519 tag = m_tag_alloc(MTAG_IPFW_RULE, 0, 520 sizeof(struct ipfw_rule_ref), M_NOWAIT); 521 if (tag == NULL) { 522 FREE_PKT(clone); 523 return 1; 524 } 525 *((struct ipfw_rule_ref *)(tag+1)) = *rule; 526 m_tag_prepend(clone, tag); 527 528 /* Do the dirty job... */ 529 ip_divert_ptr(clone, incoming); 530 return 0; 531} 532 533/* 534 * attach or detach hooks for a given protocol family 535 */ 536static int 537ipfw_hook(int onoff, int pf) 538{ 539 struct pfil_head *pfh; 540 pfil_func_t hook_func; 541 542 pfh = pfil_head_get(PFIL_TYPE_AF, pf); 543 if (pfh == NULL) 544 return ENOENT; 545 546 hook_func = (pf == AF_LINK) ? ipfw_check_frame : ipfw_check_packet; 547 548 (void) (onoff ? pfil_add_hook : pfil_remove_hook) 549 (hook_func, NULL, PFIL_IN | PFIL_OUT | PFIL_WAITOK, pfh); 550 551 return 0; 552} 553 554int 555ipfw_attach_hooks(int arg) 556{ 557 int error = 0; 558 559 if (arg == 0) /* detach */ 560 ipfw_hook(0, AF_INET); 561 else if (V_fw_enable && ipfw_hook(1, AF_INET) != 0) { 562 error = ENOENT; /* see ip_fw_pfil.c::ipfw_hook() */ 563 printf("ipfw_hook() error\n"); 564 } 565#ifdef INET6 566 if (arg == 0) /* detach */ 567 ipfw_hook(0, AF_INET6); 568 else if (V_fw6_enable && ipfw_hook(1, AF_INET6) != 0) { 569 error = ENOENT; 570 printf("ipfw6_hook() error\n"); 571 } 572#endif 573 if (arg == 0) /* detach */ 574 ipfw_hook(0, AF_LINK); 575 else if (V_fwlink_enable && ipfw_hook(1, AF_LINK) != 0) { 576 error = ENOENT; 577 printf("ipfw_link_hook() error\n"); 578 } 579 return error; 580} 581 582int 583ipfw_chg_hook(SYSCTL_HANDLER_ARGS) 584{ 585 int newval; 586 int error; 587 int af; 588 589 if (arg1 == &V_fw_enable) 590 af = AF_INET; 591#ifdef INET6 592 else if (arg1 == &V_fw6_enable) 593 af = AF_INET6; 594#endif 595 else if (arg1 == &V_fwlink_enable) 596 af = AF_LINK; 597 else 598 return (EINVAL); 599 600 newval = *(int *)arg1; 601 /* Handle sysctl change */ 602 error = sysctl_handle_int(oidp, &newval, 0, req); 603 604 if (error) 605 return (error); 606 607 /* Formalize new value */ 608 newval = (newval) ? 1 : 0; 609 610 if (*(int *)arg1 == newval) 611 return (0); 612 613 error = ipfw_hook(newval, af); 614 if (error) 615 return (error); 616 *(int *)arg1 = newval; 617 618 return (0); 619} 620/* end of file */ 621