1/*-
2 * ng_etf.c  Ethertype filter
3 */
4
5/*-
6 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
7 *
8 * Copyright (c) 2001, FreeBSD Incorporated
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice unmodified, this list of conditions, and the following
16 *    disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 *    notice, this list of conditions and the following disclaimer in the
19 *    documentation and/or other materials provided with the distribution.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 *
33 * Author: Julian Elischer <julian@freebsd.org>
34 *
35 * $FreeBSD$
36 */
37
38#include <sys/param.h>
39#include <sys/systm.h>
40#include <sys/kernel.h>
41#include <sys/mbuf.h>
42#include <sys/malloc.h>
43#include <sys/ctype.h>
44#include <sys/errno.h>
45#include <sys/queue.h>
46#include <sys/syslog.h>
47
48#include <net/ethernet.h>
49
50#include <netgraph/ng_message.h>
51#include <netgraph/ng_parse.h>
52#include <netgraph/ng_etf.h>
53#include <netgraph/netgraph.h>
54
55/* If you do complicated mallocs you may want to do this */
56/* and use it for your mallocs */
57#ifdef NG_SEPARATE_MALLOC
58static MALLOC_DEFINE(M_NETGRAPH_ETF, "netgraph_etf", "netgraph etf node ");
59#else
60#define M_NETGRAPH_ETF M_NETGRAPH
61#endif
62
63/*
64 * This section contains the netgraph method declarations for the
65 * etf node. These methods define the netgraph 'type'.
66 */
67
68static ng_constructor_t	ng_etf_constructor;
69static ng_rcvmsg_t	ng_etf_rcvmsg;
70static ng_shutdown_t	ng_etf_shutdown;
71static ng_newhook_t	ng_etf_newhook;
72static ng_rcvdata_t	ng_etf_rcvdata;	 /* note these are both ng_rcvdata_t */
73static ng_disconnect_t	ng_etf_disconnect;
74
75/* Parse type for struct ng_etfstat */
76static const struct ng_parse_struct_field ng_etf_stat_type_fields[]
77	= NG_ETF_STATS_TYPE_INFO;
78static const struct ng_parse_type ng_etf_stat_type = {
79	&ng_parse_struct_type,
80	&ng_etf_stat_type_fields
81};
82/* Parse type for struct ng_setfilter */
83static const struct ng_parse_struct_field ng_etf_filter_type_fields[]
84	= NG_ETF_FILTER_TYPE_INFO;
85static const struct ng_parse_type ng_etf_filter_type = {
86	&ng_parse_struct_type,
87	&ng_etf_filter_type_fields
88};
89
90/* List of commands and how to convert arguments to/from ASCII */
91static const struct ng_cmdlist ng_etf_cmdlist[] = {
92	{
93	  NGM_ETF_COOKIE,
94	  NGM_ETF_GET_STATUS,
95	  "getstatus",
96	  NULL,
97	  &ng_etf_stat_type,
98	},
99	{
100	  NGM_ETF_COOKIE,
101	  NGM_ETF_SET_FLAG,
102	  "setflag",
103	  &ng_parse_int32_type,
104	  NULL
105	},
106	{
107	  NGM_ETF_COOKIE,
108	  NGM_ETF_SET_FILTER,
109	  "setfilter",
110	  &ng_etf_filter_type,
111	  NULL
112	},
113	{ 0 }
114};
115
116/* Netgraph node type descriptor */
117static struct ng_type typestruct = {
118	.version =	NG_ABI_VERSION,
119	.name =		NG_ETF_NODE_TYPE,
120	.constructor =	ng_etf_constructor,
121	.rcvmsg =	ng_etf_rcvmsg,
122	.shutdown =	ng_etf_shutdown,
123	.newhook =	ng_etf_newhook,
124	.rcvdata =	ng_etf_rcvdata,
125	.disconnect =	ng_etf_disconnect,
126	.cmdlist =	ng_etf_cmdlist,
127};
128NETGRAPH_INIT(etf, &typestruct);
129
130/* Information we store for each hook on each node */
131struct ETF_hookinfo {
132	hook_p  hook;
133};
134
135struct filter {
136	LIST_ENTRY(filter) next;
137	u_int16_t	ethertype;	/* network order ethertype */
138	hook_p		match_hook;	/* Hook to use on a match */
139};
140
141#define HASHSIZE 16 /* Dont change this without changing HASH() */
142#define HASH(et) ((((et)>>12)+((et)>>8)+((et)>>4)+(et)) & 0x0f)
143LIST_HEAD(filterhead, filter);
144
145/* Information we store for each node */
146struct ETF {
147	struct ETF_hookinfo downstream_hook;
148	struct ETF_hookinfo nomatch_hook;
149	node_p		node;		/* back pointer to node */
150	u_int   	packets_in;	/* packets in from downstream */
151	u_int   	packets_out;	/* packets out towards downstream */
152	u_int32_t	flags;
153	struct filterhead hashtable[HASHSIZE];
154};
155typedef struct ETF *etf_p;
156
157static struct filter *
158ng_etf_findentry(etf_p etfp, u_int16_t ethertype)
159{
160	struct filterhead *chain = etfp->hashtable + HASH(ethertype);
161	struct filter *fil;
162
163	LIST_FOREACH(fil, chain, next) {
164		if (fil->ethertype == ethertype) {
165			return (fil);
166		}
167	}
168	return (NULL);
169}
170
171/*
172 * Allocate the private data structure. The generic node has already
173 * been created. Link them together. We arrive with a reference to the node
174 * i.e. the reference count is incremented for us already.
175 */
176static int
177ng_etf_constructor(node_p node)
178{
179	etf_p privdata;
180	int i;
181
182	/* Initialize private descriptor */
183	privdata = malloc(sizeof(*privdata), M_NETGRAPH_ETF, M_WAITOK | M_ZERO);
184	for (i = 0; i < HASHSIZE; i++) {
185		LIST_INIT((privdata->hashtable + i));
186	}
187
188	/* Link structs together; this counts as our one reference to node */
189	NG_NODE_SET_PRIVATE(node, privdata);
190	privdata->node = node;
191	return (0);
192}
193
194/*
195 * Give our ok for a hook to be added...
196 * All names are ok. Two names are special.
197 */
198static int
199ng_etf_newhook(node_p node, hook_p hook, const char *name)
200{
201	const etf_p etfp = NG_NODE_PRIVATE(node);
202	struct ETF_hookinfo *hpriv;
203
204	if (strcmp(name, NG_ETF_HOOK_DOWNSTREAM) == 0) {
205		etfp->downstream_hook.hook = hook;
206		NG_HOOK_SET_PRIVATE(hook, &etfp->downstream_hook);
207		etfp->packets_in = 0;
208		etfp->packets_out = 0;
209	} else if (strcmp(name, NG_ETF_HOOK_NOMATCH) == 0) {
210		etfp->nomatch_hook.hook = hook;
211		NG_HOOK_SET_PRIVATE(hook, &etfp->nomatch_hook);
212	} else {
213		/*
214		 * Any other hook name is valid and can
215		 * later be associated with a filter rule.
216		 */
217		hpriv = malloc(sizeof(*hpriv),
218			M_NETGRAPH_ETF, M_NOWAIT | M_ZERO);
219		if (hpriv == NULL) {
220			return (ENOMEM);
221		}
222
223		NG_HOOK_SET_PRIVATE(hook, hpriv);
224		hpriv->hook = hook;
225	}
226	return(0);
227}
228
229/*
230 * Get a netgraph control message.
231 * We actually receive a queue item that has a pointer to the message.
232 * If we free the item, the message will be freed too, unless we remove
233 * it from the item using NGI_GET_MSG();
234 * The return address is also stored in the item, as an ng_ID_t,
235 * accessible as NGI_RETADDR(item);
236 * Check it is one we understand. If needed, send a response.
237 * We could save the address for an async action later, but don't here.
238 * Always free the message.
239 * The response should be in a malloc'd region that the caller can 'free'.
240 * The NG_MKRESPONSE macro does all this for us.
241 * A response is not required.
242 * Theoretically you could respond defferently to old message types if
243 * the cookie in the header didn't match what we consider to be current
244 * (so that old userland programs could continue to work).
245 */
246static int
247ng_etf_rcvmsg(node_p node, item_p item, hook_p lasthook)
248{
249	const etf_p etfp = NG_NODE_PRIVATE(node);
250	struct ng_mesg *resp = NULL;
251	int error = 0;
252	struct ng_mesg *msg;
253
254	NGI_GET_MSG(item, msg);
255	/* Deal with message according to cookie and command */
256	switch (msg->header.typecookie) {
257	case NGM_ETF_COOKIE:
258		switch (msg->header.cmd) {
259		case NGM_ETF_GET_STATUS:
260		    {
261			struct ng_etfstat *stats;
262
263			NG_MKRESPONSE(resp, msg, sizeof(*stats), M_NOWAIT);
264			if (!resp) {
265				error = ENOMEM;
266				break;
267			}
268			stats = (struct ng_etfstat *) resp->data;
269			stats->packets_in = etfp->packets_in;
270			stats->packets_out = etfp->packets_out;
271			break;
272		    }
273		case NGM_ETF_SET_FLAG:
274			if (msg->header.arglen != sizeof(u_int32_t)) {
275				error = EINVAL;
276				break;
277			}
278			etfp->flags = *((u_int32_t *) msg->data);
279			break;
280		case NGM_ETF_SET_FILTER:
281			{
282				struct ng_etffilter *f;
283				struct filter *fil;
284				hook_p  hook;
285
286				/* Check message long enough for this command */
287				if (msg->header.arglen != sizeof(*f)) {
288					error = EINVAL;
289					break;
290				}
291
292				/* Make sure hook referenced exists */
293				f = (struct ng_etffilter *)msg->data;
294				hook = ng_findhook(node, f->matchhook);
295				if (hook == NULL) {
296					error = ENOENT;
297					break;
298				}
299
300				/* and is not the downstream hook */
301				if (hook == etfp->downstream_hook.hook) {
302					error = EINVAL;
303					break;
304				}
305
306				/* Check we don't already trap this ethertype */
307				if (ng_etf_findentry(etfp,
308						htons(f->ethertype))) {
309					error = EEXIST;
310					break;
311				}
312
313				/*
314				 * Ok, make the filter and put it in the
315				 * hashtable ready for matching.
316				 */
317				fil = malloc(sizeof(*fil),
318					M_NETGRAPH_ETF, M_NOWAIT | M_ZERO);
319				if (fil == NULL) {
320					error = ENOMEM;
321					break;
322				}
323
324				fil->match_hook = hook;
325				fil->ethertype = htons(f->ethertype);
326				LIST_INSERT_HEAD( etfp->hashtable
327					+ HASH(fil->ethertype),
328						fil, next);
329			}
330			break;
331		default:
332			error = EINVAL;		/* unknown command */
333			break;
334		}
335		break;
336	default:
337		error = EINVAL;			/* unknown cookie type */
338		break;
339	}
340
341	/* Take care of synchronous response, if any */
342	NG_RESPOND_MSG(error, node, item, resp);
343	/* Free the message and return */
344	NG_FREE_MSG(msg);
345	return(error);
346}
347
348/*
349 * Receive data, and do something with it.
350 * Actually we receive a queue item which holds the data.
351 * If we free the item it will also free the data unless we have previously
352 * disassociated it using the NGI_GET_etf() macro.
353 * Possibly send it out on another link after processing.
354 * Possibly do something different if it comes from different
355 * hooks. The caller will never free m , so if we use up this data
356 * or abort we must free it.
357 *
358 * If we want, we may decide to force this data to be queued and reprocessed
359 * at the netgraph NETISR time.
360 * We would do that by setting the HK_QUEUE flag on our hook. We would do that
361 * in the connect() method.
362 */
363static int
364ng_etf_rcvdata(hook_p hook, item_p item )
365{
366	const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
367	struct ether_header *eh;
368	int error = 0;
369	struct mbuf *m;
370	u_int16_t ethertype;
371	struct filter *fil;
372
373	if (NG_HOOK_PRIVATE(hook) == NULL) { /* Shouldn't happen but.. */
374		NG_FREE_ITEM(item);
375	}
376
377	/*
378	 * Everything not from the downstream hook goes to the
379	 * downstream hook. But only if it matches the ethertype
380	 * of the source hook. Un matching must go to/from 'nomatch'.
381	 */
382
383	/* Make sure we have an entire header */
384	NGI_GET_M(item, m);
385	if (m->m_len < sizeof(*eh) ) {
386		m = m_pullup(m, sizeof(*eh));
387		if (m == NULL) {
388			NG_FREE_ITEM(item);
389			return(EINVAL);
390		}
391	}
392
393	eh = mtod(m, struct ether_header *);
394	ethertype = eh->ether_type;
395	fil = ng_etf_findentry(etfp, ethertype);
396
397	/*
398	 * if from downstream, select between a match hook or
399	 * the nomatch hook
400	 */
401	if (hook == etfp->downstream_hook.hook) {
402		etfp->packets_in++;
403		if (fil && fil->match_hook) {
404			NG_FWD_NEW_DATA(error, item, fil->match_hook, m);
405		} else {
406			NG_FWD_NEW_DATA(error, item,etfp->nomatch_hook.hook, m);
407		}
408	} else {
409		/*
410		 * It must be heading towards the downstream.
411		 * Check that it's ethertype matches
412		 * the filters for it's input hook.
413		 * If it doesn't have one, check it's from nomatch.
414		 */
415		if ((fil && (fil->match_hook != hook))
416		|| ((fil == NULL) && (hook != etfp->nomatch_hook.hook))) {
417			NG_FREE_ITEM(item);
418			NG_FREE_M(m);
419			return (EPROTOTYPE);
420		}
421		NG_FWD_NEW_DATA( error, item, etfp->downstream_hook.hook, m);
422		if (error == 0) {
423			etfp->packets_out++;
424		}
425	}
426	return (error);
427}
428
429/*
430 * Do local shutdown processing..
431 * All our links and the name have already been removed.
432 */
433static int
434ng_etf_shutdown(node_p node)
435{
436	const etf_p privdata = NG_NODE_PRIVATE(node);
437
438	NG_NODE_SET_PRIVATE(node, NULL);
439	NG_NODE_UNREF(privdata->node);
440	free(privdata, M_NETGRAPH_ETF);
441	return (0);
442}
443
444/*
445 * Hook disconnection
446 *
447 * For this type, removal of the last link destroys the node
448 */
449static int
450ng_etf_disconnect(hook_p hook)
451{
452	const etf_p etfp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
453	int i;
454	struct filter *fil1, *fil2;
455
456	/* purge any rules that refer to this filter */
457	for (i = 0; i < HASHSIZE; i++) {
458		fil1 = LIST_FIRST(&etfp->hashtable[i]);
459		while (fil1 != NULL) {
460			fil2 = LIST_NEXT(fil1, next);
461			if (fil1->match_hook == hook) {
462				LIST_REMOVE(fil1, next);
463				free(fil1, M_NETGRAPH_ETF);
464			}
465			fil1 = fil2;
466		}
467	}
468
469	/* If it's not one of the special hooks, then free it */
470	if (hook == etfp->downstream_hook.hook) {
471		etfp->downstream_hook.hook = NULL;
472	} else if (hook == etfp->nomatch_hook.hook) {
473		etfp->nomatch_hook.hook = NULL;
474	} else {
475		if (NG_HOOK_PRIVATE(hook)) /* Paranoia */
476			free(NG_HOOK_PRIVATE(hook), M_NETGRAPH_ETF);
477	}
478
479	NG_HOOK_SET_PRIVATE(hook, NULL);
480
481	if ((NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0)
482	&& (NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))) /* already shutting down? */
483		ng_rmnode_self(NG_HOOK_NODE(hook));
484	return (0);
485}
486