svn commit: r304041 - in head/sys: conf modules/ipfw netpfil/ipfw
Andrey V. Elsukov
ae at FreeBSD.org
Sat Aug 13 15:41:06 UTC 2016
Author: ae
Date: Sat Aug 13 15:41:04 2016
New Revision: 304041
URL: https://svnweb.freebsd.org/changeset/base/304041
Log:
Move logging via BPF support into separate file.
* make interface cloner VNET-aware;
* simplify cloner code and use if_clone_simple();
* migrate LOGIF_LOCK() to rmlock;
* add ipfw_bpf_mtap2() function to pass mbuf to BPF;
* introduce new additional ipfwlog0 pseudo interface. It differs from
ipfw0 by DLT type used in bpfattach. This interface is intended to
used by ipfw modules to dump packets with additional info attached.
Currently pflog format is used. ipfw_bpf_mtap2() function uses second
argument to determine which interface use for dumping. If dlen is equal
to ETHER_HDR_LEN it uses old ipfw0 interface, if dlen is equal to
PFLOG_HDRLEN - ipfwlog0 will be used.
Obtained from: Yandex LLC
Sponsored by: Yandex LLC
Added:
head/sys/netpfil/ipfw/ip_fw_bpf.c (contents, props changed)
Modified:
head/sys/conf/files
head/sys/modules/ipfw/Makefile
head/sys/netpfil/ipfw/ip_fw2.c
head/sys/netpfil/ipfw/ip_fw_log.c
head/sys/netpfil/ipfw/ip_fw_private.h
Modified: head/sys/conf/files
==============================================================================
--- head/sys/conf/files Sat Aug 13 06:26:33 2016 (r304040)
+++ head/sys/conf/files Sat Aug 13 15:41:04 2016 (r304041)
@@ -3872,6 +3872,7 @@ netpfil/ipfw/ip_dummynet.c optional inet
netpfil/ipfw/ip_dn_io.c optional inet dummynet
netpfil/ipfw/ip_dn_glue.c optional inet dummynet
netpfil/ipfw/ip_fw2.c optional inet ipfirewall
+netpfil/ipfw/ip_fw_bpf.c optional inet ipfirewall
netpfil/ipfw/ip_fw_dynamic.c optional inet ipfirewall
netpfil/ipfw/ip_fw_eaction.c optional inet ipfirewall
netpfil/ipfw/ip_fw_log.c optional inet ipfirewall
Modified: head/sys/modules/ipfw/Makefile
==============================================================================
--- head/sys/modules/ipfw/Makefile Sat Aug 13 06:26:33 2016 (r304040)
+++ head/sys/modules/ipfw/Makefile Sat Aug 13 15:41:04 2016 (r304041)
@@ -3,7 +3,7 @@
.PATH: ${.CURDIR}/../../netpfil/ipfw
KMOD= ipfw
-SRCS= ip_fw2.c ip_fw_pfil.c
+SRCS= ip_fw2.c ip_fw_pfil.c ip_fw_bpf.c
SRCS+= ip_fw_dynamic.c ip_fw_log.c ip_fw_eaction.c
SRCS+= ip_fw_sockopt.c ip_fw_table.c ip_fw_table_algo.c ip_fw_iface.c
SRCS+= ip_fw_table_value.c
Modified: head/sys/netpfil/ipfw/ip_fw2.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw2.c Sat Aug 13 06:26:33 2016 (r304040)
+++ head/sys/netpfil/ipfw/ip_fw2.c Sat Aug 13 15:41:04 2016 (r304041)
@@ -2792,6 +2792,7 @@ vnet_ipfw_init(const void *unused)
#ifdef LINEAR_SKIPTO
ipfw_init_skipto_cache(chain);
#endif
+ ipfw_bpf_init(first);
/* First set up some values that are compile time options */
V_ipfw_vnet_ready = 1; /* Open for business */
@@ -2810,7 +2811,6 @@ vnet_ipfw_init(const void *unused)
* is checked on each packet because there are no pfil hooks.
*/
V_ip_fw_ctl_ptr = ipfw_ctl3;
- ipfw_log_bpf(1); /* init */
error = ipfw_attach_hooks(1);
return (error);
}
@@ -2834,8 +2834,6 @@ vnet_ipfw_uninit(const void *unused)
(void)ipfw_attach_hooks(0 /* detach */);
V_ip_fw_ctl_ptr = NULL;
- ipfw_log_bpf(0); /* uninit */
-
last = IS_DEFAULT_VNET(curvnet) ? 1 : 0;
IPFW_UH_WLOCK(chain);
@@ -2865,6 +2863,7 @@ vnet_ipfw_uninit(const void *unused)
ipfw_dyn_uninit(1); /* free the remaining parts */
ipfw_destroy_counters();
ipfw_destroy_obj_rewriter();
+ ipfw_bpf_uninit(last);
return (0);
}
Added: head/sys/netpfil/ipfw/ip_fw_bpf.c
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/sys/netpfil/ipfw/ip_fw_bpf.c Sat Aug 13 15:41:04 2016 (r304041)
@@ -0,0 +1,209 @@
+/*-
+ * Copyright (c) 2016 Yandex LLC
+ * Copyright (c) 2016 Andrey V. Elsukov <ae at FreeBSD.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/mbuf.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/rmlock.h>
+#include <sys/socket.h>
+#include <net/ethernet.h>
+#include <net/if.h>
+#include <net/if_pflog.h>
+#include <net/if_var.h>
+#include <net/if_clone.h>
+#include <net/if_types.h>
+#include <net/vnet.h>
+#include <net/bpf.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_fw.h>
+#include <netinet/ip_var.h>
+#include <netpfil/ipfw/ip_fw_private.h>
+
+static VNET_DEFINE(struct ifnet *, log_if);
+static VNET_DEFINE(struct ifnet *, pflog_if);
+static VNET_DEFINE(struct if_clone *, ipfw_cloner);
+static VNET_DEFINE(struct if_clone *, ipfwlog_cloner);
+#define V_ipfw_cloner VNET(ipfw_cloner)
+#define V_ipfwlog_cloner VNET(ipfwlog_cloner)
+#define V_log_if VNET(log_if)
+#define V_pflog_if VNET(pflog_if)
+
+static struct rmlock log_if_lock;
+#define LOGIF_LOCK_INIT(x) rm_init(&log_if_lock, "ipfw log_if lock")
+#define LOGIF_LOCK_DESTROY(x) rm_destroy(&log_if_lock)
+#define LOGIF_RLOCK_TRACKER struct rm_priotracker _log_tracker
+#define LOGIF_RLOCK(x) rm_rlock(&log_if_lock, &_log_tracker)
+#define LOGIF_RUNLOCK(x) rm_runlock(&log_if_lock, &_log_tracker)
+#define LOGIF_WLOCK(x) rm_wlock(&log_if_lock)
+#define LOGIF_WUNLOCK(x) rm_wunlock(&log_if_lock)
+
+static const char ipfwname[] = "ipfw";
+static const char ipfwlogname[] = "ipfwlog";
+
+static int
+ipfw_bpf_ioctl(struct ifnet *ifp, u_long cmd, caddr_t addr)
+{
+
+ return (EINVAL);
+}
+
+static int
+ipfw_bpf_output(struct ifnet *ifp, struct mbuf *m,
+ const struct sockaddr *dst, struct route *ro)
+{
+
+ if (m != NULL)
+ FREE_PKT(m);
+ return (0);
+}
+
+static void
+ipfw_clone_destroy(struct ifnet *ifp)
+{
+
+ LOGIF_WLOCK();
+ if (ifp->if_hdrlen == ETHER_HDR_LEN)
+ V_log_if = NULL;
+ else
+ V_pflog_if = NULL;
+ LOGIF_WUNLOCK();
+
+ bpfdetach(ifp);
+ if_detach(ifp);
+ if_free(ifp);
+}
+
+static int
+ipfw_clone_create(struct if_clone *ifc, int unit, caddr_t params)
+{
+ struct ifnet *ifp;
+
+ ifp = if_alloc(IFT_PFLOG);
+ if (ifp == NULL)
+ return (ENOSPC);
+ if_initname(ifp, ipfwname, unit);
+ ifp->if_flags = IFF_UP | IFF_SIMPLEX | IFF_MULTICAST;
+ ifp->if_mtu = 65536;
+ ifp->if_ioctl = ipfw_bpf_ioctl;
+ ifp->if_output = ipfw_bpf_output;
+ ifp->if_hdrlen = ETHER_HDR_LEN;
+ if_attach(ifp);
+ bpfattach(ifp, DLT_EN10MB, ETHER_HDR_LEN);
+ LOGIF_WLOCK();
+ if (V_log_if != NULL) {
+ LOGIF_WUNLOCK();
+ bpfdetach(ifp);
+ if_detach(ifp);
+ if_free(ifp);
+ return (EEXIST);
+ }
+ V_log_if = ifp;
+ LOGIF_WUNLOCK();
+ return (0);
+}
+
+static int
+ipfwlog_clone_create(struct if_clone *ifc, int unit, caddr_t params)
+{
+ struct ifnet *ifp;
+
+ ifp = if_alloc(IFT_PFLOG);
+ if (ifp == NULL)
+ return (ENOSPC);
+ if_initname(ifp, ipfwlogname, unit);
+ ifp->if_flags = IFF_UP | IFF_SIMPLEX | IFF_MULTICAST;
+ ifp->if_mtu = 65536;
+ ifp->if_ioctl = ipfw_bpf_ioctl;
+ ifp->if_output = ipfw_bpf_output;
+ ifp->if_hdrlen = PFLOG_HDRLEN;
+ if_attach(ifp);
+ bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN);
+ LOGIF_WLOCK();
+ if (V_pflog_if != NULL) {
+ LOGIF_WUNLOCK();
+ bpfdetach(ifp);
+ if_detach(ifp);
+ if_free(ifp);
+ return (EEXIST);
+ }
+ V_pflog_if = ifp;
+ LOGIF_WUNLOCK();
+ return (0);
+}
+
+void
+ipfw_bpf_mtap2(void *data, u_int dlen, struct mbuf *m)
+{
+ LOGIF_RLOCK_TRACKER;
+
+ LOGIF_RLOCK();
+ if (dlen == ETHER_HDR_LEN) {
+ if (V_log_if == NULL) {
+ LOGIF_RUNLOCK();
+ return;
+ }
+ BPF_MTAP2(V_log_if, data, dlen, m);
+ } else if (dlen == PFLOG_HDRLEN) {
+ if (V_pflog_if == NULL) {
+ LOGIF_RUNLOCK();
+ return;
+ }
+ BPF_MTAP2(V_pflog_if, data, dlen, m);
+ }
+ LOGIF_RUNLOCK();
+}
+
+void
+ipfw_bpf_init(int first)
+{
+
+ if (first) {
+ LOGIF_LOCK_INIT();
+ V_log_if = NULL;
+ V_pflog_if = NULL;
+ }
+ V_ipfw_cloner = if_clone_simple(ipfwname, ipfw_clone_create,
+ ipfw_clone_destroy, 0);
+ V_ipfwlog_cloner = if_clone_simple(ipfwlogname, ipfwlog_clone_create,
+ ipfw_clone_destroy, 0);
+}
+
+void
+ipfw_bpf_uninit(int last)
+{
+
+ if_clone_detach(V_ipfw_cloner);
+ if_clone_detach(V_ipfwlog_cloner);
+ if (last)
+ LOGIF_LOCK_DESTROY();
+}
+
Modified: head/sys/netpfil/ipfw/ip_fw_log.c
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_log.c Sat Aug 13 06:26:33 2016 (r304040)
+++ head/sys/netpfil/ipfw/ip_fw_log.c Sat Aug 13 15:41:04 2016 (r304041)
@@ -40,20 +40,14 @@ __FBSDID("$FreeBSD$");
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
-#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/socket.h>
#include <sys/sysctl.h>
#include <sys/syslog.h>
-#include <sys/lock.h>
-#include <sys/rwlock.h>
#include <net/ethernet.h> /* for ETHERTYPE_IP */
#include <net/if.h>
#include <net/if_var.h>
-#include <net/if_clone.h>
#include <net/vnet.h>
-#include <net/if_types.h> /* for IFT_PFLOG */
-#include <net/bpf.h> /* for BPF */
#include <netinet/in.h>
#include <netinet/ip.h>
@@ -96,155 +90,6 @@ __FBSDID("$FreeBSD$");
#define SNP(buf) buf, sizeof(buf)
#endif /* !__APPLE__ */
-#ifdef WITHOUT_BPF
-void
-ipfw_log_bpf(int onoff)
-{
-}
-#else /* !WITHOUT_BPF */
-static VNET_DEFINE(struct ifnet *, log_if); /* hook to attach to bpf */
-#define V_log_if VNET(log_if)
-static struct rwlock log_if_lock;
-#define LOGIF_LOCK_INIT(x) rw_init(&log_if_lock, "ipfw log_if lock")
-#define LOGIF_LOCK_DESTROY(x) rw_destroy(&log_if_lock)
-#define LOGIF_RLOCK(x) rw_rlock(&log_if_lock)
-#define LOGIF_RUNLOCK(x) rw_runlock(&log_if_lock)
-#define LOGIF_WLOCK(x) rw_wlock(&log_if_lock)
-#define LOGIF_WUNLOCK(x) rw_wunlock(&log_if_lock)
-
-static const char ipfwname[] = "ipfw";
-
-/* we use this dummy function for all ifnet callbacks */
-static int
-log_dummy(struct ifnet *ifp, u_long cmd, caddr_t addr)
-{
- return EINVAL;
-}
-
-static int
-ipfw_log_output(struct ifnet *ifp, struct mbuf *m,
- const struct sockaddr *dst, struct route *ro)
-{
- if (m != NULL)
- FREE_PKT(m);
- return EINVAL;
-}
-
-static void
-ipfw_log_start(struct ifnet* ifp)
-{
- panic("ipfw_log_start() must not be called");
-}
-
-static const u_char ipfwbroadcastaddr[6] =
- { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-
-static int
-ipfw_log_clone_match(struct if_clone *ifc, const char *name)
-{
-
- return (strncmp(name, ipfwname, sizeof(ipfwname) - 1) == 0);
-}
-
-static int
-ipfw_log_clone_create(struct if_clone *ifc, char *name, size_t len,
- caddr_t params)
-{
- int error;
- int unit;
- struct ifnet *ifp;
-
- error = ifc_name2unit(name, &unit);
- if (error)
- return (error);
-
- error = ifc_alloc_unit(ifc, &unit);
- if (error)
- return (error);
-
- ifp = if_alloc(IFT_PFLOG);
- if (ifp == NULL) {
- ifc_free_unit(ifc, unit);
- return (ENOSPC);
- }
- ifp->if_dname = ipfwname;
- ifp->if_dunit = unit;
- snprintf(ifp->if_xname, IFNAMSIZ, "%s%d", ipfwname, unit);
- strlcpy(name, ifp->if_xname, len);
- ifp->if_mtu = 65536;
- ifp->if_flags = IFF_UP | IFF_SIMPLEX | IFF_MULTICAST;
- ifp->if_init = (void *)log_dummy;
- ifp->if_ioctl = log_dummy;
- ifp->if_start = ipfw_log_start;
- ifp->if_output = ipfw_log_output;
- ifp->if_addrlen = 6;
- ifp->if_hdrlen = 14;
- ifp->if_broadcastaddr = ipfwbroadcastaddr;
- ifp->if_baudrate = IF_Mbps(10);
-
- LOGIF_WLOCK();
- if (V_log_if == NULL)
- V_log_if = ifp;
- else {
- LOGIF_WUNLOCK();
- if_free(ifp);
- ifc_free_unit(ifc, unit);
- return (EEXIST);
- }
- LOGIF_WUNLOCK();
- if_attach(ifp);
- bpfattach(ifp, DLT_EN10MB, 14);
-
- return (0);
-}
-
-static int
-ipfw_log_clone_destroy(struct if_clone *ifc, struct ifnet *ifp)
-{
- int unit;
-
- if (ifp == NULL)
- return (0);
-
- LOGIF_WLOCK();
- if (V_log_if != NULL && ifp == V_log_if)
- V_log_if = NULL;
- else {
- LOGIF_WUNLOCK();
- return (EINVAL);
- }
- LOGIF_WUNLOCK();
-
- unit = ifp->if_dunit;
- bpfdetach(ifp);
- if_detach(ifp);
- if_free(ifp);
- ifc_free_unit(ifc, unit);
-
- return (0);
-}
-
-static VNET_DEFINE(struct if_clone *, ipfw_log_cloner);
-#define V_ipfw_log_cloner VNET(ipfw_log_cloner)
-
-void
-ipfw_log_bpf(int onoff)
-{
-
- if (onoff) {
- if (IS_DEFAULT_VNET(curvnet))
- LOGIF_LOCK_INIT();
- V_ipfw_log_cloner = if_clone_advanced(ipfwname, 0,
- ipfw_log_clone_match, ipfw_log_clone_create,
- ipfw_log_clone_destroy);
- } else {
- if_clone_detach(V_ipfw_log_cloner);
- if (IS_DEFAULT_VNET(curvnet))
- LOGIF_LOCK_DESTROY();
- }
-}
-#endif /* !WITHOUT_BPF */
-
#define TARG(k, f) IP_FW_ARG_TABLEARG(chain, k, f)
/*
* We enter here when we have a rule with O_LOG.
@@ -260,29 +105,23 @@ ipfw_log(struct ip_fw_chain *chain, stru
char action2[92], proto[128], fragment[32];
if (V_fw_verbose == 0) {
-#ifndef WITHOUT_BPF
- LOGIF_RLOCK();
- if (V_log_if == NULL || V_log_if->if_bpf == NULL) {
- LOGIF_RUNLOCK();
- return;
- }
-
if (args->eh) /* layer2, use orig hdr */
- BPF_MTAP2(V_log_if, args->eh, ETHER_HDR_LEN, m);
+ ipfw_bpf_mtap2(args->eh, ETHER_HDR_LEN, m);
else {
/* Add fake header. Later we will store
* more info in the header.
*/
if (ip->ip_v == 4)
- BPF_MTAP2(V_log_if, "DDDDDDSSSSSS\x08\x00", ETHER_HDR_LEN, m);
- else if (ip->ip_v == 6)
- BPF_MTAP2(V_log_if, "DDDDDDSSSSSS\x86\xdd", ETHER_HDR_LEN, m);
+ ipfw_bpf_mtap2("DDDDDDSSSSSS\x08\x00",
+ ETHER_HDR_LEN, m);
+ else if (ip->ip_v == 6)
+ ipfw_bpf_mtap2("DDDDDDSSSSSS\x86\xdd",
+ ETHER_HDR_LEN, m);
else
/* Obviously bogus EtherType. */
- BPF_MTAP2(V_log_if, "DDDDDDSSSSSS\xff\xff", ETHER_HDR_LEN, m);
+ ipfw_bpf_mtap2("DDDDDDSSSSSS\xff\xff",
+ ETHER_HDR_LEN, m);
}
- LOGIF_RUNLOCK();
-#endif /* !WITHOUT_BPF */
return;
}
/* the old 'log' function */
Modified: head/sys/netpfil/ipfw/ip_fw_private.h
==============================================================================
--- head/sys/netpfil/ipfw/ip_fw_private.h Sat Aug 13 06:26:33 2016 (r304040)
+++ head/sys/netpfil/ipfw/ip_fw_private.h Sat Aug 13 15:41:04 2016 (r304041)
@@ -154,7 +154,9 @@ void ipfw_nat_destroy(void);
/* In ip_fw_log.c */
struct ip;
struct ip_fw_chain;
-void ipfw_log_bpf(int);
+void ipfw_bpf_init(int);
+void ipfw_bpf_uninit(int);
+void ipfw_bpf_mtap2(void *, u_int, struct mbuf *);
void ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
struct ip_fw_args *args, struct mbuf *m, struct ifnet *oif,
u_short offset, uint32_t tablearg, struct ip *ip);
More information about the svn-src-all
mailing list