File Manager

003 File Manager

Current Path: /usr/src/sys/net

📁 ..
📁 altq
📄 bpf.c(69.94 KB)
📄 bpf.h(14.6 KB)
📄 bpf_buffer.c(6.39 KB)
📄 bpf_buffer.h(2.04 KB)
📄 bpf_filter.c(12.09 KB)
📄 bpf_jitter.c(3.43 KB)
📄 bpf_jitter.h(3.3 KB)
📄 bpf_zerocopy.c(16.12 KB)
📄 bpf_zerocopy.h(2.36 KB)
📄 bpfdesc.h(6.04 KB)
📄 bridgestp.c(55.53 KB)
📄 bridgestp.h(13.06 KB)
📄 debugnet.c(26.35 KB)
📄 debugnet.h(8.54 KB)
📄 debugnet_inet.c(12.67 KB)
📄 debugnet_int.h(3.11 KB)
📄 dlt.h(44.23 KB)
📄 ethernet.h(22.17 KB)
📄 firewire.h(3.95 KB)
📄 ieee8023ad_lacp.c(53.91 KB)
📄 ieee8023ad_lacp.h(9.22 KB)
📄 ieee_oui.h(3.64 KB)
📄 if.c(105.86 KB)
📄 if.h(22.3 KB)
📄 if_arp.h(5.41 KB)
📄 if_bridge.c(89.97 KB)
📄 if_bridgevar.h(11.54 KB)
📄 if_clone.c(17.42 KB)
📄 if_clone.h(3.38 KB)
📄 if_dead.c(3.83 KB)
📄 if_debug.c(4.02 KB)
📄 if_disc.c(5.95 KB)
📄 if_dl.h(3.56 KB)
📄 if_edsc.c(9.93 KB)
📄 if_enc.c(12.02 KB)
📄 if_enc.h(1.65 KB)
📄 if_epair.c(27.75 KB)
📄 if_ethersubr.c(37.23 KB)
📄 if_fwsubr.c(19.22 KB)
📄 if_gif.c(16.66 KB)
📄 if_gif.h(4.16 KB)
📄 if_gre.c(18.8 KB)
📄 if_gre.h(5.69 KB)
📄 if_infiniband.c(14.99 KB)
📄 if_ipsec.c(24.98 KB)
📄 if_ipsec.h(1.62 KB)
📄 if_lagg.c(62.68 KB)
📄 if_lagg.h(8.94 KB)
📄 if_llatbl.c(20.5 KB)
📄 if_llatbl.h(9.52 KB)
📄 if_llc.h(4.53 KB)
📄 if_loop.c(10.62 KB)
📄 if_me.c(16.73 KB)
📄 if_media.c(12.81 KB)
📄 if_media.h(36.45 KB)
📄 if_mib.c(4.6 KB)
📄 if_mib.h(5.58 KB)
📄 if_pflog.h(2.24 KB)
📄 if_pfsync.h(6.85 KB)
📄 if_sppp.h(8.37 KB)
📄 if_spppfr.c(15.11 KB)
📄 if_spppsubr.c(132.44 KB)
📄 if_stf.c(19.3 KB)
📄 if_tap.h(2.54 KB)
📄 if_tun.h(1.43 KB)
📄 if_tuntap.c(47.67 KB)
📄 if_types.h(12.2 KB)
📄 if_var.h(29.92 KB)
📄 if_vlan.c(53.04 KB)
📄 if_vlan_var.h(6.1 KB)
📄 if_vxlan.c(88.14 KB)
📄 if_vxlan.h(4.71 KB)
📄 ifdi_if.m(8.4 KB)
📄 iflib.c(185.91 KB)
📄 iflib.h(14.41 KB)
📄 iflib_clone.c(7.37 KB)
📄 iflib_private.h(2.31 KB)
📄 ifq.h(12.2 KB)
📄 infiniband.h(2.64 KB)
📄 mp_ring.c(13.3 KB)
📄 mp_ring.h(2.77 KB)
📄 mppc.h(2.37 KB)
📄 mppcc.c(8.88 KB)
📄 mppcd.c(7.89 KB)
📄 netisr.c(44.33 KB)
📄 netisr.h(9.31 KB)
📄 netisr_internal.h(4.77 KB)
📄 netmap.h(32.93 KB)
📄 netmap_legacy.h(9.49 KB)
📄 netmap_user.h(30.33 KB)
📄 netmap_virt.h(3.89 KB)
📄 paravirt.h(6.91 KB)
📄 pfil.c(16.83 KB)
📄 pfil.h(5.86 KB)
📄 pfkeyv2.h(14.54 KB)
📄 pfvar.h(48.83 KB)
📄 ppp_defs.h(5.41 KB)
📄 radix.c(30.87 KB)
📄 radix.h(6.83 KB)
📄 raw_cb.c(3.77 KB)
📄 raw_cb.h(3.04 KB)
📄 raw_usrreq.c(6.26 KB)
📄 rndis.h(10.74 KB)
📁 route
📄 route.c(19.25 KB)
📄 route.h(16.54 KB)
📄 rss_config.c(14.12 KB)
📄 rss_config.h(4.69 KB)
📄 rtsock.c(62.94 KB)
📄 sff8436.h(8.3 KB)
📄 sff8472.h(18.95 KB)
📄 slcompress.c(16.25 KB)
📄 slcompress.h(6.4 KB)
📄 toeplitz.c(1.96 KB)
📄 toeplitz.h(1.72 KB)
📄 vnet.c(22.42 KB)
📄 vnet.h(14.62 KB)

Editing: if_enc.c

/*-
 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
 *
 * Copyright (c) 2006 The FreeBSD Project.
 * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD$
 */

#include "opt_inet.h"
#include "opt_inet6.h"
#include "opt_ipsec.h"

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/hhook.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/module.h>
#include <machine/bus.h>
#include <sys/rman.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <sys/sysctl.h>

#include <net/if.h>
#include <net/if_enc.h>
#include <net/if_var.h>
#include <net/if_clone.h>
#include <net/if_types.h>
#include <net/pfil.h>
#include <net/route.h>
#include <net/netisr.h>
#include <net/bpf.h>
#include <net/vnet.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/in_var.h>

#ifdef INET6
#include <netinet/ip6.h>
#include <netinet6/ip6_var.h>
#endif

#include <netipsec/ipsec.h>
#include <netipsec/xform.h>

#define ENCMTU		(1024+512)

/* XXX this define must have the same value as in OpenBSD */
#define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
#define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
#define M_AUTH_AH	0x2000	/* header was authenticated (AH) */

struct enchdr {
	u_int32_t af;
	u_int32_t spi;
	u_int32_t flags;
};
struct enc_softc {
	struct	ifnet *sc_ifp;
};
VNET_DEFINE_STATIC(struct enc_softc *, enc_sc);
#define	V_enc_sc	VNET(enc_sc)
VNET_DEFINE_STATIC(struct if_clone *, enc_cloner);
#define	V_enc_cloner	VNET(enc_cloner)

static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
static int	enc_output(struct ifnet *, struct mbuf *,
    const struct sockaddr *, struct route *);
static int	enc_clone_create(struct if_clone *, int, caddr_t);
static void	enc_clone_destroy(struct ifnet *);
static int	enc_add_hhooks(struct enc_softc *);
static void	enc_remove_hhooks(struct enc_softc *);

static const char encname[] = "enc";

#define	IPSEC_ENC_AFTER_PFIL	0x04
/*
 * Before and after are relative to when we are stripping the
 * outer IP header.
 *
 * AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
 * after PFIL hook execution. It might be useful when PFIL hook does
 * some changes to the packet, e.g. address translation. If PFIL hook
 * consumes mbuf, nothing will be captured.
 */
VNET_DEFINE_STATIC(int, filter_mask_in) = IPSEC_ENC_BEFORE;
VNET_DEFINE_STATIC(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
VNET_DEFINE_STATIC(int, filter_mask_out) = IPSEC_ENC_BEFORE;
VNET_DEFINE_STATIC(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
#define	V_filter_mask_in	VNET(filter_mask_in)
#define	V_bpf_mask_in		VNET(bpf_mask_in)
#define	V_filter_mask_out	VNET(filter_mask_out)
#define	V_bpf_mask_out		VNET(bpf_mask_out)

static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
    "enc sysctl");
static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
    "enc input sysctl");
static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
    "enc output sysctl");
SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
    "IPsec input firewall filter mask");
SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
    "IPsec input bpf mask");
SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
    "IPsec output firewall filter mask");
SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
    "IPsec output bpf mask");

static void
enc_clone_destroy(struct ifnet *ifp)
{
	struct enc_softc *sc;

sc = ifp->if_softc;
	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));

bpfdetach(ifp);
	if_detach(ifp);
	if_free(ifp);
	free(sc, M_DEVBUF);
	V_enc_sc = NULL;
}

static int
enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
{
	struct ifnet *ifp;
	struct enc_softc *sc;

sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
	    M_WAITOK | M_ZERO);
	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
	if (ifp == NULL) {
		free(sc, M_DEVBUF);
		return (ENOSPC);
	}
	if (V_enc_sc != NULL) {
		if_free(ifp);
		free(sc, M_DEVBUF);
		return (EEXIST);
	}
	V_enc_sc = sc;
	if_initname(ifp, encname, unit);
	ifp->if_mtu = ENCMTU;
	ifp->if_ioctl = enc_ioctl;
	ifp->if_output = enc_output;
	ifp->if_softc = sc;
	if_attach(ifp);
	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
	return (0);
}

static int
enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
    struct route *ro)
{

m_freem(m);
	return (0);
}

static int
enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
{

if (cmd != SIOCSIFFLAGS)
		return (EINVAL);
	if (ifp->if_flags & IFF_UP)
		ifp->if_drv_flags |= IFF_DRV_RUNNING;
	else
		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
	return (0);
}

static void
enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
    int32_t hhook_type, uint8_t enc, uint8_t af)
{
	struct enchdr hdr;

if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
	    (enc & V_bpf_mask_in) == 0)
		return;
	else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
	    (enc & V_bpf_mask_out) == 0)
		return;
	if (bpf_peers_present(ifp->if_bpf) == 0)
		return;
	hdr.af = af;
	hdr.spi = sav->spi;
	hdr.flags = 0;
	if (sav->alg_enc != SADB_EALG_NONE)
		hdr.flags |= M_CONF;
	if (sav->alg_auth != SADB_AALG_NONE)
		hdr.flags |= M_AUTH;
	bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
}

/*
 * One helper hook function is used by any hook points.
 * + from hhook_type we can determine the packet direction:
 *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
 * + from hhook_id we can determine address family: AF_INET or AF_INET6;
 * + udata contains pointer to enc_softc;
 * + ctx_data contains pointer to struct ipsec_ctx_data.
 */
static int
enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
    void *hdata, struct osd *hosd)
{
	struct ipsec_ctx_data *ctx;
	struct enc_softc *sc;
	struct ifnet *ifp, *rcvif;
	struct pfil_head *ph;
	int pdir;

sc = (struct enc_softc *)udata;
	ifp = sc->sc_ifp;
	if ((ifp->if_flags & IFF_UP) == 0)
		return (0);

ctx = (struct ipsec_ctx_data *)ctx_data;
	/* XXX: wrong hook point was used by caller? */
	if (ctx->af != hhook_id)
		return (EPFNOSUPPORT);

enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
	switch (hhook_type) {
	case HHOOK_TYPE_IPSEC_IN:
		if (ctx->enc == IPSEC_ENC_BEFORE) {
			/* Do accounting only once */
			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
			if_inc_counter(ifp, IFCOUNTER_IBYTES,
			    (*ctx->mp)->m_pkthdr.len);
		}
		if ((ctx->enc & V_filter_mask_in) == 0)
			return (0); /* skip pfil processing */
		pdir = PFIL_IN;
		break;
	case HHOOK_TYPE_IPSEC_OUT:
		if (ctx->enc == IPSEC_ENC_BEFORE) {
			/* Do accounting only once */
			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
			if_inc_counter(ifp, IFCOUNTER_OBYTES,
			    (*ctx->mp)->m_pkthdr.len);
		}
		if ((ctx->enc & V_filter_mask_out) == 0)
			return (0); /* skip pfil processing */
		pdir = PFIL_OUT;
		break;
	default:
		return (EINVAL);
	}

switch (hhook_id) {
#ifdef INET
	case AF_INET:
		ph = V_inet_pfil_head;
		break;
#endif
#ifdef INET6
	case AF_INET6:
		ph = V_inet6_pfil_head;
		break;
#endif
	default:
		ph = NULL;
	}
	if (ph == NULL || (pdir == PFIL_OUT && !PFIL_HOOKED_OUT(ph)) ||
	    (pdir == PFIL_IN && !PFIL_HOOKED_IN(ph)))
		return (0);
	/* Make a packet looks like it was received on enc(4) */
	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
	(*ctx->mp)->m_pkthdr.rcvif = ifp;
	if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, ctx->inp) != PFIL_PASS) {
		*ctx->mp = NULL; /* consumed by filter */
		return (EACCES);
	}
	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
	enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
	    IPSEC_ENC_AFTER_PFIL, ctx->af);
	return (0);
}

static int
enc_add_hhooks(struct enc_softc *sc)
{
	struct hookinfo hki;
	int error;

error = EPFNOSUPPORT;
	hki.hook_func = enc_hhook;
	hki.hook_helper = NULL;
	hki.hook_udata = sc;
#ifdef INET
	hki.hook_id = AF_INET;
	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
	    &hki, HHOOK_WAITOK);
	if (error != 0)
		return (error);
	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
	    &hki, HHOOK_WAITOK);
	if (error != 0)
		return (error);
#endif
#ifdef INET6
	hki.hook_id = AF_INET6;
	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
	    &hki, HHOOK_WAITOK);
	if (error != 0)
		return (error);
	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
	    &hki, HHOOK_WAITOK);
	if (error != 0)
		return (error);
#endif
	return (error);
}

static void
enc_remove_hhooks(struct enc_softc *sc)
{
	struct hookinfo hki;

hki.hook_func = enc_hhook;
	hki.hook_helper = NULL;
	hki.hook_udata = sc;
#ifdef INET
	hki.hook_id = AF_INET;
	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
#endif
#ifdef INET6
	hki.hook_id = AF_INET6;
	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
#endif
}

static void
vnet_enc_init(const void *unused __unused)
{

V_enc_sc = NULL;
	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
	    enc_clone_destroy, 1);
}
VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
    vnet_enc_init, NULL);

static void
vnet_enc_init_proto(void *unused __unused)
{
	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));

if (enc_add_hhooks(V_enc_sc) != 0)
		enc_clone_destroy(V_enc_sc->sc_ifp);
}
VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
    vnet_enc_init_proto, NULL);

static void
vnet_enc_uninit(const void *unused __unused)
{
	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));

if_clone_detach(V_enc_cloner);
}
VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
    vnet_enc_uninit, NULL);

/*
 * The hhook consumer needs to go before ip[6]_destroy are called on
 * SI_ORDER_THIRD.
 */
static void
vnet_enc_uninit_hhook(const void *unused __unused)
{
	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));

enc_remove_hhooks(V_enc_sc);
}
VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
    vnet_enc_uninit_hhook, NULL);

static int
enc_modevent(module_t mod, int type, void *data)
{

switch (type) {
	case MOD_LOAD:
	case MOD_UNLOAD:
		break;
	default:
		return (EOPNOTSUPP);
	}
	return (0);
}

static moduledata_t enc_mod = {
	"if_enc",
	enc_modevent,
	0
};

DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
MODULE_VERSION(if_enc, 1);

003 File Manager

Editing: if_enc.c

Upload File

Create Folder