From owner-svn-src-all@freebsd.org Sat Aug 13 15:41:06 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 03EDFBABE64; Sat, 13 Aug 2016 15:41:06 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C7D5C1F0D; Sat, 13 Aug 2016 15:41:05 +0000 (UTC) (envelope-from ae@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u7DFf5kD036160; Sat, 13 Aug 2016 15:41:05 GMT (envelope-from ae@FreeBSD.org) Received: (from ae@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u7DFf4wU036154; Sat, 13 Aug 2016 15:41:04 GMT (envelope-from ae@FreeBSD.org) Message-Id: <201608131541.u7DFf4wU036154@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: ae set sender to ae@FreeBSD.org using -f From: "Andrey V. Elsukov" Date: Sat, 13 Aug 2016 15:41:04 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r304041 - in head/sys: conf modules/ipfw netpfil/ipfw X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Aug 2016 15:41:06 -0000 Author: ae Date: Sat Aug 13 15:41:04 2016 New Revision: 304041 URL: https://svnweb.freebsd.org/changeset/base/304041 Log: Move logging via BPF support into separate file. * make interface cloner VNET-aware; * simplify cloner code and use if_clone_simple(); * migrate LOGIF_LOCK() to rmlock; * add ipfw_bpf_mtap2() function to pass mbuf to BPF; * introduce new additional ipfwlog0 pseudo interface. It differs from ipfw0 by DLT type used in bpfattach. This interface is intended to used by ipfw modules to dump packets with additional info attached. Currently pflog format is used. ipfw_bpf_mtap2() function uses second argument to determine which interface use for dumping. If dlen is equal to ETHER_HDR_LEN it uses old ipfw0 interface, if dlen is equal to PFLOG_HDRLEN - ipfwlog0 will be used. Obtained from: Yandex LLC Sponsored by: Yandex LLC Added: head/sys/netpfil/ipfw/ip_fw_bpf.c (contents, props changed) Modified: head/sys/conf/files head/sys/modules/ipfw/Makefile head/sys/netpfil/ipfw/ip_fw2.c head/sys/netpfil/ipfw/ip_fw_log.c head/sys/netpfil/ipfw/ip_fw_private.h Modified: head/sys/conf/files ============================================================================== --- head/sys/conf/files Sat Aug 13 06:26:33 2016 (r304040) +++ head/sys/conf/files Sat Aug 13 15:41:04 2016 (r304041) @@ -3872,6 +3872,7 @@ netpfil/ipfw/ip_dummynet.c optional inet netpfil/ipfw/ip_dn_io.c optional inet dummynet netpfil/ipfw/ip_dn_glue.c optional inet dummynet netpfil/ipfw/ip_fw2.c optional inet ipfirewall +netpfil/ipfw/ip_fw_bpf.c optional inet ipfirewall netpfil/ipfw/ip_fw_dynamic.c optional inet ipfirewall netpfil/ipfw/ip_fw_eaction.c optional inet ipfirewall netpfil/ipfw/ip_fw_log.c optional inet ipfirewall Modified: head/sys/modules/ipfw/Makefile ============================================================================== --- head/sys/modules/ipfw/Makefile Sat Aug 13 06:26:33 2016 (r304040) +++ head/sys/modules/ipfw/Makefile Sat Aug 13 15:41:04 2016 (r304041) @@ -3,7 +3,7 @@ .PATH: ${.CURDIR}/../../netpfil/ipfw KMOD= ipfw -SRCS= ip_fw2.c ip_fw_pfil.c +SRCS= ip_fw2.c ip_fw_pfil.c ip_fw_bpf.c SRCS+= ip_fw_dynamic.c ip_fw_log.c ip_fw_eaction.c SRCS+= ip_fw_sockopt.c ip_fw_table.c ip_fw_table_algo.c ip_fw_iface.c SRCS+= ip_fw_table_value.c Modified: head/sys/netpfil/ipfw/ip_fw2.c ============================================================================== --- head/sys/netpfil/ipfw/ip_fw2.c Sat Aug 13 06:26:33 2016 (r304040) +++ head/sys/netpfil/ipfw/ip_fw2.c Sat Aug 13 15:41:04 2016 (r304041) @@ -2792,6 +2792,7 @@ vnet_ipfw_init(const void *unused) #ifdef LINEAR_SKIPTO ipfw_init_skipto_cache(chain); #endif + ipfw_bpf_init(first); /* First set up some values that are compile time options */ V_ipfw_vnet_ready = 1; /* Open for business */ @@ -2810,7 +2811,6 @@ vnet_ipfw_init(const void *unused) * is checked on each packet because there are no pfil hooks. */ V_ip_fw_ctl_ptr = ipfw_ctl3; - ipfw_log_bpf(1); /* init */ error = ipfw_attach_hooks(1); return (error); } @@ -2834,8 +2834,6 @@ vnet_ipfw_uninit(const void *unused) (void)ipfw_attach_hooks(0 /* detach */); V_ip_fw_ctl_ptr = NULL; - ipfw_log_bpf(0); /* uninit */ - last = IS_DEFAULT_VNET(curvnet) ? 1 : 0; IPFW_UH_WLOCK(chain); @@ -2865,6 +2863,7 @@ vnet_ipfw_uninit(const void *unused) ipfw_dyn_uninit(1); /* free the remaining parts */ ipfw_destroy_counters(); ipfw_destroy_obj_rewriter(); + ipfw_bpf_uninit(last); return (0); } Added: head/sys/netpfil/ipfw/ip_fw_bpf.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/sys/netpfil/ipfw/ip_fw_bpf.c Sat Aug 13 15:41:04 2016 (r304041) @@ -0,0 +1,209 @@ +/*- + * Copyright (c) 2016 Yandex LLC + * Copyright (c) 2016 Andrey V. Elsukov + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +__FBSDID("$FreeBSD$"); + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include + +static VNET_DEFINE(struct ifnet *, log_if); +static VNET_DEFINE(struct ifnet *, pflog_if); +static VNET_DEFINE(struct if_clone *, ipfw_cloner); +static VNET_DEFINE(struct if_clone *, ipfwlog_cloner); +#define V_ipfw_cloner VNET(ipfw_cloner) +#define V_ipfwlog_cloner VNET(ipfwlog_cloner) +#define V_log_if VNET(log_if) +#define V_pflog_if VNET(pflog_if) + +static struct rmlock log_if_lock; +#define LOGIF_LOCK_INIT(x) rm_init(&log_if_lock, "ipfw log_if lock") +#define LOGIF_LOCK_DESTROY(x) rm_destroy(&log_if_lock) +#define LOGIF_RLOCK_TRACKER struct rm_priotracker _log_tracker +#define LOGIF_RLOCK(x) rm_rlock(&log_if_lock, &_log_tracker) +#define LOGIF_RUNLOCK(x) rm_runlock(&log_if_lock, &_log_tracker) +#define LOGIF_WLOCK(x) rm_wlock(&log_if_lock) +#define LOGIF_WUNLOCK(x) rm_wunlock(&log_if_lock) + +static const char ipfwname[] = "ipfw"; +static const char ipfwlogname[] = "ipfwlog"; + +static int +ipfw_bpf_ioctl(struct ifnet *ifp, u_long cmd, caddr_t addr) +{ + + return (EINVAL); +} + +static int +ipfw_bpf_output(struct ifnet *ifp, struct mbuf *m, + const struct sockaddr *dst, struct route *ro) +{ + + if (m != NULL) + FREE_PKT(m); + return (0); +} + +static void +ipfw_clone_destroy(struct ifnet *ifp) +{ + + LOGIF_WLOCK(); + if (ifp->if_hdrlen == ETHER_HDR_LEN) + V_log_if = NULL; + else + V_pflog_if = NULL; + LOGIF_WUNLOCK(); + + bpfdetach(ifp); + if_detach(ifp); + if_free(ifp); +} + +static int +ipfw_clone_create(struct if_clone *ifc, int unit, caddr_t params) +{ + struct ifnet *ifp; + + ifp = if_alloc(IFT_PFLOG); + if (ifp == NULL) + return (ENOSPC); + if_initname(ifp, ipfwname, unit); + ifp->if_flags = IFF_UP | IFF_SIMPLEX | IFF_MULTICAST; + ifp->if_mtu = 65536; + ifp->if_ioctl = ipfw_bpf_ioctl; + ifp->if_output = ipfw_bpf_output; + ifp->if_hdrlen = ETHER_HDR_LEN; + if_attach(ifp); + bpfattach(ifp, DLT_EN10MB, ETHER_HDR_LEN); + LOGIF_WLOCK(); + if (V_log_if != NULL) { + LOGIF_WUNLOCK(); + bpfdetach(ifp); + if_detach(ifp); + if_free(ifp); + return (EEXIST); + } + V_log_if = ifp; + LOGIF_WUNLOCK(); + return (0); +} + +static int +ipfwlog_clone_create(struct if_clone *ifc, int unit, caddr_t params) +{ + struct ifnet *ifp; + + ifp = if_alloc(IFT_PFLOG); + if (ifp == NULL) + return (ENOSPC); + if_initname(ifp, ipfwlogname, unit); + ifp->if_flags = IFF_UP | IFF_SIMPLEX | IFF_MULTICAST; + ifp->if_mtu = 65536; + ifp->if_ioctl = ipfw_bpf_ioctl; + ifp->if_output = ipfw_bpf_output; + ifp->if_hdrlen = PFLOG_HDRLEN; + if_attach(ifp); + bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN); + LOGIF_WLOCK(); + if (V_pflog_if != NULL) { + LOGIF_WUNLOCK(); + bpfdetach(ifp); + if_detach(ifp); + if_free(ifp); + return (EEXIST); + } + V_pflog_if = ifp; + LOGIF_WUNLOCK(); + return (0); +} + +void +ipfw_bpf_mtap2(void *data, u_int dlen, struct mbuf *m) +{ + LOGIF_RLOCK_TRACKER; + + LOGIF_RLOCK(); + if (dlen == ETHER_HDR_LEN) { + if (V_log_if == NULL) { + LOGIF_RUNLOCK(); + return; + } + BPF_MTAP2(V_log_if, data, dlen, m); + } else if (dlen == PFLOG_HDRLEN) { + if (V_pflog_if == NULL) { + LOGIF_RUNLOCK(); + return; + } + BPF_MTAP2(V_pflog_if, data, dlen, m); + } + LOGIF_RUNLOCK(); +} + +void +ipfw_bpf_init(int first) +{ + + if (first) { + LOGIF_LOCK_INIT(); + V_log_if = NULL; + V_pflog_if = NULL; + } + V_ipfw_cloner = if_clone_simple(ipfwname, ipfw_clone_create, + ipfw_clone_destroy, 0); + V_ipfwlog_cloner = if_clone_simple(ipfwlogname, ipfwlog_clone_create, + ipfw_clone_destroy, 0); +} + +void +ipfw_bpf_uninit(int last) +{ + + if_clone_detach(V_ipfw_cloner); + if_clone_detach(V_ipfwlog_cloner); + if (last) + LOGIF_LOCK_DESTROY(); +} + Modified: head/sys/netpfil/ipfw/ip_fw_log.c ============================================================================== --- head/sys/netpfil/ipfw/ip_fw_log.c Sat Aug 13 06:26:33 2016 (r304040) +++ head/sys/netpfil/ipfw/ip_fw_log.c Sat Aug 13 15:41:04 2016 (r304041) @@ -40,20 +40,14 @@ __FBSDID("$FreeBSD$"); #include #include #include -#include #include #include #include #include -#include -#include #include /* for ETHERTYPE_IP */ #include #include -#include #include -#include /* for IFT_PFLOG */ -#include /* for BPF */ #include #include @@ -96,155 +90,6 @@ __FBSDID("$FreeBSD$"); #define SNP(buf) buf, sizeof(buf) #endif /* !__APPLE__ */ -#ifdef WITHOUT_BPF -void -ipfw_log_bpf(int onoff) -{ -} -#else /* !WITHOUT_BPF */ -static VNET_DEFINE(struct ifnet *, log_if); /* hook to attach to bpf */ -#define V_log_if VNET(log_if) -static struct rwlock log_if_lock; -#define LOGIF_LOCK_INIT(x) rw_init(&log_if_lock, "ipfw log_if lock") -#define LOGIF_LOCK_DESTROY(x) rw_destroy(&log_if_lock) -#define LOGIF_RLOCK(x) rw_rlock(&log_if_lock) -#define LOGIF_RUNLOCK(x) rw_runlock(&log_if_lock) -#define LOGIF_WLOCK(x) rw_wlock(&log_if_lock) -#define LOGIF_WUNLOCK(x) rw_wunlock(&log_if_lock) - -static const char ipfwname[] = "ipfw"; - -/* we use this dummy function for all ifnet callbacks */ -static int -log_dummy(struct ifnet *ifp, u_long cmd, caddr_t addr) -{ - return EINVAL; -} - -static int -ipfw_log_output(struct ifnet *ifp, struct mbuf *m, - const struct sockaddr *dst, struct route *ro) -{ - if (m != NULL) - FREE_PKT(m); - return EINVAL; -} - -static void -ipfw_log_start(struct ifnet* ifp) -{ - panic("ipfw_log_start() must not be called"); -} - -static const u_char ipfwbroadcastaddr[6] = - { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; - -static int -ipfw_log_clone_match(struct if_clone *ifc, const char *name) -{ - - return (strncmp(name, ipfwname, sizeof(ipfwname) - 1) == 0); -} - -static int -ipfw_log_clone_create(struct if_clone *ifc, char *name, size_t len, - caddr_t params) -{ - int error; - int unit; - struct ifnet *ifp; - - error = ifc_name2unit(name, &unit); - if (error) - return (error); - - error = ifc_alloc_unit(ifc, &unit); - if (error) - return (error); - - ifp = if_alloc(IFT_PFLOG); - if (ifp == NULL) { - ifc_free_unit(ifc, unit); - return (ENOSPC); - } - ifp->if_dname = ipfwname; - ifp->if_dunit = unit; - snprintf(ifp->if_xname, IFNAMSIZ, "%s%d", ipfwname, unit); - strlcpy(name, ifp->if_xname, len); - ifp->if_mtu = 65536; - ifp->if_flags = IFF_UP | IFF_SIMPLEX | IFF_MULTICAST; - ifp->if_init = (void *)log_dummy; - ifp->if_ioctl = log_dummy; - ifp->if_start = ipfw_log_start; - ifp->if_output = ipfw_log_output; - ifp->if_addrlen = 6; - ifp->if_hdrlen = 14; - ifp->if_broadcastaddr = ipfwbroadcastaddr; - ifp->if_baudrate = IF_Mbps(10); - - LOGIF_WLOCK(); - if (V_log_if == NULL) - V_log_if = ifp; - else { - LOGIF_WUNLOCK(); - if_free(ifp); - ifc_free_unit(ifc, unit); - return (EEXIST); - } - LOGIF_WUNLOCK(); - if_attach(ifp); - bpfattach(ifp, DLT_EN10MB, 14); - - return (0); -} - -static int -ipfw_log_clone_destroy(struct if_clone *ifc, struct ifnet *ifp) -{ - int unit; - - if (ifp == NULL) - return (0); - - LOGIF_WLOCK(); - if (V_log_if != NULL && ifp == V_log_if) - V_log_if = NULL; - else { - LOGIF_WUNLOCK(); - return (EINVAL); - } - LOGIF_WUNLOCK(); - - unit = ifp->if_dunit; - bpfdetach(ifp); - if_detach(ifp); - if_free(ifp); - ifc_free_unit(ifc, unit); - - return (0); -} - -static VNET_DEFINE(struct if_clone *, ipfw_log_cloner); -#define V_ipfw_log_cloner VNET(ipfw_log_cloner) - -void -ipfw_log_bpf(int onoff) -{ - - if (onoff) { - if (IS_DEFAULT_VNET(curvnet)) - LOGIF_LOCK_INIT(); - V_ipfw_log_cloner = if_clone_advanced(ipfwname, 0, - ipfw_log_clone_match, ipfw_log_clone_create, - ipfw_log_clone_destroy); - } else { - if_clone_detach(V_ipfw_log_cloner); - if (IS_DEFAULT_VNET(curvnet)) - LOGIF_LOCK_DESTROY(); - } -} -#endif /* !WITHOUT_BPF */ - #define TARG(k, f) IP_FW_ARG_TABLEARG(chain, k, f) /* * We enter here when we have a rule with O_LOG. @@ -260,29 +105,23 @@ ipfw_log(struct ip_fw_chain *chain, stru char action2[92], proto[128], fragment[32]; if (V_fw_verbose == 0) { -#ifndef WITHOUT_BPF - LOGIF_RLOCK(); - if (V_log_if == NULL || V_log_if->if_bpf == NULL) { - LOGIF_RUNLOCK(); - return; - } - if (args->eh) /* layer2, use orig hdr */ - BPF_MTAP2(V_log_if, args->eh, ETHER_HDR_LEN, m); + ipfw_bpf_mtap2(args->eh, ETHER_HDR_LEN, m); else { /* Add fake header. Later we will store * more info in the header. */ if (ip->ip_v == 4) - BPF_MTAP2(V_log_if, "DDDDDDSSSSSS\x08\x00", ETHER_HDR_LEN, m); - else if (ip->ip_v == 6) - BPF_MTAP2(V_log_if, "DDDDDDSSSSSS\x86\xdd", ETHER_HDR_LEN, m); + ipfw_bpf_mtap2("DDDDDDSSSSSS\x08\x00", + ETHER_HDR_LEN, m); + else if (ip->ip_v == 6) + ipfw_bpf_mtap2("DDDDDDSSSSSS\x86\xdd", + ETHER_HDR_LEN, m); else /* Obviously bogus EtherType. */ - BPF_MTAP2(V_log_if, "DDDDDDSSSSSS\xff\xff", ETHER_HDR_LEN, m); + ipfw_bpf_mtap2("DDDDDDSSSSSS\xff\xff", + ETHER_HDR_LEN, m); } - LOGIF_RUNLOCK(); -#endif /* !WITHOUT_BPF */ return; } /* the old 'log' function */ Modified: head/sys/netpfil/ipfw/ip_fw_private.h ============================================================================== --- head/sys/netpfil/ipfw/ip_fw_private.h Sat Aug 13 06:26:33 2016 (r304040) +++ head/sys/netpfil/ipfw/ip_fw_private.h Sat Aug 13 15:41:04 2016 (r304041) @@ -154,7 +154,9 @@ void ipfw_nat_destroy(void); /* In ip_fw_log.c */ struct ip; struct ip_fw_chain; -void ipfw_log_bpf(int); +void ipfw_bpf_init(int); +void ipfw_bpf_uninit(int); +void ipfw_bpf_mtap2(void *, u_int, struct mbuf *); void ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen, struct ip_fw_args *args, struct mbuf *m, struct ifnet *oif, u_short offset, uint32_t tablearg, struct ip *ip);