summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorrmind <rmind@NetBSD.org>2013-11-08 00:38:26 +0000
committerrmind <rmind@NetBSD.org>2013-11-08 00:38:26 +0000
commitd1d2e2c9b05cd0a6ff3487f2022ff26ecb24a91d (patch)
treef67e712c15e878d250a44ab2480e3cf6ef308cf8 /sys
parent7c6db3061bd13e1d209c3f71f8e23ff03365f80a (diff)
NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active. Bump NPF_VERSION.
Diffstat (limited to 'sys')
-rw-r--r--sys/modules/npf/Makefile11
-rw-r--r--sys/net/npf/files.npf3
-rw-r--r--sys/net/npf/npf.c7
-rw-r--r--sys/net/npf/npf.h5
-rw-r--r--sys/net/npf/npf_conf.c13
-rw-r--r--sys/net/npf/npf_ctl.c8
-rw-r--r--sys/net/npf/npf_handler.c75
-rw-r--r--sys/net/npf/npf_if.c177
-rw-r--r--sys/net/npf/npf_impl.h13
-rw-r--r--sys/net/npf/npf_mbuf.c8
-rw-r--r--sys/net/npf/npf_ruleset.c18
-rw-r--r--sys/net/npf/npf_session.c16
-rw-r--r--sys/rump/net/lib/libnpf/Makefile12
13 files changed, 293 insertions, 73 deletions
diff --git a/sys/modules/npf/Makefile b/sys/modules/npf/Makefile
index 35f642a85f8..aaad60e0a76 100644
--- a/sys/modules/npf/Makefile
+++ b/sys/modules/npf/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.15 2013/09/19 01:49:07 rmind Exp $
+# $NetBSD: Makefile,v 1.16 2013/11/08 00:38:26 rmind Exp $
#
# Public Domain.
#
@@ -9,10 +9,11 @@
KMOD= npf
-SRCS= npf.c npf_alg.c npf_conf.c npf_ctl.c npf_handler.c npf_bpf.c
-SRCS+= npf_inet.c npf_mbuf.c npf_nat.c npf_ruleset.c npf_rproc.c
-SRCS+= npf_sendpkt.c npf_session.c npf_state.c npf_state_tcp.c
-SRCS+= npf_tableset.c npf_tableset_ptree.c npf_worker.c
+SRCS= npf.c npf_alg.c npf_conf.c npf_ctl.c npf_handler.c
+SRCS+= npf_bpf.c npf_if.c npf_inet.c npf_mbuf.c npf_nat.c
+SRCS+= npf_ruleset.c npf_rproc.c npf_sendpkt.c npf_session.c
+SRCS+= npf_state.c npf_state_tcp.c npf_tableset.c
+SRCS+= npf_tableset_ptree.c npf_worker.c
CPPFLAGS+= -DINET6
diff --git a/sys/net/npf/files.npf b/sys/net/npf/files.npf
index 46c73cc9f7f..9107b4cb6a5 100644
--- a/sys/net/npf/files.npf
+++ b/sys/net/npf/files.npf
@@ -1,4 +1,4 @@
-# $NetBSD: files.npf,v 1.15 2013/09/19 01:49:07 rmind Exp $
+# $NetBSD: files.npf,v 1.16 2013/11/08 00:38:26 rmind Exp $
#
# Public Domain.
#
@@ -20,6 +20,7 @@ file net/npf/npf_ruleset.c npf
file net/npf/npf_rproc.c npf
file net/npf/npf_tableset.c npf
file net/npf/npf_tableset_ptree.c npf
+file net/npf/npf_if.c npf
file net/npf/npf_inet.c npf
file net/npf/npf_session.c npf
file net/npf/npf_state.c npf
diff --git a/sys/net/npf/npf.c b/sys/net/npf/npf.c
index 76ce92cb6df..56fb932a992 100644
--- a/sys/net/npf/npf.c
+++ b/sys/net/npf/npf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf.c,v 1.17 2013/09/19 01:04:46 rmind Exp $ */
+/* $NetBSD: npf.c,v 1.18 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.17 2013/09/19 01:04:46 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.18 2013/11/08 00:38:26 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -97,6 +97,7 @@ npf_init(void)
npf_ext_sysinit();
/* Load empty configuration. */
+ npf_pfil_register(true);
npf_config_init();
#ifdef _MODULE
@@ -117,7 +118,7 @@ npf_fini(void)
#ifdef _MODULE
devsw_detach(NULL, &npf_cdevsw);
#endif
- npf_pfil_unregister();
+ npf_pfil_unregister(true);
/* Flush all sessions, destroy configuration (ruleset, etc). */
npf_session_tracking(false);
diff --git a/sys/net/npf/npf.h b/sys/net/npf/npf.h
index 205ec6abe58..c25737f65ff 100644
--- a/sys/net/npf/npf.h
+++ b/sys/net/npf/npf.h
@@ -1,4 +1,4 @@
-/* $NetBSD: npf.h,v 1.31 2013/09/19 01:04:46 rmind Exp $ */
+/* $NetBSD: npf.h,v 1.32 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
@@ -45,7 +45,7 @@
#include <netinet/in_systm.h>
#include <netinet/in.h>
-#define NPF_VERSION 10
+#define NPF_VERSION 11
/*
* Public declarations and definitions.
@@ -143,6 +143,7 @@ typedef struct {
struct mbuf * nb_mbuf;
void * nb_nptr;
const ifnet_t * nb_ifp;
+ unsigned nb_ifid;
int nb_flags;
} nbuf_t;
diff --git a/sys/net/npf/npf_conf.c b/sys/net/npf/npf_conf.c
index dc8fb42f829..10dcfcff597 100644
--- a/sys/net/npf/npf_conf.c
+++ b/sys/net/npf/npf_conf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_conf.c,v 1.2 2013/02/10 23:47:37 rmind Exp $ */
+/* $NetBSD: npf_conf.c,v 1.3 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2013 The NetBSD Foundation, Inc.
@@ -48,7 +48,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_conf.c,v 1.2 2013/02/10 23:47:37 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_conf.c,v 1.3 2013/11/08 00:38:26 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -108,6 +108,11 @@ npf_config_destroy(npf_config_t *nc)
void
npf_config_fini(void)
{
+ mutex_enter(&npf_config_lock);
+ pserialize_perform(npf_config_psz);
+ npf_ifmap_flush();
+ mutex_exit(&npf_config_lock);
+
npf_config_destroy(npf_config);
pserialize_destroy(npf_config_psz);
mutex_destroy(&npf_config_lock);
@@ -151,12 +156,16 @@ npf_config_reload(prop_dictionary_t dict, npf_ruleset_t *rset,
npf_config = nc;
if (onc == NULL) {
/* Initial load, done. */
+ npf_ifmap_flush();
mutex_exit(&npf_config_lock);
return;
}
/* Synchronise: drain all references. */
pserialize_perform(npf_config_psz);
+ if (flush) {
+ npf_ifmap_flush();
+ }
mutex_exit(&npf_config_lock);
/* Finally, it is safe to destroy the old config. */
diff --git a/sys/net/npf/npf_ctl.c b/sys/net/npf/npf_ctl.c
index 241be5c1ad7..0773203cda8 100644
--- a/sys/net/npf/npf_ctl.c
+++ b/sys/net/npf/npf_ctl.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_ctl.c,v 1.30 2013/10/27 16:22:08 rmind Exp $ */
+/* $NetBSD: npf_ctl.c,v 1.31 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.30 2013/10/27 16:22:08 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.31 2013/11/08 00:38:26 rmind Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@@ -67,10 +67,10 @@ npfctl_switch(void *data)
if (onoff) {
/* Enable: add pfil hooks. */
- error = npf_pfil_register();
+ error = npf_pfil_register(false);
} else {
/* Disable: remove pfil hooks. */
- npf_pfil_unregister();
+ npf_pfil_unregister(false);
error = 0;
}
return error;
diff --git a/sys/net/npf/npf_handler.c b/sys/net/npf/npf_handler.c
index 0d09fbd0276..17f0f342668 100644
--- a/sys/net/npf/npf_handler.c
+++ b/sys/net/npf/npf_handler.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_handler.c,v 1.27 2013/06/29 21:06:58 rmind Exp $ */
+/* $NetBSD: npf_handler.c,v 1.28 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
@@ -31,10 +31,12 @@
/*
* NPF packet handler.
+ *
+ * Note: pfil(9) hooks are currently locked by softnet_lock and kernel-lock.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.27 2013/06/29 21:06:58 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.28 2013/11/08 00:38:26 rmind Exp $");
#include <sys/types.h>
#include <sys/param.h>
@@ -53,10 +55,7 @@ __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.27 2013/06/29 21:06:58 rmind Exp $
#include "npf_impl.h"
-/*
- * If npf_ph_if != NULL, pfil hooks are registered. If NULL, not registered.
- * Used to check the state. Locked by: softnet_lock + KERNEL_LOCK (XXX).
- */
+static bool pfil_registered = false;
static pfil_head_t * npf_ph_if = NULL;
static pfil_head_t * npf_ph_inet = NULL;
static pfil_head_t * npf_ph_inet6 = NULL;
@@ -71,7 +70,18 @@ static pfil_head_t * npf_ph_inet6 = NULL;
static int
npf_ifhook(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
{
-
+ u_long cmd = (u_long)mp;
+
+ if (di == PFIL_IFNET) {
+ switch (cmd) {
+ case PFIL_IFNET_ATTACH:
+ npf_ifmap_attach(ifp);
+ break;
+ case PFIL_IFNET_DETACH:
+ npf_ifmap_detach(ifp);
+ break;
+ }
+ }
return 0;
}
@@ -294,35 +304,43 @@ out:
* npf_pfil_register: register pfil(9) hooks.
*/
int
-npf_pfil_register(void)
+npf_pfil_register(bool init)
{
- int error;
+ int error = 0;
mutex_enter(softnet_lock);
KERNEL_LOCK(1, NULL);
+ /* Init: interface re-config and attach/detach hook. */
+ if (!npf_ph_if) {
+ npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
+ if (!npf_ph_if) {
+ error = ENOENT;
+ goto out;
+ }
+ error = pfil_add_hook(npf_ifhook, NULL,
+ PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
+ KASSERT(error == 0);
+ }
+ if (init) {
+ goto out;
+ }
+
/* Check if pfil hooks are not already registered. */
- if (npf_ph_if) {
+ if (pfil_registered) {
error = EEXIST;
- goto fail;
+ goto out;
}
- /* Capture point of any activity in interfaces and IP layer. */
- npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
+ /* Capture points of the activity in the IP layer. */
npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
- if (!npf_ph_if || (!npf_ph_inet && !npf_ph_inet6)) {
- npf_ph_if = NULL;
+ if (!npf_ph_inet && !npf_ph_inet6) {
error = ENOENT;
- goto fail;
+ goto out;
}
- /* Interface re-config or attach/detach hook. */
- error = pfil_add_hook(npf_ifhook, NULL,
- PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
- KASSERT(error == 0);
-
- /* Packet IN/OUT handler on all interfaces and IP layer. */
+ /* Packet IN/OUT handlers for IP layer. */
if (npf_ph_inet) {
error = pfil_add_hook(npf_packet_handler, NULL,
PFIL_ALL, npf_ph_inet);
@@ -333,7 +351,8 @@ npf_pfil_register(void)
PFIL_ALL, npf_ph_inet6);
KASSERT(error == 0);
}
-fail:
+ pfil_registered = true;
+out:
KERNEL_UNLOCK_ONE(NULL);
mutex_exit(softnet_lock);
@@ -344,13 +363,12 @@ fail:
* npf_pfil_unregister: unregister pfil(9) hooks.
*/
void
-npf_pfil_unregister(void)
+npf_pfil_unregister(bool fini)
{
-
mutex_enter(softnet_lock);
KERNEL_LOCK(1, NULL);
- if (npf_ph_if) {
+ if (fini && npf_ph_if) {
(void)pfil_remove_hook(npf_ifhook, NULL,
PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
}
@@ -362,8 +380,7 @@ npf_pfil_unregister(void)
(void)pfil_remove_hook(npf_packet_handler, NULL,
PFIL_ALL, npf_ph_inet6);
}
-
- npf_ph_if = NULL;
+ pfil_registered = false;
KERNEL_UNLOCK_ONE(NULL);
mutex_exit(softnet_lock);
@@ -372,5 +389,5 @@ npf_pfil_unregister(void)
bool
npf_pfil_registered_p(void)
{
- return npf_ph_if != NULL;
+ return pfil_registered;
}
diff --git a/sys/net/npf/npf_if.c b/sys/net/npf/npf_if.c
new file mode 100644
index 00000000000..0ea88fc821c
--- /dev/null
+++ b/sys/net/npf/npf_if.c
@@ -0,0 +1,177 @@
+/* $NetBSD: npf_if.c,v 1.1 2013/11/08 00:38:26 rmind Exp $ */
+
+/*-
+ * Copyright (c) 2013 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Mindaugas Rasiukevicius.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * NPF network interface handling module.
+ *
+ * NPF uses its own interface IDs (npf-if-id). When NPF configuration is
+ * (re)loaded, each required interface name is registered and a matching
+ * network interface gets an ID assigned. If an interface is not present,
+ * it gets an ID on attach. Any other interfaces get INACTIVE_ID.
+ *
+ * The IDs are mapped synchronously based on interface events which are
+ * monitored using pfil(9) hooks.
+ */
+
+#include <sys/cdefs.h>
+__KERNEL_RCSID(0, "$NetBSD: npf_if.c,v 1.1 2013/11/08 00:38:26 rmind Exp $");
+
+#ifdef _KERNEL_OPT
+#include "pf.h"
+#if NPF > 0
+#error "NPF and PF are mutually exclusive; please select one"
+#endif
+#endif
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/kmem.h>
+
+#include <net/if.h>
+
+#include "npf_impl.h"
+
+#define INACTIVE_ID ((u_int)-1)
+
+typedef struct {
+ char n_ifname[IFNAMSIZ];
+} npf_ifmap_t;
+
+static npf_ifmap_t npf_ifmap[NPF_MAX_IFMAP] __read_mostly;
+static u_int npf_ifmap_cnt __read_mostly;
+
+/*
+ * NOTE: IDs start from 1. Zero is reseved for "no interface" and
+ * (unsigned)-1 for "inactive interface". Therefore, an interface
+ * can have either INACTIVE_ID or non-zero ID.
+ */
+
+static u_int
+npf_ifmap_new(void)
+{
+ KASSERT(npf_config_locked_p());
+
+ for (u_int i = 0; i < npf_ifmap_cnt; i++)
+ if (npf_ifmap[i].n_ifname[0] == '\0')
+ return i + 1;
+
+ if (npf_ifmap_cnt == NPF_MAX_IFMAP) {
+ printf("npf_ifmap_new: out of slots; bump NPF_MAX_IFMAP\n");
+ return INACTIVE_ID;
+ }
+ return ++npf_ifmap_cnt;
+}
+
+static u_int
+npf_ifmap_lookup(const char *ifname)
+{
+ KASSERT(npf_config_locked_p());
+
+ for (u_int i = 0; i < npf_ifmap_cnt; i++) {
+ npf_ifmap_t *nim = &npf_ifmap[i];
+
+ if (nim->n_ifname && strcmp(nim->n_ifname, ifname) == 0)
+ return i + 1;
+ }
+ return INACTIVE_ID;
+}
+
+u_int
+npf_ifmap_register(const char *ifname)
+{
+ npf_ifmap_t *nim;
+ ifnet_t *ifp;
+ u_int i;
+
+ npf_config_enter();
+ if ((i = npf_ifmap_lookup(ifname)) != INACTIVE_ID) {
+ goto out;
+ }
+ if ((i = npf_ifmap_new()) == INACTIVE_ID) {
+ i = INACTIVE_ID;
+ goto out;
+ }
+ nim = &npf_ifmap[i - 1];
+ strlcpy(nim->n_ifname, ifname, IFNAMSIZ);
+
+ KERNEL_LOCK(1, NULL);
+ if ((ifp = ifunit(ifname)) != NULL) {
+ ifp->if_pf_kif = (void *)(uintptr_t)i;
+ }
+ KERNEL_UNLOCK_ONE(NULL);
+out:
+ npf_config_exit();
+ return i;
+}
+
+void
+npf_ifmap_flush(void)
+{
+ ifnet_t *ifp;
+
+ KASSERT(npf_config_locked_p());
+
+ for (u_int i = 0; i < npf_ifmap_cnt; i++) {
+ npf_ifmap[i].n_ifname[0] = '\0';
+ }
+ npf_ifmap_cnt = 0;
+
+ KERNEL_LOCK(1, NULL);
+ IFNET_FOREACH(ifp) {
+ ifp->if_pf_kif = (void *)(uintptr_t)INACTIVE_ID;
+ }
+ KERNEL_UNLOCK_ONE(NULL);
+}
+
+u_int
+npf_ifmap_id(const ifnet_t *ifp)
+{
+ const u_int i = (uintptr_t)ifp->if_pf_kif;
+
+ KASSERT(i == INACTIVE_ID || (i > 0 && i <= npf_ifmap_cnt));
+ return i;
+}
+
+void
+npf_ifmap_attach(ifnet_t *ifp)
+{
+ npf_config_enter();
+ ifp->if_pf_kif = (void *)(uintptr_t)npf_ifmap_lookup(ifp->if_xname);
+ npf_config_exit();
+}
+
+void
+npf_ifmap_detach(ifnet_t *ifp)
+{
+ npf_config_enter();
+ ifp->if_pf_kif = (void *)(uintptr_t)INACTIVE_ID; /* diagnostic */
+ npf_config_exit();
+}
diff --git a/sys/net/npf/npf_impl.h b/sys/net/npf/npf_impl.h
index f50a072915b..490bb21ef73 100644
--- a/sys/net/npf/npf_impl.h
+++ b/sys/net/npf/npf_impl.h
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_impl.h,v 1.36 2013/11/04 22:17:21 rmind Exp $ */
+/* $NetBSD: npf_impl.h,v 1.37 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
@@ -103,6 +103,7 @@ typedef void (*npf_workfunc_t)(void);
/* Some artificial limits. */
#define NPF_TABLE_SLOTS 32
#define NPF_MAX_RULES (1024 * 1024)
+#define NPF_MAX_IFMAP 64
/*
* SESSION STATE STRUCTURES
@@ -166,9 +167,15 @@ int npfctl_table(void *);
void npf_stats_inc(npf_stats_t);
void npf_stats_dec(npf_stats_t);
+u_int npf_ifmap_register(const char *);
+void npf_ifmap_flush(void);
+void npf_ifmap_attach(ifnet_t *);
+void npf_ifmap_detach(ifnet_t *);
+u_int npf_ifmap_id(const ifnet_t *);
+
/* Packet filter hooks. */
-int npf_pfil_register(void);
-void npf_pfil_unregister(void);
+int npf_pfil_register(bool);
+void npf_pfil_unregister(bool);
bool npf_pfil_registered_p(void);
int npf_packet_handler(void *, struct mbuf **, ifnet_t *, int);
diff --git a/sys/net/npf/npf_mbuf.c b/sys/net/npf/npf_mbuf.c
index 3898b91e518..1a3495ccdb5 100644
--- a/sys/net/npf/npf_mbuf.c
+++ b/sys/net/npf/npf_mbuf.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_mbuf.c,v 1.11 2013/02/19 23:57:37 rmind Exp $ */
+/* $NetBSD: npf_mbuf.c,v 1.12 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_mbuf.c,v 1.11 2013/02/19 23:57:37 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_mbuf.c,v 1.12 2013/11/08 00:38:26 rmind Exp $");
#include <sys/param.h>
#include <sys/mbuf.h>
@@ -51,11 +51,13 @@ __KERNEL_RCSID(0, "$NetBSD: npf_mbuf.c,v 1.11 2013/02/19 23:57:37 rmind Exp $");
void
nbuf_init(nbuf_t *nbuf, struct mbuf *m, const ifnet_t *ifp)
{
+ u_int ifid = npf_ifmap_id(ifp);
+
KASSERT((m->m_flags & M_PKTHDR) != 0);
- KASSERT(ifp != NULL);
nbuf->nb_mbuf0 = m;
nbuf->nb_ifp = ifp;
+ nbuf->nb_ifid = ifid;
nbuf_reset(nbuf);
}
diff --git a/sys/net/npf/npf_ruleset.c b/sys/net/npf/npf_ruleset.c
index 3170923170b..e56422ff374 100644
--- a/sys/net/npf/npf_ruleset.c
+++ b/sys/net/npf/npf_ruleset.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_ruleset.c,v 1.25 2013/09/19 01:49:07 rmind Exp $ */
+/* $NetBSD: npf_ruleset.c,v 1.26 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.25 2013/09/19 01:49:07 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.26 2013/11/08 00:38:26 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -520,7 +520,15 @@ npf_rule_alloc(prop_dictionary_t rldict)
/* Attributes, priority and interface ID (optional). */
prop_dictionary_get_uint32(rldict, "attributes", &rl->r_attr);
prop_dictionary_get_int32(rldict, "priority", &rl->r_priority);
- prop_dictionary_get_uint32(rldict, "interface", &rl->r_ifid);
+
+ if (prop_dictionary_get_cstring_nocopy(rldict, "interface", &rname)) {
+ if ((rl->r_ifid = npf_ifmap_register(rname)) == 0) {
+ kmem_free(rl, sizeof(npf_rule_t));
+ return NULL;
+ }
+ } else {
+ rl->r_ifid = 0;
+ }
/* Get the skip-to index. No need to validate it. */
prop_dictionary_get_uint32(rldict, "skip-to", &rl->r_skip_to);
@@ -661,10 +669,8 @@ static inline bool
npf_rule_inspect(npf_cache_t *npc, nbuf_t *nbuf, const npf_rule_t *rl,
const int di_mask, const int layer)
{
- const ifnet_t *ifp = nbuf->nb_ifp;
-
/* Match the interface. */
- if (rl->r_ifid && rl->r_ifid != ifp->if_index) {
+ if (rl->r_ifid && rl->r_ifid != nbuf->nb_ifid) {
return false;
}
diff --git a/sys/net/npf/npf_session.c b/sys/net/npf/npf_session.c
index 51fccf4fa5d..74220c9bb97 100644
--- a/sys/net/npf/npf_session.c
+++ b/sys/net/npf/npf_session.c
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_session.c,v 1.26 2013/10/29 16:39:10 rmind Exp $ */
+/* $NetBSD: npf_session.c,v 1.27 2013/11/08 00:38:26 rmind Exp $ */
/*-
* Copyright (c) 2010-2013 The NetBSD Foundation, Inc.
@@ -92,7 +92,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_session.c,v 1.26 2013/10/29 16:39:10 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_session.c,v 1.27 2013/11/08 00:38:26 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -150,7 +150,7 @@ struct npf_session {
/* Protocol and interface (common IDs). */
struct npf_secomid {
uint16_t proto;
- uint16_t if_idx;
+ uint16_t ifid;
} s_common_id;
/* Flags and the protocol state. */
u_int s_flags;
@@ -312,7 +312,7 @@ sess_hash_bucket(npf_sehash_t *stbl, const npf_secomid_t *scid,
const int sz = sen->se_alen;
uint32_t hash, mix[2];
- mix[0] = (scid->proto ^ scid->if_idx) << 16;
+ mix[0] = (scid->proto ^ scid->ifid) << 16;
mix[0] |= sen->se_src_id ^ sen->se_dst_id;
mix[1] = npf_addr_sum(sz, &sen->se_src_addr, &sen->se_dst_addr);
hash = murmurhash2(mix, sizeof(mix), sess_hash_seed);
@@ -486,7 +486,6 @@ npf_session_lookup(const npf_cache_t *npc, const nbuf_t *nbuf,
const int di, bool *forw)
{
const u_int proto = npc->npc_proto;
- const ifnet_t *ifp = nbuf->nb_ifp;
npf_sentry_t senkey, *sen;
npf_session_t *se;
npf_sehash_t *sh;
@@ -506,7 +505,7 @@ npf_session_lookup(const npf_cache_t *npc, const nbuf_t *nbuf,
*/
npf_secomid_t scid;
memset(&scid, 0, sizeof(npf_secomid_t));
- scid = (npf_secomid_t){ .proto = proto, .if_idx = ifp->if_index };
+ scid = (npf_secomid_t){ .proto = proto, .ifid = nbuf->nb_ifid };
senkey.se_common_id = &scid;
/*
@@ -527,7 +526,7 @@ npf_session_lookup(const npf_cache_t *npc, const nbuf_t *nbuf,
}
se = sen->se_backptr;
KASSERT(se->s_common_id.proto == proto);
- KASSERT(se->s_common_id.if_idx == ifp->if_index);
+ KASSERT(se->s_common_id.ifid == nbuf->nb_ifid);
flags = se->s_flags;
/* Check if session is active and not expired. */
@@ -604,7 +603,6 @@ npf_session_inspect(npf_cache_t *npc, nbuf_t *nbuf, const int di, int *error)
npf_session_t *
npf_session_establish(npf_cache_t *npc, nbuf_t *nbuf, const int di)
{
- const ifnet_t *ifp = nbuf->nb_ifp;
npf_sentry_t *fw, *bk;
npf_sehash_t *sh;
npf_session_t *se;
@@ -646,7 +644,7 @@ npf_session_establish(npf_cache_t *npc, nbuf_t *nbuf, const int di)
/* Protocol and interface. */
memset(&se->s_common_id, 0, sizeof(npf_secomid_t));
se->s_common_id.proto = npc->npc_proto;
- se->s_common_id.if_idx = ifp->if_index;
+ se->s_common_id.ifid = nbuf->nb_ifid;
/* Setup "forwards" entry. */
if (!npf_session_fillent(npc, fw)) {
diff --git a/sys/rump/net/lib/libnpf/Makefile b/sys/rump/net/lib/libnpf/Makefile
index 91f06fd27dc..5176983d241 100644
--- a/sys/rump/net/lib/libnpf/Makefile
+++ b/sys/rump/net/lib/libnpf/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.8 2013/09/19 01:49:07 rmind Exp $
+# $NetBSD: Makefile,v 1.9 2013/11/08 00:38:27 rmind Exp $
#
# Public Domain.
#
@@ -7,11 +7,11 @@
LIB= rumpnet_npf
-SRCS= npf.c npf_alg.c npf_conf.c npf_ctl.c npf_handler.c npf_bpf.c
-SRCS+= npf_inet.c npf_mbuf.c npf_nat.c npf_ruleset.c npf_rproc.c
-SRCS+= npf_sendpkt.c npf_session.c npf_state.c npf_state_tcp.c
-SRCS+= npf_tableset.c npf_tableset_ptree.c npf_worker.c
-SRCS+= if_npflog.c
+SRCS= npf.c npf_alg.c npf_conf.c npf_ctl.c npf_handler.c
+SRCS+= npf_bpf.c npf_if.c npf_inet.c npf_mbuf.c npf_nat.c
+SRCS+= npf_ruleset.c npf_rproc.c npf_sendpkt.c npf_session.c
+SRCS+= npf_state.c npf_state_tcp.c npf_tableset.c
+SRCS+= npf_tableset_ptree.c npf_worker.c if_npflog.c
SRCS+= npf_alg_icmp.c