4 * Copyright (C) 2012 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
10 #include <sys/param.h>
11 #include <sys/systm.h>
12 #include <sys/kernel.h>
13 #include <sys/module.h>
15 #include <sys/socket.h>
16 #include <sys/sysctl.h>
17 #include <sys/select.h>
18 #if __FreeBSD_version >= 500000
19 # include <sys/selinfo.h>
22 #include <netinet/in_systm.h>
23 #include <netinet/in.h>
26 #include "netinet/ipl.h"
27 #include "netinet/ip_compat.h"
28 #include "netinet/ip_fil.h"
29 #include "netinet/ip_state.h"
30 #include "netinet/ip_nat.h"
31 #include "netinet/ip_auth.h"
32 #include "netinet/ip_frag.h"
33 #include "netinet/ip_sync.h"
35 extern ipf_main_softc_t ipfmain;
37 #if __FreeBSD_version >= 502116
38 static struct cdev *ipf_devs[IPL_LOGSIZE];
40 static dev_t ipf_devs[IPL_LOGSIZE];
44 static int sysctl_ipf_int ( SYSCTL_HANDLER_ARGS );
46 static int ipf_modload(void);
47 static int ipf_modunload(void);
49 #if (__FreeBSD_version >= 500024)
50 # if (__FreeBSD_version >= 502116)
51 static int ipfopen __P((struct cdev*, int, int, struct thread *));
52 static int ipfclose __P((struct cdev*, int, int, struct thread *));
54 static int ipfopen __P((dev_t, int, int, struct thread *));
55 static int ipfclose __P((dev_t, int, int, struct thread *));
56 # endif /* __FreeBSD_version >= 502116 */
58 static int ipfopen __P((dev_t, int, int, struct proc *));
59 static int ipfclose __P((dev_t, int, int, struct proc *));
61 #if (__FreeBSD_version >= 502116)
62 static int ipfread __P((struct cdev*, struct uio *, int));
63 static int ipfwrite __P((struct cdev*, struct uio *, int));
65 static int ipfread __P((dev_t, struct uio *, int));
66 static int ipfwrite __P((dev_t, struct uio *, int));
67 #endif /* __FreeBSD_version >= 502116 */
71 SYSCTL_DECL(_net_inet);
72 #define SYSCTL_IPF(parent, nbr, name, access, ptr, val, descr) \
73 SYSCTL_OID(parent, nbr, name, CTLTYPE_INT|access, \
74 ptr, val, sysctl_ipf_int, "I", descr);
75 #define CTLFLAG_OFF 0x00800000 /* IPFilter must be disabled */
76 #define CTLFLAG_RWO (CTLFLAG_RW|CTLFLAG_OFF)
77 SYSCTL_NODE(_net_inet, OID_AUTO, ipf, CTLFLAG_RW, 0, "IPF");
79 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_flags, CTLFLAG_RW, &ipf_flags, 0, "");
80 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_pass, CTLFLAG_RW, &ipf_pass, 0, "");
81 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_active, CTLFLAG_RD, &ipf_active, 0, "");
82 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcpidletimeout, CTLFLAG_RWO,
83 &ipf_tcpidletimeout, 0, "");
84 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcphalfclosed, CTLFLAG_RWO,
85 &ipf_tcphalfclosed, 0, "");
86 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcpclosewait, CTLFLAG_RWO,
87 &ipf_tcpclosewait, 0, "");
88 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcplastack, CTLFLAG_RWO,
89 &ipf_tcplastack, 0, "");
90 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcptimeout, CTLFLAG_RWO,
91 &ipf_tcptimeout, 0, "");
92 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcpclosed, CTLFLAG_RWO,
93 &ipf_tcpclosed, 0, "");
94 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_udptimeout, CTLFLAG_RWO,
95 &ipf_udptimeout, 0, "");
96 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_udpacktimeout, CTLFLAG_RWO,
97 &ipf_udpacktimeout, 0, "");
98 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_icmptimeout, CTLFLAG_RWO,
99 &ipf_icmptimeout, 0, "");
100 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_defnatage, CTLFLAG_RWO,
101 &ipf_nat_defage, 0, "");
102 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_ipfrttl, CTLFLAG_RW,
103 &ipf_ipfrttl, 0, "");
104 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_running, CTLFLAG_RD,
105 &ipf_running, 0, "");
106 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_statesize, CTLFLAG_RWO,
107 &ipf_state_size, 0, "");
108 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_statemax, CTLFLAG_RWO,
109 &ipf_state_max, 0, "");
110 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_nattable_sz, CTLFLAG_RWO,
111 &ipf_nat_table_sz, 0, "");
112 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_natrules_sz, CTLFLAG_RWO,
113 &ipf_nat_maprules_sz, 0, "");
114 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_rdrrules_sz, CTLFLAG_RWO,
115 &ipf_nat_rdrrules_sz, 0, "");
116 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_hostmap_sz, CTLFLAG_RWO,
117 &ipf_nat_hostmap_sz, 0, "");
118 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_authsize, CTLFLAG_RWO,
119 &ipf_auth_size, 0, "");
120 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_authused, CTLFLAG_RD,
121 &ipf_auth_used, 0, "");
122 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_defaultauthage, CTLFLAG_RW,
123 &ipf_auth_defaultage, 0, "");
124 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_chksrc, CTLFLAG_RW, &ipf_chksrc, 0, "");
125 SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_minttl, CTLFLAG_RW, &ipf_minttl, 0, "");
128 #define CDEV_MAJOR 79
129 #include <sys/poll.h>
130 #if __FreeBSD_version >= 500043
131 # include <sys/select.h>
132 static int ipfpoll(struct cdev *dev, int events, struct thread *td);
134 static struct cdevsw ipf_cdevsw = {
135 #if __FreeBSD_version >= 502103
136 .d_version = D_VERSION,
137 .d_flags = 0, /* D_NEEDGIANT - Should be SMP safe */
146 #if __FreeBSD_version < 600000
151 static int ipfpoll(dev_t dev, int events, struct proc *td);
153 static struct cdevsw ipf_cdevsw = {
155 /* close */ ipfclose,
157 /* write */ ipfwrite,
158 /* ioctl */ ipfioctl,
161 /* strategy */ nostrategy,
163 /* maj */ CDEV_MAJOR,
167 # if (__FreeBSD_version < 500043)
170 # if (__FreeBSD_version >= 430000)
176 static char *ipf_devfiles[] = { IPL_NAME, IPNAT_NAME, IPSTATE_NAME, IPAUTH_NAME,
177 IPSYNC_NAME, IPSCAN_NAME, IPLOOKUP_NAME, NULL };
181 ipfilter_modevent(module_t mod, int type, void *unused)
188 error = ipf_modload();
192 error = ipf_modunload();
205 char *defpass, *c, *str;
208 if (ipf_load_all() != 0)
211 if (ipf_create_all(&ipfmain) == NULL)
214 error = ipfattach(&ipfmain);
218 for (i = 0; i < IPL_LOGSIZE; i++)
221 for (i = 0; (str = ipf_devfiles[i]); i++) {
223 for(j = strlen(str); j > 0; j--)
230 ipf_devs[i] = make_dev(&ipf_cdevsw, i, 0, 0, 0600, c);
233 error = ipf_pfil_hook();
238 if (FR_ISPASS(ipfmain.ipf_pass))
240 else if (FR_ISBLOCK(ipfmain.ipf_pass))
243 defpass = "no-match -> block";
245 printf("%s initialized. Default = %s all, Logging = %s%s\n",
246 ipfilter_version, defpass,
252 #ifdef IPFILTER_COMPILED
267 if (ipfmain.ipf_refcnt)
270 error = ipf_pfil_unhook();
274 if (ipfmain.ipf_running >= 0) {
275 error = ipfdetach(&ipfmain);
279 ipf_destroy_all(&ipfmain);
284 ipfmain.ipf_running = -2;
286 for (i = 0; ipf_devfiles[i]; i++) {
287 if (ipf_devs[i] != NULL)
288 destroy_dev(ipf_devs[i]);
291 printf("%s unloaded\n", ipfilter_version);
297 static moduledata_t ipfiltermod = {
304 DECLARE_MODULE(ipfilter, ipfiltermod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);
305 #ifdef MODULE_VERSION
306 MODULE_VERSION(ipfilter, 1);
313 sysctl_ipf_int ( SYSCTL_HANDLER_ARGS )
318 error = SYSCTL_OUT(req, arg1, sizeof(int));
320 error = SYSCTL_OUT(req, &arg2, sizeof(int));
322 if (error || !req->newptr)
328 if ((oidp->oid_kind & CTLFLAG_OFF) && (ipfmain.ipf_running > 0))
331 error = SYSCTL_IN(req, arg1, sizeof(int));
340 #if __FreeBSD_version >= 500043
341 ipfpoll(struct cdev *dev, int events, struct thread *td)
343 ipfpoll(dev_t dev, int events, struct proc *td)
346 u_int unit = GET_MINOR(dev);
349 if (unit < 0 || unit > IPL_LOGMAX)
360 if ((events & (POLLIN | POLLRDNORM)) && ipf_log_canread(&ipfmain, unit))
361 revents |= events & (POLLIN | POLLRDNORM);
365 if ((events & (POLLIN | POLLRDNORM)) && ipf_auth_waiting(&ipfmain))
366 revents |= events & (POLLIN | POLLRDNORM);
369 if ((events & (POLLIN | POLLRDNORM)) && ipf_sync_canread(&ipfmain))
370 revents |= events & (POLLIN | POLLRDNORM);
371 if ((events & (POLLOUT | POLLWRNORM)) && ipf_sync_canwrite(&ipfmain))
372 revents |= events & (POLLOUT | POLLWRNORM);
380 if ((revents == 0) && ((events & (POLLIN|POLLRDNORM)) != 0))
381 selrecord(td, &ipfmain.ipf_selwait[unit]);
388 * routines below for saving IP headers to buffer
390 static int ipfopen(dev, flags
391 #if ((BSD >= 199506) || (__FreeBSD_version >= 220000))
394 # if (__FreeBSD_version >= 500024)
398 # endif /* __FreeBSD_version >= 500024 */
402 #if (__FreeBSD_version >= 502116)
409 u_int unit = GET_MINOR(dev);
412 if (IPL_LOGMAX < unit)
437 static int ipfclose(dev, flags
438 #if ((BSD >= 199506) || (__FreeBSD_version >= 220000))
441 # if (__FreeBSD_version >= 500024)
445 # endif /* __FreeBSD_version >= 500024 */
449 #if (__FreeBSD_version >= 502116)
456 u_int unit = GET_MINOR(dev);
458 if (IPL_LOGMAX < unit)
467 * both of these must operate with at least splnet() lest they be
468 * called during packet processing and cause an inconsistancy to appear in
472 static int ipfread(dev, uio, ioflag)
475 static int ipfread(dev, uio)
477 #if (__FreeBSD_version >= 502116)
484 u_int unit = GET_MINOR(dev);
489 if (ipfmain.ipf_running < 1)
492 if (unit == IPL_LOGSYNC)
493 return ipf_sync_read(&ipfmain, uio);
496 return ipf_log_read(&ipfmain, unit, uio);
505 * both of these must operate with at least splnet() lest they be
506 * called during packet processing and cause an inconsistancy to appear in
510 static int ipfwrite(dev, uio, ioflag)
513 static int ipfwrite(dev, uio)
515 #if (__FreeBSD_version >= 502116)
523 if (ipfmain.ipf_running < 1)
526 if (GET_MINOR(dev) == IPL_LOGSYNC)
527 return ipf_sync_write(&ipfmain, uio);