4 * Copyright (C) 2012 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
10 * 29/12/94 Added code from Marc Huber <huber@fzi.de> to allow it to allocate
11 * its own major char number! Way cool patch!
15 #include <sys/param.h>
18 * Post NetBSD 1.2 has the PFIL interface for packet filters. This turns
19 * on those hooks. We don't need any special mods with this!
21 #if (defined(NetBSD) && (NetBSD > 199609) && (NetBSD <= 1991011)) || \
22 (defined(NetBSD1_2) && NetBSD1_2 > 1)
26 #include <sys/systm.h>
32 #include <sys/kernel.h>
33 #include <sys/vnode.h>
34 #include <sys/namei.h>
35 #include <sys/malloc.h>
36 #include <sys/mount.h>
40 #include <netinet/in_systm.h>
41 #include <netinet/in.h>
42 #include <netinet/ip.h>
43 #include <net/route.h>
44 #include <netinet/ip_var.h>
45 #include <netinet/tcp.h>
46 #include <netinet/tcpip.h>
49 #include <sys/select.h>
51 #include "ip_compat.h"
58 #if !defined(__NetBSD_Version__) || __NetBSD_Version__ < 103050000
59 #define vn_lock(v,f) VOP_LOCK(v)
62 #if !defined(VOP_LEASE) && defined(LEASE_CHECK)
63 #define VOP_LEASE LEASE_CHECK
67 extern int lkmenodev __P((void));
70 int ipflkm_lkmentry __P((struct lkm_table *, int, int));
72 int xxxinit __P((struct lkm_table *, int, int));
74 static int ipf_unload __P((void));
75 static int ipf_load __P((void));
76 static int ipf_remove __P((void));
77 static int ipfaction __P((struct lkm_table *, int));
78 static char *ipf_devfiles[] = { IPL_NAME, IPNAT_NAME, IPSTATE_NAME,
79 IPAUTH_NAME, IPSYNC_NAME, IPSCAN_NAME,
80 IPLOOKUP_NAME, NULL };
83 extern ipf_main_softc_t ipfmain;
84 extern const struct cdevsw ipl_cdevsw;
86 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 106080000)
87 MOD_DEV(IPL_VERSION, "ipf", NULL, -1, &ipl_cdevsw, -1);
89 MOD_DEV(IPL_VERSION, LM_DT_CHAR, -1, &ipldevsw);
92 extern int vd_unuseddev __P((void));
93 extern struct cdevsw cdevsw[];
99 ipflkm_lkmentry(lkmtp, cmd, ver)
101 xxxinit(lkmtp, cmd, ver)
103 struct lkm_table *lkmtp;
106 DISPATCH(lkmtp, cmd, ver, ipfaction, ipfaction, ipfaction);
111 ipfaction(lkmtp, cmd)
112 struct lkm_table *lkmtp;
115 #if !defined(__NetBSD__) || (__NetBSD_Version__ < 106080000)
118 struct lkm_dev *args = lkmtp->private.lkm_dev;
124 if (lkmexists(lkmtp))
127 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 106080000)
128 # if (__NetBSD_Version__ < 200000000)
129 err = devsw_attach(args->lkm_devname,
130 args->lkm_bdev, &args->lkm_bdevmaj,
131 args->lkm_cdev, &args->lkm_cdevmaj);
135 ipf_major = args->lkm_cdevmaj;
137 for (i = 0; i < nchrdev; i++)
138 if (cdevsw[i].d_open == (dev_type_open((*)))lkmenodev ||
139 cdevsw[i].d_open == ipfopen)
142 printf("IP Filter: No free cdevsw slots\n");
147 args->lkm_offset = i; /* slot in cdevsw[] */
149 printf("IP Filter: loaded into slot %d\n", ipf_major);
152 #if defined(__NetBSD__) && (__NetBSD_Version__ >= 106080000)
153 devsw_detach(args->lkm_bdev, args->lkm_cdev);
154 args->lkm_bdevmaj = -1;
155 args->lkm_cdevmaj = -1;
159 printf("IP Filter: unloaded from slot %d\n",
179 for (i = 0; (name = ipf_devfiles[i]); i++) {
180 #if (__NetBSD_Version__ > 106009999)
181 # if (__NetBSD_Version__ > 399001400)
182 # if (__NetBSD_Version__ > 499001400)
183 NDINIT(&nd, DELETE, LOCKPARENT|LOCKLEAF, UIO_SYSSPACE,
186 NDINIT(&nd, DELETE, LOCKPARENT|LOCKLEAF, UIO_SYSSPACE,
190 NDINIT(&nd, DELETE, LOCKPARENT|LOCKLEAF, UIO_SYSSPACE,
194 NDINIT(&nd, DELETE, LOCKPARENT, UIO_SYSSPACE, name, curproc);
196 if ((error = namei(&nd)))
198 #if (__NetBSD_Version__ > 399001400)
199 # if (__NetBSD_Version__ > 399002000)
200 # if (__NetBSD_Version__ < 499001400)
201 VOP_LEASE(nd.ni_dvp, curlwp, curlwp->l_cred, LEASE_WRITE);
204 VOP_LEASE(nd.ni_dvp, curlwp, curlwp->l_proc->p_ucred, LEASE_WRITE);
207 VOP_LEASE(nd.ni_dvp, curproc, curproc->p_ucred, LEASE_WRITE);
209 #if !defined(__NetBSD_Version__) || (__NetBSD_Version__ < 106000000)
210 vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
212 #if (__NetBSD_Version__ >= 399002000)
213 # if (__NetBSD_Version__ < 499001400)
214 VOP_LEASE(nd.ni_vp, curlwp, curlwp->l_cred, LEASE_WRITE);
217 # if (__NetBSD_Version__ > 399001400)
218 VOP_LEASE(nd.ni_vp, curlwp, curlwp->l_proc->p_ucred, LEASE_WRITE);
220 VOP_LEASE(nd.ni_vp, curproc, curproc->p_ucred, LEASE_WRITE);
223 (void) VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
235 * Unloading - remove the filter rule check from the IP
236 * input/output stream.
238 if (ipfmain.ipf_refcnt)
240 else if (ipfmain.ipf_running >= 0) {
241 error = ipfdetach(&ipfmain);
243 ipf_destroy_all(&ipfmain);
249 ipfmain.ipf_running = -2;
250 error = ipf_remove();
251 printf("%s unloaded\n", ipfilter_version);
262 int error = 0, fmode = S_IFCHR|0600, i;
266 * XXX Remove existing device nodes prior to creating new ones
267 * XXX using the assigned LKM device slot's major number. In a
268 * XXX perfect world we could use the ones specified by cdevsw[].
272 bzero((char *)&ipfmain, sizeof(ipfmain));
273 error = ipf_load_all();
276 if (ipf_create_all(&ipfmain) == NULL) {
281 error = ipfattach(&ipfmain);
287 for (i = 0; (error == 0) && (name = ipf_devfiles[i]); i++) {
288 #if (__NetBSD_Version__ > 399001400)
289 # if (__NetBSD_Version__ > 499001400)
290 NDINIT(&nd, CREATE, LOCKPARENT, UIO_SYSSPACE, name);
292 NDINIT(&nd, CREATE, LOCKPARENT, UIO_SYSSPACE, name, curlwp);
295 NDINIT(&nd, CREATE, LOCKPARENT, UIO_SYSSPACE, name, curproc);
297 if ((error = namei(&nd)))
299 if (nd.ni_vp != NULL) {
300 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
301 if (nd.ni_dvp == nd.ni_vp)
310 vattr.va_type = VCHR;
311 vattr.va_mode = (fmode & 07777);
312 vattr.va_rdev = (ipf_major << 8) | i;
313 #if (__NetBSD_Version__ > 399001400)
314 # if (__NetBSD_Version__ >= 399002000)
315 # if (__NetBSD_Version__ < 499001400)
316 VOP_LEASE(nd.ni_dvp, curlwp, curlwp->l_cred, LEASE_WRITE);
319 VOP_LEASE(nd.ni_dvp, curlwp, curlwp->l_proc->p_ucred, LEASE_WRITE);
322 VOP_LEASE(nd.ni_dvp, curproc, curproc->p_ucred, LEASE_WRITE);
324 error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
332 if (FR_ISPASS(ipfmain.ipf_pass))
334 else if (FR_ISBLOCK(ipfmain.ipf_pass))
337 defpass = "no-match -> block";
339 printf("%s initialized. Default = %s all, Logging = %s%s\n",
340 ipfilter_version, defpass,
346 #ifdef IPFILTER_COMPILED
352 ipfmain.ipf_running = 1;