Author: ae
Date: Wed Nov 25 07:31:59 2015
New Revision: 291292
URL: https://svnweb.freebsd.org/changeset/base/291292
Log:
Overhaul if_enc(4) and make it loadable in run-time.
Use hhook(9) framework to achieve ability of loading and unloading
if_enc(4) kernel module. INET and INET6 code on initialization registers
two helper hooks points in the kernel. if_enc(4) module uses these helper
hook points and registers its hooks. IPSEC code uses these hhook points
to call helper hooks implemented in if_enc(4).
Added:
head/sys/modules/if_enc/
head/sys/modules/if_enc/Makefile (contents, props changed)
Modified:
head/sys/conf/files
head/sys/conf/options
head/sys/modules/Makefile
head/sys/net/if.c
head/sys/net/if_enc.c
head/sys/net/if_enc.h
head/sys/net/if_var.h
head/sys/netinet/ip_input.c
head/sys/netinet6/ip6_input.c
head/sys/netipsec/ipsec.c
head/sys/netipsec/ipsec.h
head/sys/netipsec/ipsec_input.c
head/sys/netipsec/ipsec_output.c
head/sys/sys/hhook.h
Modified: head/sys/conf/files
==============================================================================
--- head/sys/conf/files Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/conf/files Wed Nov 25 07:31:59 2015 (r291292)
@@ -3466,7 +3466,7 @@ net/if_dead.c standard
net/if_debug.c optional ddb
net/if_disc.c optional disc
net/if_edsc.c optional edsc
-net/if_enc.c optional enc ipsec inet | enc ipsec inet6
+net/if_enc.c optional enc inet | enc inet6
net/if_epair.c optional epair
net/if_ethersubr.c optional ether
net/if_fddisubr.c optional fddi
Modified: head/sys/conf/options
==============================================================================
--- head/sys/conf/options Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/conf/options Wed Nov 25 07:31:59 2015 (r291292)
@@ -707,7 +707,6 @@ ISAPNP opt_isa.h
# various 'device presence' options.
DEV_BPF opt_bpf.h
DEV_CARP opt_carp.h
-DEV_ENC opt_enc.h
DEV_MCA opt_mca.h
DEV_NETMAP opt_global.h
DEV_PCI opt_pci.h
Modified: head/sys/modules/Makefile
==============================================================================
--- head/sys/modules/Makefile Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/modules/Makefile Wed Nov 25 07:31:59 2015 (r291292)
@@ -142,6 +142,7 @@ SUBDIR= \
if_bridge \
if_disc \
if_edsc \
+ ${_if_enc} \
if_epair \
${_if_gif} \
${_if_gre} \
@@ -429,6 +430,7 @@ SUBDIR+= cuse
defined(ALL_MODULES)
_carp= carp
_toecore= toecore
+_if_enc= if_enc
_if_gif= if_gif
_if_gre= if_gre
.endif
Added: head/sys/modules/if_enc/Makefile
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/sys/modules/if_enc/Makefile Wed Nov 25 07:31:59 2015
(r291292)
@@ -0,0 +1,11 @@
+# $FreeBSD$
+
+SYSDIR?=${.CURDIR}/../..
+.include "${SYSDIR}/conf/kern.opts.mk"
+
+.PATH: ${SYSDIR}/net
+
+KMOD= if_enc
+SRCS= if_enc.c opt_inet.h opt_inet6.h
+
+.include <bsd.kmod.mk>
Modified: head/sys/net/if.c
==============================================================================
--- head/sys/net/if.c Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/net/if.c Wed Nov 25 07:31:59 2015 (r291292)
@@ -183,6 +183,10 @@ static void if_detach_internal(struct if
extern void nd6_setmtu(struct ifnet *);
#endif
+/* ipsec helper hooks */
+VNET_DEFINE(struct hhook_head *, ipsec_hhh_in[HHOOK_IPSEC_COUNT]);
+VNET_DEFINE(struct hhook_head *, ipsec_hhh_out[HHOOK_IPSEC_COUNT]);
+
VNET_DEFINE(int, if_index);
int ifqmaxlen = IFQ_MAXLEN;
VNET_DEFINE(struct ifnethead, ifnet); /* depend on static init XXX */
Modified: head/sys/net/if_enc.c
==============================================================================
--- head/sys/net/if_enc.c Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/net/if_enc.c Wed Nov 25 07:31:59 2015 (r291292)
@@ -1,5 +1,6 @@
/*-
* Copyright (c) 2006 The FreeBSD Project.
+ * Copyright (c) 2015 Andrey V. Elsukov <a...@freebsd.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -79,56 +80,67 @@ struct enchdr {
u_int32_t spi;
u_int32_t flags;
};
-
-struct ifnet *encif;
-static struct mtx enc_mtx;
-
struct enc_softc {
struct ifnet *sc_ifp;
};
+static VNET_DEFINE(struct enc_softc *, enc_sc);
+#define V_enc_sc VNET(enc_sc)
+static VNET_DEFINE(struct if_clone *, enc_cloner);
+#define V_enc_cloner VNET(enc_cloner)
static int enc_ioctl(struct ifnet *, u_long, caddr_t);
-static int enc_output(struct ifnet *ifp, struct mbuf *m,
- const struct sockaddr *dst, struct route *ro);
+static int enc_output(struct ifnet *, struct mbuf *,
+ const struct sockaddr *, struct route *);
static int enc_clone_create(struct if_clone *, int, caddr_t);
static void enc_clone_destroy(struct ifnet *);
-static struct if_clone *enc_cloner;
-static const char encname[] = "enc";
+static int enc_add_hhooks(struct enc_softc *);
+static void enc_remove_hhooks(struct enc_softc *);
-/*
- * Sysctls.
- */
+static const char encname[] = "enc";
/*
* Before and after are relative to when we are stripping the
* outer IP header.
*/
-static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
+static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
+#define V_filter_mask_in VNET(filter_mask_in)
+#define V_bpf_mask_in VNET(bpf_mask_in)
+#define V_filter_mask_out VNET(filter_mask_out)
+#define V_bpf_mask_out VNET(bpf_mask_out)
+static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
-static int ipsec_filter_mask_in = ENC_BEFORE;
-SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
- &ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
-static int ipsec_bpf_mask_in = ENC_BEFORE;
-SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
- &ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
-
static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output
sysctl");
-static int ipsec_filter_mask_out = ENC_BEFORE;
-SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
- &ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
-static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
-SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
- &ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
+SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
+ CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
+ "IPsec input firewall filter mask");
+SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
+ CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
+ "IPsec input bpf mask");
+SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
+ CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
+ "IPsec output firewall filter mask");
+SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
+ CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
+ "IPsec output bpf mask");
static void
enc_clone_destroy(struct ifnet *ifp)
{
- KASSERT(ifp != encif, ("%s: destroying encif", __func__));
+ struct enc_softc *sc;
+ sc = ifp->if_softc;
+ KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
+
+ enc_remove_hhooks(sc);
bpfdetach(ifp);
if_detach(ifp);
if_free(ifp);
+ free(sc, M_DEVBUF);
+ V_enc_sc = NULL;
}
static int
@@ -137,234 +149,255 @@ enc_clone_create(struct if_clone *ifc, i
struct ifnet *ifp;
struct enc_softc *sc;
- sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
+ sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
+ M_WAITOK | M_ZERO);
ifp = sc->sc_ifp = if_alloc(IFT_ENC);
if (ifp == NULL) {
free(sc, M_DEVBUF);
return (ENOSPC);
}
-
+ if (V_enc_sc != NULL) {
+ if_free(ifp);
+ free(sc, M_DEVBUF);
+ return (EEXIST);
+ }
+ V_enc_sc = sc;
if_initname(ifp, encname, unit);
ifp->if_mtu = ENCMTU;
ifp->if_ioctl = enc_ioctl;
ifp->if_output = enc_output;
- ifp->if_snd.ifq_maxlen = ifqmaxlen;
ifp->if_softc = sc;
if_attach(ifp);
bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
-
- mtx_lock(&enc_mtx);
- /* grab a pointer to enc0, ignore the rest */
- if (encif == NULL)
- encif = ifp;
- mtx_unlock(&enc_mtx);
-
- return (0);
-}
-
-static int
-enc_modevent(module_t mod, int type, void *data)
-{
- switch (type) {
- case MOD_LOAD:
- mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
- enc_cloner = if_clone_simple(encname, enc_clone_create,
- enc_clone_destroy, 1);
- break;
- case MOD_UNLOAD:
- printf("enc module unload - not possible for this module\n");
- return (EINVAL);
- default:
- return (EOPNOTSUPP);
+ if (enc_add_hhooks(sc) != 0) {
+ enc_clone_destroy(ifp);
+ return (ENXIO);
}
return (0);
}
-static moduledata_t enc_mod = {
- "if_enc",
- enc_modevent,
- 0
-};
-
-DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
-
static int
enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
struct route *ro)
{
+
m_freem(m);
return (0);
}
-/*
- * Process an ioctl request.
- */
-/* ARGSUSED */
static int
enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
{
- int error = 0;
-
- mtx_lock(&enc_mtx);
-
- switch (cmd) {
-
- case SIOCSIFFLAGS:
- if (ifp->if_flags & IFF_UP)
- ifp->if_drv_flags |= IFF_DRV_RUNNING;
- else
- ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
-
- break;
-
- default:
- error = EINVAL;
- }
- mtx_unlock(&enc_mtx);
- return (error);
+ if (cmd != SIOCSIFFLAGS)
+ return (EINVAL);
+ if (ifp->if_flags & IFF_UP)
+ ifp->if_drv_flags |= IFF_DRV_RUNNING;
+ else
+ ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+ return (0);
}
-int
-ipsec_filter(struct mbuf **mp, int dir, int flags)
+/*
+ * One helper hook function is used by any hook points.
+ * + from hhook_type we can determine the packet direction:
+ * HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
+ * + from hhook_id we can determine address family: AF_INET or AF_INET6;
+ * + udata contains pointer to enc_softc;
+ * + ctx_data contains pointer to struct ipsec_ctx_data.
+ */
+static int
+enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
+ void *hdata, struct osd *hosd)
{
- int error, i;
- struct ip *ip;
- struct ifnet *rcvif;
-
- KASSERT(encif != NULL, ("%s: encif is null", __func__));
- KASSERT(flags & (ENC_IN|ENC_OUT),
- ("%s: invalid flags: %04x", __func__, flags));
-
- if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
+ struct enchdr hdr;
+ struct ipsec_ctx_data *ctx;
+ struct enc_softc *sc;
+ struct ifnet *ifp, *rcvif;
+ struct pfil_head *ph;
+ int pdir;
+
+ sc = (struct enc_softc *)udata;
+ ifp = sc->sc_ifp;
+ if ((ifp->if_flags & IFF_UP) == 0)
return (0);
- if (flags & ENC_IN) {
- if ((flags & ipsec_filter_mask_in) == 0)
- return (0);
- } else {
- if ((flags & ipsec_filter_mask_out) == 0)
- return (0);
+ ctx = (struct ipsec_ctx_data *)ctx_data;
+ /* XXX: wrong hook point was used by caller? */
+ if (ctx->af != hhook_id)
+ return (EPFNOSUPPORT);
+
+ if (((hhook_type == HHOOK_TYPE_IPSEC_IN &&
+ (ctx->enc & V_bpf_mask_in) != 0) ||
+ (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
+ (ctx->enc & V_bpf_mask_out) != 0)) &&
+ bpf_peers_present(ifp->if_bpf) != 0) {
+ hdr.af = ctx->af;
+ hdr.spi = ctx->sav->spi;
+ hdr.flags = 0;
+ if (ctx->sav->alg_enc != SADB_EALG_NONE)
+ hdr.flags |= M_CONF;
+ if (ctx->sav->alg_auth != SADB_AALG_NONE)
+ hdr.flags |= M_AUTH;
+ bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp);
+ }
+
+ switch (hhook_type) {
+ case HHOOK_TYPE_IPSEC_IN:
+ if (ctx->enc == IPSEC_ENC_BEFORE) {
+ /* Do accounting only once */
+ if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
+ if_inc_counter(ifp, IFCOUNTER_IBYTES,
+ (*ctx->mp)->m_pkthdr.len);
+ }
+ if ((ctx->enc & V_filter_mask_in) == 0)
+ return (0); /* skip pfil processing */
+ pdir = PFIL_IN;
+ break;
+ case HHOOK_TYPE_IPSEC_OUT:
+ if (ctx->enc == IPSEC_ENC_BEFORE) {
+ /* Do accounting only once */
+ if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
+ if_inc_counter(ifp, IFCOUNTER_OBYTES,
+ (*ctx->mp)->m_pkthdr.len);
+ }
+ if ((ctx->enc & V_filter_mask_out) == 0)
+ return (0); /* skip pfil processing */
+ pdir = PFIL_OUT;
+ break;
+ default:
+ return (EINVAL);
}
- /* Skip pfil(9) if no filters are loaded */
- if (1
+ switch (hhook_id) {
#ifdef INET
- && !PFIL_HOOKED(&V_inet_pfil_hook)
+ case AF_INET:
+ ph = &V_inet_pfil_hook;
+ break;
#endif
#ifdef INET6
- && !PFIL_HOOKED(&V_inet6_pfil_hook)
+ case AF_INET6:
+ ph = &V_inet6_pfil_hook;
+ break;
#endif
- ) {
+ default:
+ ph = NULL;
+ }
+ if (ph == NULL || !PFIL_HOOKED(ph))
return (0);
+ /* Make a packet looks like it was received on enc(4) */
+ rcvif = (*ctx->mp)->m_pkthdr.rcvif;
+ (*ctx->mp)->m_pkthdr.rcvif = ifp;
+ if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
+ *ctx->mp == NULL) {
+ *ctx->mp = NULL; /* consumed by filter */
+ return (EACCES);
}
+ (*ctx->mp)->m_pkthdr.rcvif = rcvif;
+ return (0);
+}
- i = min((*mp)->m_pkthdr.len, max_protohdr);
- if ((*mp)->m_len < i) {
- *mp = m_pullup(*mp, i);
- if (*mp == NULL) {
- printf("%s: m_pullup failed\n", __func__);
- return (-1);
- }
- }
+static int
+enc_add_hhooks(struct enc_softc *sc)
+{
+ struct hookinfo hki;
+ int error;
- error = 0;
- rcvif = (*mp)->m_pkthdr.rcvif;
- (*mp)->m_pkthdr.rcvif = encif;
- ip = mtod(*mp, struct ip *);
- switch (ip->ip_v) {
+ error = EPFNOSUPPORT;
+ hki.hook_func = enc_hhook;
+ hki.hook_helper = NULL;
+ hki.hook_udata = sc;
#ifdef INET
- case 4:
- error = pfil_run_hooks(&V_inet_pfil_hook, mp,
- encif, dir, NULL);
- break;
+ hki.hook_id = AF_INET;
+ hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+ error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
+ &hki, HHOOK_WAITOK);
+ if (error != 0)
+ return (error);
+ hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+ error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
+ &hki, HHOOK_WAITOK);
+ if (error != 0)
+ return (error);
#endif
#ifdef INET6
- case 6:
- error = pfil_run_hooks(&V_inet6_pfil_hook, mp,
- encif, dir, NULL);
- break;
-#endif
- default:
- printf("%s: unknown IP version\n", __func__);
- }
-
- /*
- * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
- * then error will be zero but we still want to return an error to our
- * caller so the null mbuf isn't forwarded further.
- */
- if (*mp == NULL && error == 0)
- return (-1); /* Consumed by the filter */
- if (*mp == NULL)
+ hki.hook_id = AF_INET6;
+ hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+ error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
+ &hki, HHOOK_WAITOK);
+ if (error != 0)
return (error);
+ hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+ error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
+ &hki, HHOOK_WAITOK);
if (error != 0)
- goto bad;
-
- (*mp)->m_pkthdr.rcvif = rcvif;
+ return (error);
+#endif
return (error);
+}
-bad:
- m_freem(*mp);
- *mp = NULL;
- return (error);
+static void
+enc_remove_hhooks(struct enc_softc *sc)
+{
+ struct hookinfo hki;
+
+ hki.hook_func = enc_hhook;
+ hki.hook_helper = NULL;
+ hki.hook_udata = sc;
+#ifdef INET
+ hki.hook_id = AF_INET;
+ hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+ hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
+ hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+ hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
+#endif
+#ifdef INET6
+ hki.hook_id = AF_INET6;
+ hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+ hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
+ hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+ hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
+#endif
}
-void
-ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
+static void
+vnet_enc_init(const void *unused __unused)
{
- int mflags;
- struct enchdr hdr;
- KASSERT(encif != NULL, ("%s: encif is null", __func__));
- KASSERT(flags & (ENC_IN|ENC_OUT),
- ("%s: invalid flags: %04x", __func__, flags));
-
- if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
- return;
-
- if (flags & ENC_IN) {
- if ((flags & ipsec_bpf_mask_in) == 0)
- return;
- } else {
- if ((flags & ipsec_bpf_mask_out) == 0)
- return;
- }
+ V_enc_sc = NULL;
+ V_enc_cloner = if_clone_simple(encname, enc_clone_create,
+ enc_clone_destroy, 1);
+}
+VNET_SYSINIT(vnet_enc_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
+ vnet_enc_init, NULL);
- if (bpf_peers_present(encif->if_bpf)) {
- mflags = 0;
- hdr.spi = 0;
- if (!sav) {
- struct m_tag *mtag;
- mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
- if (mtag != NULL) {
- struct tdb_ident *tdbi;
- tdbi = (struct tdb_ident *) (mtag + 1);
- if (tdbi->alg_enc != SADB_EALG_NONE)
- mflags |= M_CONF;
- if (tdbi->alg_auth != SADB_AALG_NONE)
- mflags |= M_AUTH;
- hdr.spi = tdbi->spi;
- }
- } else {
- if (sav->alg_enc != SADB_EALG_NONE)
- mflags |= M_CONF;
- if (sav->alg_auth != SADB_AALG_NONE)
- mflags |= M_AUTH;
- hdr.spi = sav->spi;
- }
+static void
+vnet_enc_uninit(const void *unused __unused)
+{
+
+ if_clone_detach(V_enc_cloner);
+}
+VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
+ vnet_enc_uninit, NULL);
- /*
- * We need to prepend the address family as a four byte
- * field. Cons up a dummy header to pacify bpf. This
- * is safe because bpf will only read from the mbuf
- * (i.e., it won't try to free it or keep a pointer a
- * to it).
- */
- hdr.af = af;
- /* hdr.spi already set above */
- hdr.flags = mflags;
+static int
+enc_modevent(module_t mod, int type, void *data)
+{
- bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
+ switch (type) {
+ case MOD_LOAD:
+ case MOD_UNLOAD:
+ break;
+ default:
+ return (EOPNOTSUPP);
}
+ return (0);
}
+
+static moduledata_t enc_mod = {
+ "if_enc",
+ enc_modevent,
+ 0
+};
+
+DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
Modified: head/sys/net/if_enc.h
==============================================================================
--- head/sys/net/if_enc.h Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/net/if_enc.h Wed Nov 25 07:31:59 2015 (r291292)
@@ -30,6 +30,13 @@
#ifndef _NET_IF_ENC_H
#define _NET_IF_ENC_H
-extern struct ifnet *encif;
+struct ipsec_ctx_data {
+ struct mbuf **mp;
+ struct secasvar *sav;
+ uint8_t af;
+#define IPSEC_ENC_BEFORE 0x01
+#define IPSEC_ENC_AFTER 0x02
+ uint8_t enc;
+};
#endif /* _NET_IF_ENC_H */
Modified: head/sys/net/if_var.h
==============================================================================
--- head/sys/net/if_var.h Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/net/if_var.h Wed Nov 25 07:31:59 2015 (r291292)
@@ -93,6 +93,14 @@ TAILQ_HEAD(ifgrouphead, ifg_group);
#ifdef _KERNEL
VNET_DECLARE(struct pfil_head, link_pfil_hook); /* packet filter hooks
*/
#define V_link_pfil_hook VNET(link_pfil_hook)
+
+#define HHOOK_IPSEC_INET 0
+#define HHOOK_IPSEC_INET6 1
+#define HHOOK_IPSEC_COUNT 2
+VNET_DECLARE(struct hhook_head *, ipsec_hhh_in[HHOOK_IPSEC_COUNT]);
+VNET_DECLARE(struct hhook_head *, ipsec_hhh_out[HHOOK_IPSEC_COUNT]);
+#define V_ipsec_hhh_in VNET(ipsec_hhh_in)
+#define V_ipsec_hhh_out VNET(ipsec_hhh_out)
#endif /* _KERNEL */
typedef enum {
Modified: head/sys/netinet/ip_input.c
==============================================================================
--- head/sys/netinet/ip_input.c Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/netinet/ip_input.c Wed Nov 25 07:31:59 2015 (r291292)
@@ -41,6 +41,7 @@ __FBSDID("$FreeBSD$");
#include <sys/param.h>
#include <sys/systm.h>
+#include <sys/hhook.h>
#include <sys/mbuf.h>
#include <sys/malloc.h>
#include <sys/domain.h>
@@ -318,6 +319,17 @@ ip_init(void)
printf("%s: WARNING: unable to register pfil hook, "
"error %d\n", __func__, i);
+ if (hhook_head_register(HHOOK_TYPE_IPSEC_IN, AF_INET,
+ &V_ipsec_hhh_in[HHOOK_IPSEC_INET],
+ HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0)
+ printf("%s: WARNING: unable to register input helper hook\n",
+ __func__);
+ if (hhook_head_register(HHOOK_TYPE_IPSEC_OUT, AF_INET,
+ &V_ipsec_hhh_out[HHOOK_IPSEC_INET],
+ HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0)
+ printf("%s: WARNING: unable to register output helper hook\n",
+ __func__);
+
/* Skip initialization of globals for non-default instances. */
if (!IS_DEFAULT_VNET(curvnet))
return;
@@ -352,12 +364,24 @@ ip_init(void)
void
ip_destroy(void)
{
- int i;
+ int error;
- if ((i = pfil_head_unregister(&V_inet_pfil_hook)) != 0)
+ if ((error = pfil_head_unregister(&V_inet_pfil_hook)) != 0)
printf("%s: WARNING: unable to unregister pfil hook, "
- "error %d\n", __func__, i);
+ "error %d\n", __func__, error);
+ error = hhook_head_deregister(V_ipsec_hhh_in[HHOOK_IPSEC_INET]);
+ if (error != 0) {
+ printf("%s: WARNING: unable to deregister input helper hook "
+ "type HHOOK_TYPE_IPSEC_IN, id HHOOK_IPSEC_INET: "
+ "error %d returned\n", __func__, error);
+ }
+ error = hhook_head_deregister(V_ipsec_hhh_out[HHOOK_IPSEC_INET]);
+ if (error != 0) {
+ printf("%s: WARNING: unable to deregister output helper hook "
+ "type HHOOK_TYPE_IPSEC_OUT, id HHOOK_IPSEC_INET: "
+ "error %d returned\n", __func__, error);
+ }
/* Cleanup in_ifaddr hash table; should be empty. */
hashdestroy(V_in_ifaddrhashtbl, M_IFADDR, V_in_ifaddrhmask);
Modified: head/sys/netinet6/ip6_input.c
==============================================================================
--- head/sys/netinet6/ip6_input.c Wed Nov 25 07:14:58 2015
(r291291)
+++ head/sys/netinet6/ip6_input.c Wed Nov 25 07:31:59 2015
(r291292)
@@ -72,6 +72,7 @@ __FBSDID("$FreeBSD$");
#include <sys/param.h>
#include <sys/systm.h>
+#include <sys/hhook.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/proc.h>
@@ -201,6 +202,17 @@ ip6_init(void)
printf("%s: WARNING: unable to register pfil hook, "
"error %d\n", __func__, i);
+ if (hhook_head_register(HHOOK_TYPE_IPSEC_IN, AF_INET6,
+ &V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
+ HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0)
+ printf("%s: WARNING: unable to register input helper hook\n",
+ __func__);
+ if (hhook_head_register(HHOOK_TYPE_IPSEC_OUT, AF_INET6,
+ &V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
+ HHOOK_WAITOK | HHOOK_HEADISINVNET) != 0)
+ printf("%s: WARNING: unable to register output helper hook\n",
+ __func__);
+
scope6_init();
addrsel_policy_init();
nd6_init();
@@ -300,11 +312,23 @@ ip6proto_unregister(short ip6proto)
void
ip6_destroy()
{
- int i;
+ int error;
- if ((i = pfil_head_unregister(&V_inet6_pfil_hook)) != 0)
+ if ((error = pfil_head_unregister(&V_inet6_pfil_hook)) != 0)
printf("%s: WARNING: unable to unregister pfil hook, "
- "error %d\n", __func__, i);
+ "error %d\n", __func__, error);
+ error = hhook_head_deregister(V_ipsec_hhh_in[HHOOK_IPSEC_INET6]);
+ if (error != 0) {
+ printf("%s: WARNING: unable to deregister input helper hook "
+ "type HHOOK_TYPE_IPSEC_IN, id HHOOK_IPSEC_INET6: "
+ "error %d returned\n", __func__, error);
+ }
+ error = hhook_head_deregister(V_ipsec_hhh_out[HHOOK_IPSEC_INET6]);
+ if (error != 0) {
+ printf("%s: WARNING: unable to deregister output helper hook "
+ "type HHOOK_TYPE_IPSEC_OUT, id HHOOK_IPSEC_INET6: "
+ "error %d returned\n", __func__, error);
+ }
hashdestroy(V_in6_ifaddrhashtbl, M_IFADDR, V_in6_ifaddrhmask);
nd6_destroy();
callout_drain(&V_in6_tmpaddrtimer_ch);
Modified: head/sys/netipsec/ipsec.c
==============================================================================
--- head/sys/netipsec/ipsec.c Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/netipsec/ipsec.c Wed Nov 25 07:31:59 2015 (r291292)
@@ -48,6 +48,7 @@
#include <sys/socket.h>
#include <sys/socketvar.h>
#include <sys/errno.h>
+#include <sys/hhook.h>
#include <sys/time.h>
#include <sys/kernel.h>
#include <sys/syslog.h>
@@ -55,6 +56,7 @@
#include <sys/proc.h>
#include <net/if.h>
+#include <net/if_enc.h>
#include <net/if_var.h>
#include <net/vnet.h>
@@ -806,6 +808,34 @@ ipsec6_setspidx_ipaddr(struct mbuf *m, s
}
#endif
+int
+ipsec_run_hhooks(struct ipsec_ctx_data *ctx, int type)
+{
+ int idx;
+
+ switch (ctx->af) {
+#ifdef INET
+ case AF_INET:
+ idx = HHOOK_IPSEC_INET;
+ break;
+#endif
+#ifdef INET6
+ case AF_INET6:
+ idx = HHOOK_IPSEC_INET6;
+ break;
+#endif
+ default:
+ return (EPFNOSUPPORT);
+ }
+ if (type == HHOOK_TYPE_IPSEC_IN)
+ HHOOKS_RUN_IF(V_ipsec_hhh_in[idx], ctx, NULL);
+ else
+ HHOOKS_RUN_IF(V_ipsec_hhh_out[idx], ctx, NULL);
+ if (*ctx->mp == NULL)
+ return (EACCES);
+ return (0);
+}
+
static void
ipsec_delpcbpolicy(struct inpcbpolicy *p)
{
Modified: head/sys/netipsec/ipsec.h
==============================================================================
--- head/sys/netipsec/ipsec.h Wed Nov 25 07:14:58 2015 (r291291)
+++ head/sys/netipsec/ipsec.h Wed Nov 25 07:31:59 2015 (r291292)
@@ -258,6 +258,15 @@ struct ipsecstat {
#ifdef _KERNEL
#include <sys/counter.h>
+struct ipsec_ctx_data;
+#define IPSEC_INIT_CTX(_ctx, _mp, _sav, _af, _enc) do { \
+ (_ctx)->mp = (_mp); \
+ (_ctx)->sav = (_sav); \
+ (_ctx)->af = (_af); \
+ (_ctx)->enc = (_enc); \
+} while(0)
+int ipsec_run_hhooks(struct ipsec_ctx_data *ctx, int direction);
+
VNET_DECLARE(int, ipsec_debug);
#define V_ipsec_debug VNET(ipsec_debug)
@@ -352,14 +361,6 @@ extern struct mbuf *m_makespace(struct m
extern caddr_t m_pad(struct mbuf *m, int n);
extern int m_striphdr(struct mbuf *m, int skip, int hlen);
-#ifdef DEV_ENC
-#define ENC_BEFORE 0x0001
-#define ENC_AFTER 0x0002
-#define ENC_IN 0x0100
-#define ENC_OUT 0x0200
-extern int ipsec_filter(struct mbuf **, int, int);
-extern void ipsec_bpf(struct mbuf *, struct secasvar *, int, int);
-#endif
#endif /* _KERNEL */
#ifndef _KERNEL
Modified: head/sys/netipsec/ipsec_input.c
==============================================================================
--- head/sys/netipsec/ipsec_input.c Wed Nov 25 07:14:58 2015
(r291291)
+++ head/sys/netipsec/ipsec_input.c Wed Nov 25 07:31:59 2015
(r291292)
@@ -43,7 +43,6 @@
#include "opt_inet.h"
#include "opt_inet6.h"
#include "opt_ipsec.h"
-#include "opt_enc.h"
#include <sys/param.h>
#include <sys/systm.h>
@@ -53,11 +52,12 @@
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/errno.h>
+#include <sys/hhook.h>
#include <sys/syslog.h>
#include <net/if.h>
#include <net/if_var.h>
-#include <net/pfil.h>
+#include <net/if_enc.h>
#include <net/netisr.h>
#include <net/vnet.h>
@@ -94,10 +94,6 @@
#include <machine/in_cksum.h>
#include <machine/stdarg.h>
-#ifdef DEV_ENC
-#include <net/if_enc.h>
-#endif
-
#define IPSEC_ISTAT(proto, name) do { \
if ((proto) == IPPROTO_ESP) \
@@ -314,6 +310,7 @@ ipsec4_common_input_cb(struct mbuf *m, s
int protoff)
{
char buf[INET6_ADDRSTRLEN];
+ struct ipsec_ctx_data ctx;
int prot, af, sproto, isr_prot;
struct ip *ip;
struct m_tag *mtag;
@@ -368,16 +365,10 @@ ipsec4_common_input_cb(struct mbuf *m, s
}
prot = ip->ip_p;
-#ifdef DEV_ENC
- if_inc_counter(encif, IFCOUNTER_IPACKETS, 1);
- if_inc_counter(encif, IFCOUNTER_IBYTES, m->m_pkthdr.len);
-
- /* Pass the mbuf to enc0 for bpf and pfil. */
- ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_BEFORE);
- if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
- return (error);
+ IPSEC_INIT_CTX(&ctx, &m, sav, AF_INET, IPSEC_ENC_BEFORE);
+ if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
+ goto bad;
ip = mtod(m, struct ip *);
-#endif /* DEV_ENC */
/* IP-in-IP encapsulation */
if (prot == IPPROTO_IPIP &&
@@ -501,32 +492,18 @@ ipsec4_common_input_cb(struct mbuf *m, s
*/
if (saidx->mode == IPSEC_MODE_TRANSPORT)
prot = IPPROTO_IPIP;
-#ifdef DEV_ENC
- /*
- * Pass the mbuf to enc0 for bpf and pfil.
- */
- if (prot == IPPROTO_IPIP)
- ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER);
-#ifdef INET6
- if (prot == IPPROTO_IPV6)
- ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER);
-#endif
-
- if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0)
- return (error);
-#endif /* DEV_ENC */
-
/*
* Re-dispatch via software interrupt.
*/
-
switch (prot) {
case IPPROTO_IPIP:
isr_prot = NETISR_IP;
+ af = AF_INET;
break;
#ifdef INET6
case IPPROTO_IPV6:
isr_prot = NETISR_IPV6;
+ af = AF_INET6;
break;
#endif
default:
@@ -537,6 +514,9 @@ ipsec4_common_input_cb(struct mbuf *m, s
goto bad;
}
+ IPSEC_INIT_CTX(&ctx, &m, sav, af, IPSEC_ENC_AFTER);
+ if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
+ goto bad;
error = netisr_queue_src(isr_prot, (uintptr_t)sav->spi, m);
if (error) {
IPSEC_ISTAT(sproto, qfull);
@@ -611,6 +591,7 @@ ipsec6_common_input_cb(struct mbuf *m, s
int protoff)
{
char buf[INET6_ADDRSTRLEN];
+ struct ipsec_ctx_data ctx;
int prot, af, sproto;
struct ip6_hdr *ip6;
struct m_tag *mtag;
@@ -658,20 +639,13 @@ ipsec6_common_input_cb(struct mbuf *m, s
ip6 = mtod(m, struct ip6_hdr *);
ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
+ IPSEC_INIT_CTX(&ctx, &m, sav, af, IPSEC_ENC_BEFORE);
+ if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
+ goto bad;
/* Save protocol */
m_copydata(m, protoff, 1, &nxt8);
prot = nxt8;
-#ifdef DEV_ENC
- if_inc_counter(encif, IFCOUNTER_IPACKETS, 1);
- if_inc_counter(encif, IFCOUNTER_IBYTES, m->m_pkthdr.len);
-
- /* Pass the mbuf to enc0 for bpf and pfil. */
- ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_BEFORE);
- if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_BEFORE)) != 0)
- return (error);
-#endif /* DEV_ENC */
-
/* IPv6-in-IP encapsulation */
if (prot == IPPROTO_IPV6 &&
saidx->mode != IPSEC_MODE_TRANSPORT) {
@@ -778,20 +752,16 @@ ipsec6_common_input_cb(struct mbuf *m, s
key_sa_recordxfer(sav, m);
-#ifdef DEV_ENC
- /*
- * Pass the mbuf to enc0 for bpf and pfil.
- */
+
#ifdef INET
if (prot == IPPROTO_IPIP)
- ipsec_bpf(m, sav, AF_INET, ENC_IN|ENC_AFTER);
+ af = AF_INET;
+ else
#endif
- if (prot == IPPROTO_IPV6)
- ipsec_bpf(m, sav, AF_INET6, ENC_IN|ENC_AFTER);
-
- if ((error = ipsec_filter(&m, PFIL_IN, ENC_IN|ENC_AFTER)) != 0)
- return (error);
-#endif /* DEV_ENC */
+ af = AF_INET6;
+ IPSEC_INIT_CTX(&ctx, &m, sav, af, IPSEC_ENC_AFTER);
+ if ((error = ipsec_run_hhooks(&ctx, HHOOK_TYPE_IPSEC_IN)) != 0)
+ goto bad;
if (skip == 0) {
/*
* We stripped outer IPv6 header.
Modified: head/sys/netipsec/ipsec_output.c
==============================================================================
--- head/sys/netipsec/ipsec_output.c Wed Nov 25 07:14:58 2015
(r291291)
+++ head/sys/netipsec/ipsec_output.c Wed Nov 25 07:31:59 2015
(r291292)
@@ -32,7 +32,6 @@
#include "opt_inet.h"
*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
