system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-03 08:49:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

pf: convert DIOCNATLOOK to netlink

Browse Source 
Sponsored by:	Rubicon Communications, LLC ("Netgate")
This commit is contained in:
Kristof Provost 2024-05-31 15:51:38 +02:00
parent a9d7ff4e5e
commit 71d3c7041d
6 changed files with 245 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
contrib/pf/ftp-proxy/filter.c
View File

@ -352,27 +352,27 @@ int
server_lookup4(struct sockaddr_in *client, struct sockaddr_in *proxy,
struct sockaddr_in *server)
{
struct pfioc_natlook pnl;
struct pfctl_natlook_key k = {};
struct pfctl_natlook r = {};
memset(&pnl, 0, sizeof pnl);
pnl.direction = PF_OUT;
pnl.af = AF_INET;
pnl.proto = IPPROTO_TCP;
memcpy(&pnl.saddr.v4, &client->sin_addr.s_addr, sizeof pnl.saddr.v4);
memcpy(&pnl.daddr.v4, &proxy->sin_addr.s_addr, sizeof pnl.daddr.v4);
pnl.sport = client->sin_port;
pnl.dport = proxy->sin_port;
if (ioctl(pfctl_fd(pfh), DIOCNATLOOK, &pnl) == -1)
k.direction = PF_OUT;
k.af = AF_INET;
k.proto = IPPROTO_TCP;
memcpy(&k.saddr.v4, &client->sin_addr.s_addr, sizeof(k.saddr.v4));
memcpy(&k.daddr.v4, &proxy->sin_addr.s_addr, sizeof(k.daddr.v4));
k.sport = client->sin_port;
k.dport = proxy->sin_port;
if (pfctl_natlook(pfh, &k, &r))
return (-1);
memset(server, 0, sizeof(struct sockaddr_in));
server->sin_len = sizeof(struct sockaddr_in);
server->sin_family = AF_INET;
memcpy(&server->sin_addr.s_addr, &pnl.rdaddr.v4,
sizeof server->sin_addr.s_addr);
server->sin_port = pnl.rdport;
memcpy(&server->sin_addr.s_addr, &r.daddr.v4,
sizeof(server->sin_addr.s_addr));
server->sin_port = r.dport;
return (0);
}
@ -380,26 +380,26 @@ int
server_lookup6(struct sockaddr_in6 *client, struct sockaddr_in6 *proxy,
struct sockaddr_in6 *server)
{
struct pfioc_natlook pnl;
struct pfctl_natlook_key k = {};
struct pfctl_natlook r = {};
memset(&pnl, 0, sizeof pnl);
pnl.direction = PF_OUT;
pnl.af = AF_INET6;
pnl.proto = IPPROTO_TCP;
memcpy(&pnl.saddr.v6, &client->sin6_addr.s6_addr, sizeof pnl.saddr.v6);
memcpy(&pnl.daddr.v6, &proxy->sin6_addr.s6_addr, sizeof pnl.daddr.v6);
pnl.sport = client->sin6_port;
pnl.dport = proxy->sin6_port;
if (ioctl(pfctl_fd(pfh), DIOCNATLOOK, &pnl) == -1)
k.direction = PF_OUT;
k.af = AF_INET6;
k.proto = IPPROTO_TCP;
memcpy(&k.saddr.v6, &client->sin6_addr.s6_addr, sizeof(k.saddr.v6));
memcpy(&k.daddr.v6, &proxy->sin6_addr.s6_addr, sizeof(k.daddr.v6));
k.sport = client->sin6_port;
k.dport = proxy->sin6_port;
if (pfctl_natlook(pfh, &k, &r))
return (-1);
memset(server, 0, sizeof(struct sockaddr_in6));
server->sin6_len = sizeof(struct sockaddr_in6);
server->sin6_family = AF_INET6;
memcpy(&server->sin6_addr.s6_addr, &pnl.rdaddr.v6,
sizeof server->sin6_addr);
server->sin6_port = pnl.rdport;
memcpy(&server->sin6_addr.s6_addr, &r.daddr.v6,
sizeof(server->sin6_addr));
server->sin6_port = r.dport;
return (0);
}

50
contrib/pf/tftp-proxy/filter.c
View File

@ -363,26 +363,26 @@ int
server_lookup4(struct sockaddr_in *client, struct sockaddr_in *proxy,
struct sockaddr_in *server, u_int8_t proto)
{
struct pfioc_natlook pnl;
struct pfctl_natlook_key k = {};
struct pfctl_natlook r = {};
memset(&pnl, 0, sizeof pnl);
pnl.direction = PF_OUT;
pnl.af = AF_INET;
pnl.proto = proto;
memcpy(&pnl.saddr.v4, &client->sin_addr.s_addr, sizeof pnl.saddr.v4);
memcpy(&pnl.daddr.v4, &proxy->sin_addr.s_addr, sizeof pnl.daddr.v4);
pnl.sport = client->sin_port;
pnl.dport = proxy->sin_port;
k.direction = PF_OUT;
k.af = AF_INET;
k.proto = proto;
memcpy(&k.saddr.v4, &client->sin_addr.s_addr, sizeof(k.saddr.v4));
memcpy(&k.daddr.v4, &proxy->sin_addr.s_addr, sizeof(k.daddr.v4));
k.sport = client->sin_port;
k.dport = proxy->sin_port;
if (ioctl(pfctl_fd(pfh), DIOCNATLOOK, &pnl) == -1)
if (pfctl_natlook(pfh, &k, &r))
return (-1);
memset(server, 0, sizeof(struct sockaddr_in));
server->sin_len = sizeof(struct sockaddr_in);
server->sin_family = AF_INET;
memcpy(&server->sin_addr.s_addr, &pnl.rdaddr.v4,
memcpy(&server->sin_addr.s_addr, &r.daddr.v4,
sizeof server->sin_addr.s_addr);
server->sin_port = pnl.rdport;
server->sin_port = r.dport;
return (0);
}
@ -391,26 +391,26 @@ int
server_lookup6(struct sockaddr_in6 *client, struct sockaddr_in6 *proxy,
struct sockaddr_in6 *server, u_int8_t proto)
{
struct pfioc_natlook pnl;
struct pfctl_natlook_key k = {};
struct pfctl_natlook r = {};
memset(&pnl, 0, sizeof pnl);
pnl.direction = PF_OUT;
pnl.af = AF_INET6;
pnl.proto = proto;
memcpy(&pnl.saddr.v6, &client->sin6_addr.s6_addr, sizeof pnl.saddr.v6);
memcpy(&pnl.daddr.v6, &proxy->sin6_addr.s6_addr, sizeof pnl.daddr.v6);
pnl.sport = client->sin6_port;
pnl.dport = proxy->sin6_port;
if (ioctl(pfctl_fd(pfh), DIOCNATLOOK, &pnl) == -1)
k.direction = PF_OUT;
k.af = AF_INET6;
k.proto = proto;
memcpy(&k.saddr.v6, &client->sin6_addr.s6_addr, sizeof k.saddr.v6);
memcpy(&k.daddr.v6, &proxy->sin6_addr.s6_addr, sizeof k.daddr.v6);
k.sport = client->sin6_port;
k.dport = proxy->sin6_port;
if (pfctl_natlook(pfh, &k, &r))
return (-1);
memset(server, 0, sizeof(struct sockaddr_in6));
server->sin6_len = sizeof(struct sockaddr_in6);
server->sin6_family = AF_INET6;
memcpy(&server->sin6_addr.s6_addr, &pnl.rdaddr.v6,
memcpy(&server->sin6_addr.s6_addr, &r.daddr.v6,
sizeof server->sin6_addr);
server->sin6_port = pnl.rdport;
server->sin6_port = r.dport;
return (0);
}

55
lib/libpfctl/libpfctl.c
View File

@ -2435,3 +2435,58 @@ pfctl_set_statusif(struct pfctl_handle *h, const char *ifname)
return (e.error);
}
#define _IN(_field) offsetof(struct genlmsghdr, _field)
#define _OUT(_field) offsetof(struct pfctl_natlook, _field)
static struct snl_attr_parser ap_natlook[] = {
{ .type = PF_NL_SRC_ADDR, .off = _OUT(saddr), .cb = snl_attr_get_in6_addr },
{ .type = PF_NL_DST_ADDR, .off = _OUT(daddr), .cb = snl_attr_get_in6_addr },
{ .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = snl_attr_get_uint16 },
{ .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = snl_attr_get_uint16 },
};
static struct snl_field_parser fp_natlook[] = {};
#undef _IN
#undef _OUT
SNL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, fp_natlook, ap_natlook);
int
pfctl_natlook(struct pfctl_handle *h, const struct pfctl_natlook_key *k,
struct pfctl_natlook *r)
{
struct snl_writer nw;
struct snl_errmsg_data e = {};
struct nlmsghdr *hdr;
uint32_t seq_id;
int family_id;
family_id = snl_get_genl_family(&h->ss, PFNL_FAMILY_NAME);
if (family_id == 0)
return (ENOTSUP);
snl_init_writer(&h->ss, &nw);
hdr = snl_create_genl_msg_request(&nw, family_id, PFNL_CMD_NATLOOK);
hdr->nlmsg_flags |= NLM_F_DUMP;
snl_add_msg_attr_u8(&nw, PF_NL_AF, k->af);
snl_add_msg_attr_u8(&nw, PF_NL_DIRECTION, k->direction);
snl_add_msg_attr_u8(&nw, PF_NL_PROTO, k->proto);
snl_add_msg_attr_ip6(&nw, PF_NL_SRC_ADDR, &k->saddr.v6);
snl_add_msg_attr_ip6(&nw, PF_NL_DST_ADDR, &k->daddr.v6);
snl_add_msg_attr_u16(&nw, PF_NL_SRC_PORT, k->sport);
snl_add_msg_attr_u16(&nw, PF_NL_DST_PORT, k->dport);
if ((hdr = snl_finalize_msg(&nw)) == NULL)
return (ENXIO);
seq_id = hdr->nlmsg_seq;
if (! snl_send_message(&h->ss, hdr))
return (ENXIO);
while ((hdr = snl_read_reply_multi(&h->ss, seq_id, &e)) != NULL) {
if (! snl_parse_nlmsg(&h->ss, hdr, &natlook_parser, r))
continue;
}
return (e.error);
}

18
lib/libpfctl/libpfctl.h
View File

@ -475,4 +475,22 @@ int pfctl_table_get_addrs(int dev, struct pfr_table *tbl, struct pfr_addr
*addr, int *size, int flags);
int pfctl_set_statusif(struct pfctl_handle *h, const char *ifname);
struct pfctl_natlook_key {
sa_family_t af;
uint8_t direction;
uint8_t proto;
struct pf_addr saddr;
struct pf_addr daddr;
uint16_t sport;
uint16_t dport;
};
struct pfctl_natlook {
struct pf_addr saddr;
struct pf_addr daddr;
uint16_t sport;
uint16_t dport;
};
int pfctl_natlook(struct pfctl_handle *h,
const struct pfctl_natlook_key *k, struct pfctl_natlook *r);
#endif

106
sys/netpfil/pf/pf_nl.c
View File

@ -26,6 +26,9 @@
* SUCH DAMAGE.
*
*/
#include <sys/cdefs.h>
#include "opt_inet.h"
#include "opt_inet6.h"
#include <sys/param.h>
#include <sys/malloc.h>
@ -1222,12 +1225,108 @@ pf_handle_clear_status(struct nlmsghdr *hdr, struct nl_pstate *npt)
return (0);
}
struct pf_nl_natlook {
sa_family_t af;
uint8_t direction;
uint8_t proto;
struct pf_addr src;
struct pf_addr dst;
uint16_t sport;
uint16_t dport;
};
#define _IN(_field) offsetof(struct genlmsghdr, _field)
#define _OUT(_field) offsetof(struct pf_nl_natlook, _field)
static const struct nlattr_parser nla_p_natlook[] = {
{ .type = PF_NL_AF, .off = _OUT(af), .cb = nlattr_get_uint8 },
{ .type = PF_NL_DIRECTION, .off = _OUT(direction), .cb = nlattr_get_uint8 },
{ .type = PF_NL_PROTO, .off = _OUT(proto), .cb = nlattr_get_uint8 },
{ .type = PF_NL_SRC_ADDR, .off = _OUT(src), .cb = nlattr_get_in6_addr },
{ .type = PF_NL_DST_ADDR, .off = _OUT(dst), .cb = nlattr_get_in6_addr },
{ .type = PF_NL_SRC_PORT, .off = _OUT(sport), .cb = nlattr_get_uint16 },
{ .type = PF_NL_DST_PORT, .off = _OUT(dport), .cb = nlattr_get_uint16 },
};
static const struct nlfield_parser nlf_p_natlook[] = {};
#undef _IN
#undef _OUT
NL_DECLARE_PARSER(natlook_parser, struct genlmsghdr, nlf_p_natlook, nla_p_natlook);
static int
pf_handle_natlook(struct nlmsghdr *hdr, struct nl_pstate *npt)
{
struct pf_nl_natlook attrs = {};
struct pf_state_key_cmp key = {};
struct nl_writer *nw = npt->nw;
struct pf_state_key *sk;
struct pf_kstate *state;
struct genlmsghdr *ghdr_new;
int error, m;
int sidx, didx;
error = nl_parse_nlmsg(hdr, &natlook_parser, npt, &attrs);
if (error != 0)
return (error);
if (attrs.proto == 0 ||
PF_AZERO(&attrs.src, attrs.af) ||
PF_AZERO(&attrs.dst, attrs.af) ||
((attrs.proto == IPPROTO_TCP || attrs.proto == IPPROTO_UDP) &&
(attrs.sport == 0 || attrs.dport == 0)))
return (EINVAL);
/* NATLOOK src and dst are reversed, so reverse sidx/didx */
sidx = (attrs.direction == PF_IN) ? 1 : 0;
didx = (attrs.direction == PF_IN) ? 0 : 1;
key.af = attrs.af;
key.proto = attrs.proto;
PF_ACPY(&key.addr[sidx], &attrs.src, attrs.af);
key.port[sidx] = attrs.sport;
PF_ACPY(&key.addr[didx], &attrs.dst, attrs.af);
key.port[didx] = attrs.dport;
state = pf_find_state_all(&key, attrs.direction, &m);
if (state == NULL)
return (ENOENT);
if (m > 1) {
PF_STATE_UNLOCK(state);
return (E2BIG);
}
if (!nlmsg_reply(nw, hdr, sizeof(struct genlmsghdr))) {
PF_STATE_UNLOCK(state);
return (ENOMEM);
}
ghdr_new = nlmsg_reserve_object(nw, struct genlmsghdr);
ghdr_new->cmd = PFNL_CMD_NATLOOK;
ghdr_new->version = 0;
ghdr_new->reserved = 0;
sk = state->key[sidx];
nlattr_add_in6_addr(nw, PF_NL_SRC_ADDR, &sk->addr[sidx].v6);
nlattr_add_in6_addr(nw, PF_NL_DST_ADDR, &sk->addr[didx].v6);
nlattr_add_u16(nw, PF_NL_SRC_PORT, sk->port[sidx]);
nlattr_add_u16(nw, PF_NL_DST_PORT, sk->port[didx]);
PF_STATE_UNLOCK(state);
if (!nlmsg_end(nw)) {
nlmsg_abort(nw);
return (ENOMEM);
}
return (0);
}
static const struct nlhdr_parser *all_parsers[] = {
&state_parser,
&addrule_parser,
&getrules_parser,
&clear_states_parser,
&set_statusif_parser,
&natlook_parser,
};
static int family_id;
@ -1317,6 +1416,13 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
{
.cmd_num = PFNL_CMD_NATLOOK,
.cmd_name = "NATLOOK",
.cmd_cb = pf_handle_natlook,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
},
};
void

12
sys/netpfil/pf/pf_nl.h
View File

@ -48,6 +48,7 @@ enum {
PFNL_CMD_SET_STATUSIF = 10,
PFNL_CMD_GET_STATUS = 11,
PFNL_CMD_CLEAR_STATUS = 12,
PFNL_CMD_NATLOOK = 13,
__PFNL_CMD_MAX,
};
#define PFNL_CMD_MAX (__PFNL_CMD_MAX -1)
@ -316,6 +317,17 @@ enum pf_get_status_types_t {
PF_GS_BCOUNTERS = 16, /* u64 array */
};
enum pf_natlook_types_t {
PF_NL_UNSPEC,
PF_NL_AF = 1, /* u8 */
PF_NL_DIRECTION = 2, /* u8 */
PF_NL_PROTO = 3, /* u8 */
PF_NL_SRC_ADDR = 4, /* in6_addr */
PF_NL_DST_ADDR = 5, /* in6_addr */
PF_NL_SRC_PORT = 6, /* u16 */
PF_NL_DST_PORT = 7, /* u16 */
};
#ifdef _KERNEL
void pf_nl_register(void);