1 files changed, 252 insertions, 206 deletions

diff --git a/freebsd/sys/net/if_enc.c b/freebsd/sys/net/if_enc.c
index 91d34722..d0d065b8 100644
--- a/freebsd/sys/net/if_enc.c
+++ b/freebsd/sys/net/if_enc.c
@@ -2,6 +2,7 @@
 
 /*-
  * Copyright (c) 2006 The FreeBSD Project.
+ * Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -31,10 +32,10 @@
 
 #include <rtems/bsd/local/opt_inet.h>
 #include <rtems/bsd/local/opt_inet6.h>
-#include <rtems/bsd/local/opt_enc.h>
 
 #include <rtems/bsd/sys/param.h>
 #include <sys/systm.h>
+#include <sys/hhook.h>
 #include <sys/kernel.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
@@ -46,6 +47,8 @@
 #include <sys/sysctl.h>
 
 #include <net/if.h>
+#include <net/if_enc.h>
+#include <net/if_var.h>
 #include <net/if_clone.h>
 #include <net/if_types.h>
 #include <net/pfil.h>
@@ -80,56 +83,66 @@ struct enchdr {
 	u_int32_t spi;
 	u_int32_t flags;
 };
-
-struct ifnet	*encif;
-static struct mtx	enc_mtx;
-
 struct enc_softc {
 	struct	ifnet *sc_ifp;
 };
+static VNET_DEFINE(struct enc_softc *, enc_sc);
+#define	V_enc_sc	VNET(enc_sc)
+static VNET_DEFINE(struct if_clone *, enc_cloner);
+#define	V_enc_cloner	VNET(enc_cloner)
 
 static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
-static int	enc_output(struct ifnet *ifp, struct mbuf *m,
-		    struct sockaddr *dst, struct route *ro);
+static int	enc_output(struct ifnet *, struct mbuf *,
+    const struct sockaddr *, struct route *);
 static int	enc_clone_create(struct if_clone *, int, caddr_t);
 static void	enc_clone_destroy(struct ifnet *);
+static int	enc_add_hhooks(struct enc_softc *);
+static void	enc_remove_hhooks(struct enc_softc *);
 
-IFC_SIMPLE_DECLARE(enc, 1);
-
-/*
- * Sysctls.
- */
+static const char encname[] = "enc";
 
 /*
  * Before and after are relative to when we are stripping the
  * outer IP header.
  */
-static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
+static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
+static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
+#define	V_filter_mask_in	VNET(filter_mask_in)
+#define	V_bpf_mask_in		VNET(bpf_mask_in)
+#define	V_filter_mask_out	VNET(filter_mask_out)
+#define	V_bpf_mask_out		VNET(bpf_mask_out)
 
+static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
 static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
-static int ipsec_filter_mask_in = ENC_BEFORE;
-SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
-	&ipsec_filter_mask_in, 0, "IPsec input firewall filter mask");
-static int ipsec_bpf_mask_in = ENC_BEFORE;
-SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
-	&ipsec_bpf_mask_in, 0, "IPsec input bpf mask");
-
 static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
-static int ipsec_filter_mask_out = ENC_BEFORE;
-SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask, CTLFLAG_RW,
-	&ipsec_filter_mask_out, 0, "IPsec output firewall filter mask");
-static int ipsec_bpf_mask_out = ENC_BEFORE|ENC_AFTER;
-SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask, CTLFLAG_RW,
-	&ipsec_bpf_mask_out, 0, "IPsec output bpf mask");
+SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
+    "IPsec input firewall filter mask");
+SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
+    "IPsec input bpf mask");
+SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
+    "IPsec output firewall filter mask");
+SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
+    CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
+    "IPsec output bpf mask");
 
 static void
 enc_clone_destroy(struct ifnet *ifp)
 {
-	KASSERT(ifp != encif, ("%s: destroying encif", __func__));
+	struct enc_softc *sc;
+
+	sc = ifp->if_softc;
+	KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
 
 	bpfdetach(ifp);
 	if_detach(ifp);
 	if_free(ifp);
+	free(sc, M_DEVBUF);
+	V_enc_sc = NULL;
 }
 
 static int
@@ -138,244 +151,277 @@ enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 	struct ifnet *ifp;
 	struct enc_softc *sc;
 
-	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
+	sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
+	    M_WAITOK | M_ZERO);
 	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
 	if (ifp == NULL) {
 		free(sc, M_DEVBUF);
 		return (ENOSPC);
 	}
-
-	if_initname(ifp, ifc->ifc_name, unit);
+	if (V_enc_sc != NULL) {
+		if_free(ifp);
+		free(sc, M_DEVBUF);
+		return (EEXIST);
+	}
+	V_enc_sc = sc;
+	if_initname(ifp, encname, unit);
 	ifp->if_mtu = ENCMTU;
 	ifp->if_ioctl = enc_ioctl;
 	ifp->if_output = enc_output;
-	ifp->if_snd.ifq_maxlen = ifqmaxlen;
 	ifp->if_softc = sc;
 	if_attach(ifp);
 	bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
-
-	mtx_lock(&enc_mtx);
-	/* grab a pointer to enc0, ignore the rest */
-	if (encif == NULL)
-		encif = ifp;
-	mtx_unlock(&enc_mtx);
-
 	return (0);
 }
 
 static int
-enc_modevent(module_t mod, int type, void *data)
+enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
+    struct route *ro)
 {
-	switch (type) {
-	case MOD_LOAD:
-		mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
-		if_clone_attach(&enc_cloner);
-		break;
-	case MOD_UNLOAD:
-		printf("enc module unload - not possible for this module\n");
-		return (EINVAL);
-	default:
-		return (EOPNOTSUPP);
-	}
+
+	m_freem(m);
 	return (0);
 }
 
-static moduledata_t enc_mod = {
-	"if_enc",
-	enc_modevent,
-	0
-};
-
-DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
-
 static int
-enc_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
-    struct route *ro)
+enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 {
-	m_freem(m);
+
+	if (cmd != SIOCSIFFLAGS)
+		return (EINVAL);
+	if (ifp->if_flags & IFF_UP)
+		ifp->if_drv_flags |= IFF_DRV_RUNNING;
+	else
+		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 	return (0);
 }
 
 /*
- * Process an ioctl request.
+ * One helper hook function is used by any hook points.
+ * + from hhook_type we can determine the packet direction:
+ *   HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
+ * + from hhook_id we can determine address family: AF_INET or AF_INET6;
+ * + udata contains pointer to enc_softc;
+ * + ctx_data contains pointer to struct ipsec_ctx_data.
  */
-/* ARGSUSED */
 static int
-enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
+    void *hdata, struct osd *hosd)
 {
-	int error = 0;
-
-	mtx_lock(&enc_mtx);
+	struct enchdr hdr;
+	struct ipsec_ctx_data *ctx;
+	struct enc_softc *sc;
+	struct ifnet *ifp, *rcvif;
+	struct pfil_head *ph;
+	int pdir;
 
-	switch (cmd) {
+	sc = (struct enc_softc *)udata;
+	ifp = sc->sc_ifp;
+	if ((ifp->if_flags & IFF_UP) == 0)
+		return (0);
 
-	case SIOCSIFFLAGS:
-		if (ifp->if_flags & IFF_UP)
-			ifp->if_drv_flags |= IFF_DRV_RUNNING;
-		else
-			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+	ctx = (struct ipsec_ctx_data *)ctx_data;
+	/* XXX: wrong hook point was used by caller? */
+	if (ctx->af != hhook_id)
+		return (EPFNOSUPPORT);
+
+	if (((hhook_type == HHOOK_TYPE_IPSEC_IN &&
+	    (ctx->enc & V_bpf_mask_in) != 0) ||
+	    (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
+	    (ctx->enc & V_bpf_mask_out) != 0)) &&
+	    bpf_peers_present(ifp->if_bpf) != 0) {
+		hdr.af = ctx->af;
+		hdr.spi = ctx->sav->spi;
+		hdr.flags = 0;
+		if (ctx->sav->alg_enc != SADB_EALG_NONE)
+			hdr.flags |= M_CONF;
+		if (ctx->sav->alg_auth != SADB_AALG_NONE)
+			hdr.flags |= M_AUTH;
+		bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp);
+	}
 
+	switch (hhook_type) {
+	case HHOOK_TYPE_IPSEC_IN:
+		if (ctx->enc == IPSEC_ENC_BEFORE) {
+			/* Do accounting only once */
+			if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
+			if_inc_counter(ifp, IFCOUNTER_IBYTES,
+			    (*ctx->mp)->m_pkthdr.len);
+		}
+		if ((ctx->enc & V_filter_mask_in) == 0)
+			return (0); /* skip pfil processing */
+		pdir = PFIL_IN;
+		break;
+	case HHOOK_TYPE_IPSEC_OUT:
+		if (ctx->enc == IPSEC_ENC_BEFORE) {
+			/* Do accounting only once */
+			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
+			if_inc_counter(ifp, IFCOUNTER_OBYTES,
+			    (*ctx->mp)->m_pkthdr.len);
+		}
+		if ((ctx->enc & V_filter_mask_out) == 0)
+			return (0); /* skip pfil processing */
+		pdir = PFIL_OUT;
 		break;
-
 	default:
-		error = EINVAL;
+		return (EINVAL);
 	}
 
-	mtx_unlock(&enc_mtx);
-	return (error);
+	switch (hhook_id) {
+#ifdef INET
+	case AF_INET:
+		ph = &V_inet_pfil_hook;
+		break;
+#endif
+#ifdef INET6
+	case AF_INET6:
+		ph = &V_inet6_pfil_hook;
+		break;
+#endif
+	default:
+		ph = NULL;
+	}
+	if (ph == NULL || !PFIL_HOOKED(ph))
+		return (0);
+	/* Make a packet looks like it was received on enc(4) */
+	rcvif = (*ctx->mp)->m_pkthdr.rcvif;
+	(*ctx->mp)->m_pkthdr.rcvif = ifp;
+	if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
+	    *ctx->mp == NULL) {
+		*ctx->mp = NULL; /* consumed by filter */
+		return (EACCES);
+	}
+	(*ctx->mp)->m_pkthdr.rcvif = rcvif;
+	return (0);
 }
 
-int
-ipsec_filter(struct mbuf **mp, int dir, int flags)
+static int
+enc_add_hhooks(struct enc_softc *sc)
 {
-	int error, i;
-	struct ip *ip;
-
-	KASSERT(encif != NULL, ("%s: encif is null", __func__));
-	KASSERT(flags & (ENC_IN|ENC_OUT),
-		("%s: invalid flags: %04x", __func__, flags));
-
-	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
-		return (0);
+	struct hookinfo hki;
+	int error;
 
-	if (flags & ENC_IN) {
-		if ((flags & ipsec_filter_mask_in) == 0)
-			return (0);
-	} else {
-		if ((flags & ipsec_filter_mask_out) == 0)
-			return (0);
-	}
-
-	/* Skip pfil(9) if no filters are loaded */
-	if (1
+	error = EPFNOSUPPORT;
+	hki.hook_func = enc_hhook;
+	hki.hook_helper = NULL;
+	hki.hook_udata = sc;
 #ifdef INET
-	    && !PFIL_HOOKED(&V_inet_pfil_hook)
+	hki.hook_id = AF_INET;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
+	    &hki, HHOOK_WAITOK);
+	if (error != 0)
+		return (error);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
+	    &hki, HHOOK_WAITOK);
+	if (error != 0)
+		return (error);
 #endif
 #ifdef INET6
-	    && !PFIL_HOOKED(&V_inet6_pfil_hook)
+	hki.hook_id = AF_INET6;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
+	    &hki, HHOOK_WAITOK);
+	if (error != 0)
+		return (error);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
+	    &hki, HHOOK_WAITOK);
+	if (error != 0)
+		return (error);
 #endif
-	    ) {
-		return (0);
-	}
+	return (error);
+}
 
-	i = min((*mp)->m_pkthdr.len, max_protohdr);
-	if ((*mp)->m_len < i) {
-		*mp = m_pullup(*mp, i);
-		if (*mp == NULL) {
-			printf("%s: m_pullup failed\n", __func__);
-			return (-1);
-		}
-	}
+static void
+enc_remove_hhooks(struct enc_softc *sc)
+{
+	struct hookinfo hki;
 
-	error = 0;
-	ip = mtod(*mp, struct ip *);
-	switch (ip->ip_v) {
+	hki.hook_func = enc_hhook;
+	hki.hook_helper = NULL;
+	hki.hook_udata = sc;
 #ifdef INET
-		case 4:
-			/*
-			 * before calling the firewall, swap fields the same as
-			 * IP does. here we assume the header is contiguous
-			 */
-			ip->ip_len = ntohs(ip->ip_len);
-			ip->ip_off = ntohs(ip->ip_off);
-
-			error = pfil_run_hooks(&V_inet_pfil_hook, mp,
-			    encif, dir, NULL);
-
-			if (*mp == NULL || error != 0)
-				break;
-
-			/* restore byte ordering */
-			ip = mtod(*mp, struct ip *);
-			ip->ip_len = htons(ip->ip_len);
-			ip->ip_off = htons(ip->ip_off);
-			break;
+	hki.hook_id = AF_INET;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
 #endif
 #ifdef INET6
-		case 6:
-			error = pfil_run_hooks(&V_inet6_pfil_hook, mp,
-			    encif, dir, NULL);
-			break;
+	hki.hook_id = AF_INET6;
+	hki.hook_type = HHOOK_TYPE_IPSEC_IN;
+	hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
+	hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
+	hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
 #endif
-		default:
-			printf("%s: unknown IP version\n", __func__);
-	}
+}
 
-	/*
-	 * If the mbuf was consumed by the filter for requeueing (dummynet, etc)
-	 * then error will be zero but we still want to return an error to our
-	 * caller so the null mbuf isn't forwarded further.
-	 */
-	if (*mp == NULL && error == 0)
-		return (-1);	/* Consumed by the filter */
-	if (*mp == NULL)
-		return (error);
-	if (error != 0)
-		goto bad;
+static void
+vnet_enc_init(const void *unused __unused)
+{
 
-	return (error);
+	V_enc_sc = NULL;
+	V_enc_cloner = if_clone_simple(encname, enc_clone_create,
+	    enc_clone_destroy, 1);
+}
+VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
+    vnet_enc_init, NULL);
 
-bad:
-	m_freem(*mp);
-	*mp = NULL;
-	return (error);
+static void
+vnet_enc_init_proto(void *unused __unused)
+{
+	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
+
+	if (enc_add_hhooks(V_enc_sc) != 0)
+		enc_clone_destroy(V_enc_sc->sc_ifp);
 }
+VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
+    vnet_enc_init_proto, NULL);
 
-void
-ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af, int flags)
+static void
+vnet_enc_uninit(const void *unused __unused)
 {
-	int mflags;
-	struct enchdr hdr;
+	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
 
-	KASSERT(encif != NULL, ("%s: encif is null", __func__));
-	KASSERT(flags & (ENC_IN|ENC_OUT),
-		("%s: invalid flags: %04x", __func__, flags));
+	if_clone_detach(V_enc_cloner);
+}
+VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
+    vnet_enc_uninit, NULL);
 
-	if ((encif->if_drv_flags & IFF_DRV_RUNNING) == 0)
-		return;
+/*
+ * The hhook consumer needs to go before ip[6]_destroy are called on
+ * SI_ORDER_THIRD.
+ */
+static void
+vnet_enc_uninit_hhook(const void *unused __unused)
+{
+	KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
 
-	if (flags & ENC_IN) {
-		if ((flags & ipsec_bpf_mask_in) == 0)
-			return;
-	} else {
-		if ((flags & ipsec_bpf_mask_out) == 0)
-			return;
-	}
+	enc_remove_hhooks(V_enc_sc);
+}
+VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
+    vnet_enc_uninit_hhook, NULL);
 
-	if (bpf_peers_present(encif->if_bpf)) {
-		mflags = 0;
-		hdr.spi = 0;
-		if (!sav) {
-			struct m_tag *mtag;
-			mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
-			if (mtag != NULL) {
-				struct tdb_ident *tdbi;
-				tdbi = (struct tdb_ident *) (mtag + 1);
-				if (tdbi->alg_enc != SADB_EALG_NONE)
-					mflags |= M_CONF;
-				if (tdbi->alg_auth != SADB_AALG_NONE)
-					mflags |= M_AUTH;
-				hdr.spi = tdbi->spi;
-			}
-		} else {
-			if (sav->alg_enc != SADB_EALG_NONE)
-				mflags |= M_CONF;
-			if (sav->alg_auth != SADB_AALG_NONE)
-				mflags |= M_AUTH;
-			hdr.spi = sav->spi;
-		}
+static int
+enc_modevent(module_t mod, int type, void *data)
+{
 
-		/*
-		 * We need to prepend the address family as a four byte
-		 * field.  Cons up a dummy header to pacify bpf.  This
-		 * is safe because bpf will only read from the mbuf
-		 * (i.e., it won't try to free it or keep a pointer a
-		 * to it).
-		 */
-		hdr.af = af;
-		/* hdr.spi already set above */
-		hdr.flags = mflags;
-
-		bpf_mtap2(encif->if_bpf, &hdr, sizeof(hdr), m);
+	switch (type) {
+	case MOD_LOAD:
+	case MOD_UNLOAD:
+		break;
+	default:
+		return (EOPNOTSUPP);
 	}
+	return (0);
 }
+
+static moduledata_t enc_mod = {
+	"if_enc",
+	enc_modevent,
+	0
+};
+
+DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);