Print this page 
OS-7667 IPFilter needs to keep and report state for cloud firewall logging
Portions contributed by: Mike Gerdts <mike.gerdts@joyent.com>
Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/inet/ipf/ip_state.c
          +++ new/usr/src/uts/common/inet/ipf/ip_state.c
   1    1  /*
   2    2   * Copyright (C) 1995-2003 by Darren Reed.
   3    3   *
   4    4   * See the IPFILTER.LICENCE file for details on licencing.
   5    5   *
   6    6   * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
   7    7   *
   8      - * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
        8 + * Copyright 2019 Joyent, Inc.
   9    9   */
  10   10  
  11   11  #if defined(KERNEL) || defined(_KERNEL)
  12   12  # undef KERNEL
  13   13  # undef _KERNEL
  14   14  # define        KERNEL  1
  15   15  # define        _KERNEL 1
  16   16  #endif
  17   17  #include <sys/errno.h>
  18   18  #include <sys/types.h>
↓ open down ↓ 82 lines elided ↑ open up ↑ 
 101  101  #ifdef  USE_INET6
 102  102  #include <netinet/icmp6.h>
 103  103  #endif
 104  104  #if (__FreeBSD_version >= 300000)
 105  105  # include <sys/malloc.h>
 106  106  # if defined(_KERNEL) && !defined(IPFILTER_LKM)
 107  107  #  include <sys/libkern.h>
 108  108  #  include <sys/systm.h>
 109  109  # endif
 110  110  #endif
      111 +#include <sys/uuid.h>
 111  112  /* END OF INCLUDES */
 112  113  
 113  114  
 114  115  #if !defined(lint)
 115  116  static const char sccsid[] = "@(#)ip_state.c    1.8 6/5/96 (C) 1993-2000 Darren Reed";
 116  117  static const char rcsid[] = "@(#)$Id: ip_state.c,v 2.186.2.36 2005/08/11 19:58:03 darrenr Exp $";
 117  118  #endif
 118  119  
 119  120  #ifdef  USE_INET6
 120  121  static ipstate_t *fr_checkicmp6matchingstate __P((fr_info_t *));
↓ open down ↓ 1317 lines elided ↑ open up ↑ 
1438 1439                                                 fr->fr_age[0], ifs);
1439 1440                          is->is_sti.tqe_flags |= TQE_RULEBASED;
1440 1441                  }
1441 1442                  if (fr->fr_age[1] != 0) {
1442 1443                          is->is_tqehead[1] = 
1443 1444                              fr_addtimeoutqueue(&ifs->ifs_ips_utqe,
1444 1445                                                 fr->fr_age[1], ifs);
1445 1446                          is->is_sti.tqe_flags |= TQE_RULEBASED;
1446 1447                  }
1447 1448                  is->is_tag = fr->fr_logtag;
     1449 +                memcpy(is->is_uuid, fr->fr_uuid, sizeof (uuid_t));
1448 1450  
1449 1451                  is->is_ifp[(out << 1) + 1] = fr->fr_ifas[1];
1450 1452                  is->is_ifp[(1 - out) << 1] = fr->fr_ifas[2];
1451 1453                  is->is_ifp[((1 - out) << 1) + 1] = fr->fr_ifas[3];
1452 1454  
1453 1455                  if (((ifp = fr->fr_ifas[1]) != NULL) &&
1454 1456                      (ifp != (void *)-1)) {
1455 1457                          COPYIFNAME(ifp, is->is_ifname[(out << 1) + 1], fr->fr_v);
1456 1458                  }
1457 1459                  if (((ifp = fr->fr_ifas[2]) != NULL) &&
↓ open down ↓ 59 lines elided ↑ open up ↑ 
1517 1519          } else {
1518 1520                  MUTEX_EXIT(&is->is_lock);
1519 1521          }
1520 1522  #ifdef  IPFILTER_SYNC
1521 1523          if ((is->is_flags & IS_STATESYNC) && ((is->is_flags & SI_CLONE) == 0))
1522 1524                  is->is_sync = ipfsync_new(SMC_STATE, fin, is);
1523 1525  #endif
1524 1526          if (ifs->ifs_ipstate_logging)
1525 1527                  ipstate_log(is, ISL_NEW, ifs);
1526 1528  
     1529 +        if (IFS_CFWLOG(ifs, is->is_rule))
     1530 +                ipf_log_cfwlog(is, ISL_NEW, ifs);
     1531 +
1527 1532          RWLOCK_EXIT(&ifs->ifs_ipf_state);
1528 1533          fin->fin_rev = IP6_NEQ(&is->is_dst, &fin->fin_daddr);
1529 1534          fin->fin_flx |= FI_STATE;
1530 1535          if (fin->fin_flx & FI_FRAG)
1531 1536                  (void) fr_newfrag(fin, pass ^ FR_KEEPSTATE);
1532 1537  
1533 1538          return is;
1534 1539  }
1535 1540  
1536 1541
↓ open down ↓ 770 lines elided ↑ open up ↑ 
2307 2312                                  is->is_dend = ntohl(tcp->th_ack);
2308 2313                          } else {
2309 2314                                  is->is_dport = sp;
2310 2315                                  is->is_dend = ntohl(tcp->th_seq);
2311 2316                          }
2312 2317                          is->is_maxdend = is->is_dend + 1;
2313 2318                  }
2314 2319                  is->is_flags &= ~(SI_W_SPORT|SI_W_DPORT);
2315 2320                  if ((flags & SI_CLONED) && ifs->ifs_ipstate_logging)
2316 2321                          ipstate_log(is, ISL_CLONE, ifs);
     2322 +                if ((flags & SI_CLONED) && IFS_CFWLOG(ifs, is->is_rule))
     2323 +                        ipf_log_cfwlog(is, ISL_CLONE, ifs);
2317 2324          }
2318 2325  
2319 2326          ret = -1;
2320 2327  
2321 2328          if (is->is_flx[out][rev] == 0) {
2322 2329                  is->is_flx[out][rev] = flx;
2323 2330                  /*
2324 2331                   * If we are dealing with the first packet coming in reverse
2325 2332                   * direction (sent by peer), then we have to set options into
2326 2333                   * state.
↓ open down ↓ 1063 lines elided ↑ open up ↑ 
3390 3397                  *is->is_pnext = is->is_next;
3391 3398                  if (is->is_next != NULL) {
3392 3399                          is->is_next->is_pnext = is->is_pnext;
3393 3400                          is->is_next = NULL;
3394 3401                  }
3395 3402                  is->is_pnext = NULL;
3396 3403          }
3397 3404   
3398 3405          if (ifs->ifs_ipstate_logging != 0 && why != 0)
3399 3406                  ipstate_log(is, why, ifs);
3400      -
     3407 +#if 0
     3408 +        /*
     3409 +         * For now, ipf_log_cfwlog() copes with all "why" values. Strictly
     3410 +         * speaking, though, they all map to one event (CFWEV_END), which for
     3411 +         * now is not supported, hence the #if 0.
     3412 +         */
     3413 +        if (why != 0 && IFS_CFWLOG(ifs, is->is_rule))
     3414 +                ipf_log_cfwlog(is, why, ifs);
     3415 +#endif
3401 3416          if (is->is_rule != NULL) {
3402 3417                  is->is_rule->fr_statecnt--;
3403 3418                  (void)fr_derefrule(&is->is_rule, ifs);
3404 3419          }
3405 3420  
3406 3421          MUTEX_DESTROY(&is->is_lock);
3407 3422          KFREE(is);
3408 3423          ifs->ifs_ips_num--;
3409 3424  
3410 3425          return (0);
↓ open down ↓ 513 lines elided ↑ open up ↑ 
3924 3939                   */
3925 3940                  DTRACE_PROBE1(state_done, int, nstate);
3926 3941  
3927 3942                  if ((tqe->tqe_flags & TQE_RULEBASED) == 0)
3928 3943                          fr_movequeue(tqe, tqe->tqe_ifq, tqtab + nstate, ifs);
3929 3944          }
3930 3945  
3931 3946          return rval;
3932 3947  }
3933 3948  
3934      -
3935 3949  /* ------------------------------------------------------------------------ */
3936 3950  /* Function:    ipstate_log                                                 */
3937 3951  /* Returns:     Nil                                                         */
3938 3952  /* Parameters:  is(I)   - pointer to state structure                        */
3939 3953  /*              type(I) - type of log entry to create                       */
3940 3954  /*                                                                          */
3941 3955  /* Creates a state table log entry using the state structure and type info. */
3942 3956  /* passed in.  Log packet/byte counts, source/destination address and other */
3943 3957  /* protocol specific information.                                           */
3944 3958  /* ------------------------------------------------------------------------ */
↓ open down ↓ 502 lines elided ↑ open up ↑ 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX