1 /* 2 * NPF initialisation and handler routines. 3 * 4 * Public Domain. 5 */ 6 7 #ifdef _KERNEL 8 #include <sys/types.h> 9 #include <sys/cprng.h> 10 #include <sys/kmem.h> 11 #include <net/if.h> 12 #include <net/if_types.h> 13 #endif 14 15 #include "npf_impl.h" 16 #include "npf_test.h" 17 18 /* State of the current stream. */ 19 static npf_state_t cstream_state; 20 static void * cstream_ptr; 21 static bool cstream_retval; 22 23 static long (*_random_func)(void); 24 static int (*_pton_func)(int, const char *, void *); 25 static const char * (*_ntop_func)(int, const void *, char *, socklen_t); 26 27 static void npf_state_sample(npf_state_t *, bool); 28 29 static void load_npf_config_ifs(nvlist_t *, bool); 30 31 #ifndef __NetBSD__ 32 /* 33 * Standalone NPF: we define the same struct ifnet members 34 * to reduce the npf_ifops_t implementation differences. 35 */ 36 struct ifnet { 37 char if_xname[32]; 38 void * if_softc; 39 TAILQ_ENTRY(ifnet) if_list; 40 }; 41 #endif 42 43 static TAILQ_HEAD(, ifnet) npftest_ifnet_list = 44 TAILQ_HEAD_INITIALIZER(npftest_ifnet_list); 45 46 static const char * npftest_ifop_getname(npf_t *, ifnet_t *); 47 static ifnet_t * npftest_ifop_lookup(npf_t *, const char *); 48 static void npftest_ifop_flush(npf_t *, void *); 49 static void * npftest_ifop_getmeta(npf_t *, const ifnet_t *); 50 static void npftest_ifop_setmeta(npf_t *, ifnet_t *, void *); 51 52 const npf_ifops_t npftest_ifops = { 53 .getname = npftest_ifop_getname, 54 .lookup = npftest_ifop_lookup, 55 .flush = npftest_ifop_flush, 56 .getmeta = npftest_ifop_getmeta, 57 .setmeta = npftest_ifop_setmeta, 58 }; 59 60 void 61 npf_test_init(int (*pton_func)(int, const char *, void *), 62 const char *(*ntop_func)(int, const void *, char *, socklen_t), 63 long (*rndfunc)(void)) 64 { 65 npf_t *npf; 66 67 #ifdef __NetBSD__ 68 // XXX: Workaround for npf_init() 69 if ((npf = npf_getkernctx()) != NULL) { 70 npf_worker_discharge(npf); 71 npf_worker_sysfini(); 72 } 73 #endif 74 npf = npfk_create(0, &npftest_mbufops, &npftest_ifops, NULL); 75 npfk_thread_register(npf); 76 77 npf_setkernctx(npf); 78 79 npf_state_setsampler(npf_state_sample); 80 _pton_func = pton_func; 81 _ntop_func = ntop_func; 82 _random_func = rndfunc; 83 84 (void)npf_test_addif(IFNAME_DUMMY, false, false); 85 } 86 87 void 88 npf_test_fini(const char *config) 89 { 90 npf_t *npf = npf_getkernctx(); 91 92 if (config) { 93 int ret = npf_config_read_enter(npf); 94 npf_config_procs_null(npf); 95 npf_config_read_exit(npf, ret); 96 97 ret = npf_ext_log_fini(npf); 98 assert(ret == 0); 99 ret = npf_ext_normalize_fini(npf); 100 assert(ret == 0); 101 ret = npf_ext_route_fini(npf); 102 assert(ret == 0); 103 } 104 105 npfk_thread_unregister(npf); 106 npfk_destroy(npf); 107 } 108 109 int 110 npf_test_load(const void *buf, size_t len, bool verbose) 111 { 112 nvlist_t *npf_dict; 113 npf_error_t error; 114 int ret; 115 116 npf_t* npf = npf_getkernctx(); 117 118 npf_dict = nvlist_unpack(buf, len, 0); 119 if (!npf_dict) { 120 printf("%s: could not unpack the nvlist\n", __func__); 121 return EINVAL; 122 } 123 load_npf_config_ifs(npf_dict, verbose); 124 125 /* register the npf extensions */ 126 ret = npf_ext_log_init(npf); 127 assert(ret == 0); 128 ret = npf_ext_normalize_init(npf); 129 assert(ret == 0); 130 ret = npf_ext_route_init(npf); 131 assert(ret == 0); 132 133 ret = npfk_load(npf, npf_dict, &error); 134 nvlist_destroy(npf_dict); 135 return ret; 136 } 137 138 ifnet_t * 139 npf_test_addif(const char *ifname, bool reg, bool verbose) 140 { 141 npf_t *npf = npf_getkernctx(); 142 ifnet_t *ifp = kmem_zalloc(sizeof(*ifp), KM_SLEEP); 143 144 /* 145 * This is a "fake" interface with explicitly set index. 146 * Note: test modules may not setup pfil(9) hooks and if_attach() 147 * may not trigger npf_ifmap_attach(), so we call it manually. 148 */ 149 strlcpy(ifp->if_xname, ifname, sizeof(ifp->if_xname)); 150 TAILQ_INSERT_TAIL(&npftest_ifnet_list, ifp, if_list); 151 152 npfk_ifmap_attach(npf, ifp); 153 if (reg) { 154 npf_ifmap_register(npf, ifname); 155 } 156 157 if (verbose) { 158 printf("+ Interface %s\n", ifname); 159 } 160 return ifp; 161 } 162 163 ifnet_t * 164 npf_test_getif(const char *ifname) 165 { 166 ifnet_t *ifp; 167 168 TAILQ_FOREACH(ifp, &npftest_ifnet_list, if_list) { 169 if (!strcmp(ifp->if_xname, ifname)) 170 return ifp; 171 } 172 return NULL; 173 } 174 175 static void 176 load_npf_config_ifs(nvlist_t *npf_dict, bool verbose) 177 { 178 const nvlist_t * const *iflist; 179 const nvlist_t *dbg_dict; 180 size_t nitems; 181 182 dbg_dict = dnvlist_get_nvlist(npf_dict, "debug", NULL); 183 if (!dbg_dict) { 184 return; 185 } 186 if (!nvlist_exists_nvlist_array(dbg_dict, "interfaces")) { 187 return; 188 } 189 iflist = nvlist_get_nvlist_array(dbg_dict, "interfaces", &nitems); 190 for (unsigned i = 0; i < nitems; i++) { 191 const nvlist_t *ifdict = iflist[i]; 192 const char *ifname; 193 194 if ((ifname = nvlist_get_string(ifdict, "name")) != NULL) { 195 (void)npf_test_addif(ifname, true, verbose); 196 } 197 } 198 } 199 200 static const char * 201 npftest_ifop_getname(npf_t *npf __unused, ifnet_t *ifp) 202 { 203 return ifp->if_xname; 204 } 205 206 static ifnet_t * 207 npftest_ifop_lookup(npf_t *npf __unused, const char *ifname) 208 { 209 return npf_test_getif(ifname); 210 } 211 212 static void 213 npftest_ifop_flush(npf_t *npf __unused, void *arg) 214 { 215 ifnet_t *ifp; 216 217 TAILQ_FOREACH(ifp, &npftest_ifnet_list, if_list) 218 ifp->if_softc = arg; 219 } 220 221 static void * 222 npftest_ifop_getmeta(npf_t *npf __unused, const ifnet_t *ifp) 223 { 224 return ifp->if_softc; 225 } 226 227 static void 228 npftest_ifop_setmeta(npf_t *npf __unused, ifnet_t *ifp, void *arg) 229 { 230 ifp->if_softc = arg; 231 } 232 233 /* 234 * State sampler - this routine is called from inside of NPF state engine. 235 */ 236 static void 237 npf_state_sample(npf_state_t *nst, bool retval) 238 { 239 /* Pointer will serve as an ID. */ 240 cstream_ptr = nst; 241 memcpy(&cstream_state, nst, sizeof(npf_state_t)); 242 cstream_retval = retval; 243 } 244 245 int 246 npf_test_statetrack(const void *data, size_t len, ifnet_t *ifp, 247 bool forw, int64_t *result) 248 { 249 npf_t *npf = npf_getkernctx(); 250 struct mbuf *m; 251 int i = 0, error; 252 253 m = mbuf_getwithdata(data, len); 254 error = npfk_packet_handler(npf, &m, ifp, forw ? PFIL_OUT : PFIL_IN); 255 if (error) { 256 assert(m == NULL); 257 return error; 258 } 259 assert(m != NULL); 260 m_freem(m); 261 262 const int di = forw ? NPF_FLOW_FORW : NPF_FLOW_BACK; 263 npf_tcpstate_t *fstate = &cstream_state.nst_tcpst[di]; 264 npf_tcpstate_t *tstate = &cstream_state.nst_tcpst[!di]; 265 266 result[i++] = (intptr_t)cstream_ptr; 267 result[i++] = cstream_retval; 268 result[i++] = cstream_state.nst_state; 269 270 result[i++] = fstate->nst_end; 271 result[i++] = fstate->nst_maxend; 272 result[i++] = fstate->nst_maxwin; 273 result[i++] = fstate->nst_wscale; 274 275 result[i++] = tstate->nst_end; 276 result[i++] = tstate->nst_maxend; 277 result[i++] = tstate->nst_maxwin; 278 result[i++] = tstate->nst_wscale; 279 280 return 0; 281 } 282 283 int 284 npf_inet_pton(int af, const char *src, void *dst) 285 { 286 return _pton_func(af, src, dst); 287 } 288 289 const char * 290 npf_inet_ntop(int af, const void *src, char *dst, socklen_t size) 291 { 292 return _ntop_func(af, src, dst, size); 293 } 294 295 #ifdef _KERNEL 296 /* 297 * Need to override cprng_fast32() -- we need deterministic PRNG. 298 */ 299 uint32_t 300 cprng_fast32(void) 301 { 302 return (uint32_t)(_random_func ? _random_func() : random()); 303 } 304 #endif 305
Indexes created Mon Nov 09 00:25:08 UTC 2026