1 /*- 2 * Copyright (c) 2019 Mindaugas Rasiukevicius <rmind at noxt eu> 3 * Copyright (c) 2013 The NetBSD Foundation, Inc. 4 * All rights reserved. 5 * 6 * This code is derived from software contributed to The NetBSD Foundation 7 * by Mindaugas Rasiukevicius. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 19 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 /* 32 * NPF network interface handling. 33 * 34 * NPF uses its own interface IDs (npf-if-id). These IDs start from 1. 35 * Zero is reserved to indicate "no interface" case or an interface of 36 * no interest (i.e. not registered). 37 * 38 * This module provides an interface to primarily handle the following: 39 * 40 * - Bind a symbolic interface name to NPF interface ID. 41 * - Associate NPF interface ID when the network interface is attached. 42 * 43 * When NPF configuration is (re)loaded, each referenced network interface 44 * name is registered with a unique ID. If the network interface is already 45 * attached, then the ID is associated with it immediately; otherwise, IDs 46 * are associated/disassociated on interface events which are monitored 47 * using pfil(9) hooks. 48 * 49 * To avoid race conditions when an active NPF configuration is updated or 50 * interfaces are detached/attached, the interface names are never removed 51 * and therefore IDs are never re-assigned. The only point when interface 52 * names and IDs are cleared is when the configuration is flushed. 53 * 54 * A linear counter is used for IDs. 55 */ 56 57 #ifdef _KERNEL 58 #include <sys/cdefs.h> 59 __KERNEL_RCSID(0, "$NetBSD: npf_if.c,v 1.13 2020/05/30 14:16:56 rmind Exp $"); 60 61 #include <sys/param.h> 62 #include <sys/types.h> 63 #include <sys/kmem.h> 64 #include <net/if.h> 65 #endif 66 67 #include "npf_impl.h" 68 69 typedef struct npf_ifmap { 70 char ifname[IFNAMSIZ + 1]; 71 } npf_ifmap_t; 72 73 #define NPF_IFMAP_NOID (0U) 74 #define NPF_IFMAP_SLOT2ID(npf, slot) ((npf)->ifmap_off + (slot) + 1) 75 #define NPF_IFMAP_ID2SLOT(npf, id) \ 76 ((id) - atomic_load_relaxed(&(npf)->ifmap_off) - 1) 77 78 void 79 npf_ifmap_init(npf_t *npf, const npf_ifops_t *ifops) 80 { 81 const size_t nbytes = sizeof(npf_ifmap_t) * NPF_MAX_IFMAP; 82 83 KASSERT(ifops != NULL); 84 ifops->flush(npf, (void *)(uintptr_t)0); 85 86 mutex_init(&npf->ifmap_lock, MUTEX_DEFAULT, IPL_SOFTNET); 87 npf->ifmap = kmem_zalloc(nbytes, KM_SLEEP); 88 npf->ifmap_cnt = 0; 89 npf->ifmap_off = 0; 90 npf->ifops = ifops; 91 } 92 93 void 94 npf_ifmap_fini(npf_t *npf) 95 { 96 const size_t nbytes = sizeof(npf_ifmap_t) * NPF_MAX_IFMAP; 97 mutex_destroy(&npf->ifmap_lock); 98 kmem_free(npf->ifmap, nbytes); 99 } 100 101 static unsigned 102 npf_ifmap_lookup(npf_t *npf, const char *ifname) 103 { 104 KASSERT(mutex_owned(&npf->ifmap_lock)); 105 106 for (unsigned i = 0; i < npf->ifmap_cnt; i++) { 107 npf_ifmap_t *ifmap = &npf->ifmap[i]; 108 109 if (strcmp(ifmap->ifname, ifname) == 0) { 110 return NPF_IFMAP_SLOT2ID(npf, i); 111 } 112 } 113 return NPF_IFMAP_NOID; 114 } 115 116 /* 117 * npf_ifmap_register: register an interface name; return an assigned 118 * NPF network ID on success (non-zero). 119 * 120 * This routine is mostly called on NPF configuration (re)load for the 121 * interfaces names referenced by the rules. 122 */ 123 unsigned 124 npf_ifmap_register(npf_t *npf, const char *ifname) 125 { 126 npf_ifmap_t *ifmap; 127 unsigned id, i; 128 ifnet_t *ifp; 129 130 mutex_enter(&npf->ifmap_lock); 131 if ((id = npf_ifmap_lookup(npf, ifname)) != NPF_IFMAP_NOID) { 132 goto out; 133 } 134 if (npf->ifmap_cnt == NPF_MAX_IFMAP) { 135 printf("npf_ifmap_new: out of slots; bump NPF_MAX_IFMAP\n"); 136 id = NPF_IFMAP_NOID; 137 goto out; 138 } 139 KASSERT(npf->ifmap_cnt < NPF_MAX_IFMAP); 140 141 /* Allocate a new slot and convert and assign an ID. */ 142 i = npf->ifmap_cnt++; 143 ifmap = &npf->ifmap[i]; 144 strlcpy(ifmap->ifname, ifname, IFNAMSIZ); 145 id = NPF_IFMAP_SLOT2ID(npf, i); 146 147 if ((ifp = npf->ifops->lookup(npf, ifname)) != NULL) { 148 npf->ifops->setmeta(npf, ifp, (void *)(uintptr_t)id); 149 } 150 out: 151 mutex_exit(&npf->ifmap_lock); 152 return id; 153 } 154 155 void 156 npf_ifmap_flush(npf_t *npf) 157 { 158 mutex_enter(&npf->ifmap_lock); 159 npf->ifops->flush(npf, (void *)(uintptr_t)NPF_IFMAP_NOID); 160 for (unsigned i = 0; i < npf->ifmap_cnt; i++) { 161 npf->ifmap[i].ifname[0] = '\0'; 162 } 163 npf->ifmap_cnt = 0; 164 165 /* 166 * Reset the ID counter if reaching the overflow; this is not 167 * realistic, but we maintain correctness. 168 */ 169 if (npf->ifmap_off < (UINT_MAX - NPF_MAX_IFMAP)) { 170 npf->ifmap_off += NPF_MAX_IFMAP; 171 } else { 172 npf->ifmap_off = 0; 173 } 174 mutex_exit(&npf->ifmap_lock); 175 } 176 177 /* 178 * npf_ifmap_getid: get the ID for the given network interface. 179 * 180 * => This routine is typically called from the packet handler when 181 * matching whether the packet is on particular network interface. 182 * 183 * => This routine is lock-free; if the NPF configuration is flushed 184 * while the packet is in-flight, the ID will not match because we 185 * keep the IDs linear. 186 */ 187 unsigned 188 npf_ifmap_getid(npf_t *npf, const ifnet_t *ifp) 189 { 190 const unsigned id = (uintptr_t)npf->ifops->getmeta(npf, ifp); 191 return id; 192 } 193 194 /* 195 * npf_ifmap_copylogname: this function is toxic; it can return garbage 196 * as we don't lock, but it is only used temporarily and only for logging. 197 */ 198 void 199 npf_ifmap_copylogname(npf_t *npf, unsigned id, char *buf, size_t len) 200 { 201 const unsigned i = NPF_IFMAP_ID2SLOT(npf, id); 202 203 membar_consumer(); 204 205 if (id != NPF_IFMAP_NOID && i < NPF_MAX_IFMAP) { 206 /* 207 * Lock-free access is safe as there is an extra byte 208 * with a permanent NUL terminator at the end. 209 */ 210 const npf_ifmap_t *ifmap = &npf->ifmap[i]; 211 strlcpy(buf, ifmap->ifname, MIN(len, IFNAMSIZ)); 212 } else { 213 strlcpy(buf, "???", len); 214 } 215 } 216 217 void 218 npf_ifmap_copyname(npf_t *npf, unsigned id, char *buf, size_t len) 219 { 220 mutex_enter(&npf->ifmap_lock); 221 npf_ifmap_copylogname(npf, id, buf, len); 222 mutex_exit(&npf->ifmap_lock); 223 } 224 225 __dso_public void 226 npfk_ifmap_attach(npf_t *npf, ifnet_t *ifp) 227 { 228 const npf_ifops_t *ifops = npf->ifops; 229 unsigned id; 230 231 mutex_enter(&npf->ifmap_lock); 232 id = npf_ifmap_lookup(npf, ifops->getname(npf, ifp)); 233 ifops->setmeta(npf, ifp, (void *)(uintptr_t)id); 234 mutex_exit(&npf->ifmap_lock); 235 } 236 237 __dso_public void 238 npfk_ifmap_detach(npf_t *npf, ifnet_t *ifp) 239 { 240 /* Diagnostic. */ 241 mutex_enter(&npf->ifmap_lock); 242 npf->ifops->setmeta(npf, ifp, (void *)(uintptr_t)NPF_IFMAP_NOID); 243 mutex_exit(&npf->ifmap_lock); 244 } 245
Indexes created Sat Sep 20 22:09:52 GMT 2025