Home | History | Annotate | Line # | Download | only in npf
npf.c revision 1.10 
      1 /*	$NetBSD: npf.c,v 1.10 2012/03/13 18:40:59 elad Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * NPF main: dynamic load/initialisation and unload routines.
     34  */
     35 
     36 #include <sys/cdefs.h>
     37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.10 2012/03/13 18:40:59 elad Exp $");
     38 
     39 #include <sys/param.h>
     40 #include <sys/types.h>
     41 
     42 #include <sys/atomic.h>
     43 #include <sys/conf.h>
     44 #include <sys/kauth.h>
     45 #include <sys/kmem.h>
     46 #include <sys/lwp.h>
     47 #include <sys/module.h>
     48 #include <sys/percpu.h>
     49 #include <sys/rwlock.h>
     50 #include <sys/socketvar.h>
     51 #include <sys/uio.h>
     52 
     53 #include "npf_impl.h"
     54 
     55 /*
     56  * Module and device structures.
     57  */
     58 MODULE(MODULE_CLASS_DRIVER, npf, NULL);
     59 
     60 void		npfattach(int);
     61 
     62 static int	npf_fini(void);
     63 static int	npf_dev_open(dev_t, int, int, lwp_t *);
     64 static int	npf_dev_close(dev_t, int, int, lwp_t *);
     65 static int	npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
     66 static int	npf_dev_poll(dev_t, int, lwp_t *);
     67 static int	npf_dev_read(dev_t, struct uio *, int);
     68 
     69 typedef struct {
     70 	npf_ruleset_t *		n_rules;
     71 	npf_tableset_t *	n_tables;
     72 	npf_ruleset_t *		n_nat_rules;
     73 	prop_dictionary_t	n_dict;
     74 	bool			n_default_pass;
     75 } npf_core_t;
     76 
     77 static void	npf_core_destroy(npf_core_t *);
     78 static int	npfctl_stats(void *);
     79 
     80 static krwlock_t		npf_lock		__cacheline_aligned;
     81 static npf_core_t *		npf_core		__cacheline_aligned;
     82 static percpu_t *		npf_stats_percpu	__read_mostly;
     83 
     84 const struct cdevsw npf_cdevsw = {
     85 	npf_dev_open, npf_dev_close, npf_dev_read, nowrite, npf_dev_ioctl,
     86 	nostop, notty, npf_dev_poll, nommap, nokqfilter, D_OTHER | D_MPSAFE
     87 };
     88 
     89 static int
     90 npf_init(void)
     91 {
     92 #ifdef _MODULE
     93 	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
     94 #endif
     95 	npf_ruleset_t *rset, *nset;
     96 	npf_tableset_t *tset;
     97 	prop_dictionary_t dict;
     98 	int error = 0;
     99 
    100 	rw_init(&npf_lock);
    101 	npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE);
    102 	npf_tableset_sysinit();
    103 	npf_session_sysinit();
    104 	npf_nat_sysinit();
    105 	npf_alg_sysinit();
    106 	npflogattach(1);
    107 
    108 	/* Load empty configuration. */
    109 	dict = prop_dictionary_create();
    110 	rset = npf_ruleset_create();
    111 	tset = npf_tableset_create();
    112 	nset = npf_ruleset_create();
    113 	npf_reload(dict, rset, tset, nset, true);
    114 	KASSERT(npf_core != NULL);
    115 
    116 #ifdef _MODULE
    117 	/* Attach /dev/npf device. */
    118 	error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
    119 	if (error) {
    120 		/* It will call devsw_detach(), which is safe. */
    121 		(void)npf_fini();
    122 	}
    123 #endif
    124 	return error;
    125 }
    126 
    127 static int
    128 npf_fini(void)
    129 {
    130 
    131 	/* At first, detach device and remove pfil hooks. */
    132 #ifdef _MODULE
    133 	devsw_detach(NULL, &npf_cdevsw);
    134 #endif
    135 	npflogdetach();
    136 	npf_pfil_unregister();
    137 
    138 	/* Flush all sessions, destroy configuration (ruleset, etc). */
    139 	npf_session_tracking(false);
    140 	npf_core_destroy(npf_core);
    141 
    142 	/* Finally, safe to destroy the subsystems. */
    143 	npf_alg_sysfini();
    144 	npf_nat_sysfini();
    145 	npf_session_sysfini();
    146 	npf_tableset_sysfini();
    147 	percpu_free(npf_stats_percpu, NPF_STATS_SIZE);
    148 	rw_destroy(&npf_lock);
    149 
    150 	return 0;
    151 }
    152 
    153 /*
    154  * Module interface.
    155  */
    156 static int
    157 npf_modcmd(modcmd_t cmd, void *arg)
    158 {
    159 
    160 	switch (cmd) {
    161 	case MODULE_CMD_INIT:
    162 		return npf_init();
    163 	case MODULE_CMD_FINI:
    164 		return npf_fini();
    165 	default:
    166 		return ENOTTY;
    167 	}
    168 	return 0;
    169 }
    170 
    171 void
    172 npfattach(int nunits)
    173 {
    174 
    175 	/* Void. */
    176 }
    177 
    178 static int
    179 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
    180 {
    181 
    182 	/* Available only for super-user. */
    183 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    184 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    185 		return EPERM;
    186 	}
    187 	return 0;
    188 }
    189 
    190 static int
    191 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
    192 {
    193 
    194 	return 0;
    195 }
    196 
    197 static int
    198 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
    199 {
    200 	int error;
    201 
    202 	/* Available only for super-user. */
    203 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    204 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    205 		return EPERM;
    206 	}
    207 
    208 	switch (cmd) {
    209 	case IOC_NPF_VERSION:
    210 		*(int *)data = NPF_VERSION;
    211 		error = 0;
    212 		break;
    213 	case IOC_NPF_SWITCH:
    214 		error = npfctl_switch(data);
    215 		break;
    216 	case IOC_NPF_RELOAD:
    217 		error = npfctl_reload(cmd, data);
    218 		break;
    219 	case IOC_NPF_GETCONF:
    220 		error = npfctl_getconf(cmd, data);
    221 		break;
    222 	case IOC_NPF_TABLE:
    223 		error = npfctl_table(data);
    224 		break;
    225 	case IOC_NPF_STATS:
    226 		error = npfctl_stats(data);
    227 		break;
    228 	case IOC_NPF_SESSIONS_SAVE:
    229 		error = npfctl_sessions_save(cmd, data);
    230 		break;
    231 	case IOC_NPF_SESSIONS_LOAD:
    232 		error = npfctl_sessions_load(cmd, data);
    233 		break;
    234 	case IOC_NPF_UPDATE_RULE:
    235 		error = npfctl_update_rule(cmd, data);
    236 		break;
    237 	default:
    238 		error = ENOTTY;
    239 		break;
    240 	}
    241 	return error;
    242 }
    243 
    244 static int
    245 npf_dev_poll(dev_t dev, int events, lwp_t *l)
    246 {
    247 
    248 	return ENOTSUP;
    249 }
    250 
    251 static int
    252 npf_dev_read(dev_t dev, struct uio *uio, int flag)
    253 {
    254 
    255 	return ENOTSUP;
    256 }
    257 
    258 /*
    259  * NPF core loading/reloading/unloading mechanism.
    260  */
    261 
    262 static void
    263 npf_core_destroy(npf_core_t *nc)
    264 {
    265 
    266 	prop_object_release(nc->n_dict);
    267 	npf_ruleset_destroy(nc->n_rules);
    268 	npf_ruleset_destroy(nc->n_nat_rules);
    269 	npf_tableset_destroy(nc->n_tables);
    270 	kmem_free(nc, sizeof(npf_core_t));
    271 }
    272 
    273 /*
    274  * npf_reload: atomically load new ruleset, tableset and NAT policies.
    275  * Then destroy old (unloaded) structures.
    276  */
    277 void
    278 npf_reload(prop_dictionary_t dict, npf_ruleset_t *rset,
    279     npf_tableset_t *tset, npf_ruleset_t *nset, bool flush)
    280 {
    281 	npf_core_t *nc, *onc;
    282 
    283 	/* Setup a new core structure. */
    284 	nc = kmem_zalloc(sizeof(npf_core_t), KM_SLEEP);
    285 	nc->n_rules = rset;
    286 	nc->n_tables = tset;
    287 	nc->n_nat_rules = nset;
    288 	nc->n_dict = dict;
    289 	nc->n_default_pass = flush;
    290 
    291 	/* Lock and load the core structure. */
    292 	rw_enter(&npf_lock, RW_WRITER);
    293 	onc = atomic_swap_ptr(&npf_core, nc);
    294 	if (onc) {
    295 		/* Reload only necessary NAT policies. */
    296 		npf_ruleset_natreload(nset, onc->n_nat_rules);
    297 	}
    298 	/* Unlock.  Everything goes "live" now. */
    299 	rw_exit(&npf_lock);
    300 
    301 	if (onc) {
    302 		/* Destroy unloaded structures. */
    303 		npf_core_destroy(onc);
    304 	}
    305 }
    306 
    307 void
    308 npf_core_enter(void)
    309 {
    310 	rw_enter(&npf_lock, RW_READER);
    311 }
    312 
    313 npf_ruleset_t *
    314 npf_core_ruleset(void)
    315 {
    316 	KASSERT(rw_lock_held(&npf_lock));
    317 	return npf_core->n_rules;
    318 }
    319 
    320 npf_ruleset_t *
    321 npf_core_natset(void)
    322 {
    323 	KASSERT(rw_lock_held(&npf_lock));
    324 	return npf_core->n_nat_rules;
    325 }
    326 
    327 npf_tableset_t *
    328 npf_core_tableset(void)
    329 {
    330 	KASSERT(rw_lock_held(&npf_lock));
    331 	return npf_core->n_tables;
    332 }
    333 
    334 void
    335 npf_core_exit(void)
    336 {
    337 	rw_exit(&npf_lock);
    338 }
    339 
    340 bool
    341 npf_core_locked(void)
    342 {
    343 	return rw_lock_held(&npf_lock);
    344 }
    345 
    346 prop_dictionary_t
    347 npf_core_dict(void)
    348 {
    349 	KASSERT(rw_lock_held(&npf_lock));
    350 	return npf_core->n_dict;
    351 }
    352 
    353 bool
    354 npf_default_pass(void)
    355 {
    356 	KASSERT(rw_lock_held(&npf_lock));
    357 	return npf_core->n_default_pass;
    358 }
    359 
    360 /*
    361  * NPF statistics interface.
    362  */
    363 
    364 void
    365 npf_stats_inc(npf_stats_t st)
    366 {
    367 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    368 	stats[st]++;
    369 	percpu_putref(npf_stats_percpu);
    370 }
    371 
    372 void
    373 npf_stats_dec(npf_stats_t st)
    374 {
    375 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    376 	stats[st]--;
    377 	percpu_putref(npf_stats_percpu);
    378 }
    379 
    380 static void
    381 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci)
    382 {
    383 	uint64_t *percpu_stats = mem, *full_stats = arg;
    384 	int i;
    385 
    386 	for (i = 0; i < NPF_STATS_COUNT; i++) {
    387 		full_stats[i] += percpu_stats[i];
    388 	}
    389 }
    390 
    391 /*
    392  * npfctl_stats: export collected statistics.
    393  */
    394 static int
    395 npfctl_stats(void *data)
    396 {
    397 	uint64_t *fullst, *uptr = *(uint64_t **)data;
    398 	int error;
    399 
    400 	fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP);
    401 	percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst);
    402 	error = copyout(fullst, uptr, NPF_STATS_SIZE);
    403 	kmem_free(fullst, NPF_STATS_SIZE);
    404 	return error;
    405 }
    406