npf.c revision 1.12.2.1
1 /* $NetBSD: npf.c,v 1.12.2.1 2012/11/20 03:02:47 tls Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF main: dynamic load/initialisation and unload routines. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.12.2.1 2012/11/20 03:02:47 tls Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/atomic.h> 43 #include <sys/conf.h> 44 #include <sys/kauth.h> 45 #include <sys/kmem.h> 46 #include <sys/lwp.h> 47 #include <sys/module.h> 48 #include <sys/percpu.h> 49 #include <sys/rwlock.h> 50 #include <sys/socketvar.h> 51 #include <sys/sysctl.h> 52 #include <sys/uio.h> 53 54 #include "npf_impl.h" 55 56 /* 57 * Module and device structures. 58 */ 59 MODULE(MODULE_CLASS_DRIVER, npf, NULL); 60 61 void npfattach(int); 62 63 static int npf_fini(void); 64 static int npf_dev_open(dev_t, int, int, lwp_t *); 65 static int npf_dev_close(dev_t, int, int, lwp_t *); 66 static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *); 67 static int npf_dev_poll(dev_t, int, lwp_t *); 68 static int npf_dev_read(dev_t, struct uio *, int); 69 70 typedef struct { 71 npf_ruleset_t * n_rules; 72 npf_tableset_t * n_tables; 73 npf_ruleset_t * n_nat_rules; 74 prop_dictionary_t n_dict; 75 bool n_default_pass; 76 } npf_core_t; 77 78 static void npf_core_destroy(npf_core_t *); 79 static int npfctl_stats(void *); 80 81 static krwlock_t npf_lock __cacheline_aligned; 82 static npf_core_t * npf_core __cacheline_aligned; 83 static percpu_t * npf_stats_percpu __read_mostly; 84 static struct sysctllog * npf_sysctl __read_mostly; 85 86 const struct cdevsw npf_cdevsw = { 87 npf_dev_open, npf_dev_close, npf_dev_read, nowrite, npf_dev_ioctl, 88 nostop, notty, npf_dev_poll, nommap, nokqfilter, D_OTHER | D_MPSAFE 89 }; 90 91 static int 92 npf_init(void) 93 { 94 #ifdef _MODULE 95 devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR; 96 #endif 97 npf_ruleset_t *rset, *nset; 98 npf_tableset_t *tset; 99 prop_dictionary_t dict; 100 int error = 0; 101 102 rw_init(&npf_lock); 103 npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE); 104 npf_sysctl = NULL; 105 106 npf_tableset_sysinit(); 107 npf_session_sysinit(); 108 npf_nat_sysinit(); 109 npf_alg_sysinit(); 110 npf_ext_sysinit(); 111 112 /* Load empty configuration. */ 113 dict = prop_dictionary_create(); 114 rset = npf_ruleset_create(); 115 tset = npf_tableset_create(); 116 nset = npf_ruleset_create(); 117 npf_reload(dict, rset, tset, nset, true); 118 KASSERT(npf_core != NULL); 119 120 #ifdef _MODULE 121 /* Attach /dev/npf device. */ 122 error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor); 123 if (error) { 124 /* It will call devsw_detach(), which is safe. */ 125 (void)npf_fini(); 126 } 127 #endif 128 return error; 129 } 130 131 static int 132 npf_fini(void) 133 { 134 135 /* At first, detach device and remove pfil hooks. */ 136 #ifdef _MODULE 137 devsw_detach(NULL, &npf_cdevsw); 138 #endif 139 npf_pfil_unregister(); 140 141 /* Flush all sessions, destroy configuration (ruleset, etc). */ 142 npf_session_tracking(false); 143 npf_core_destroy(npf_core); 144 145 /* Finally, safe to destroy the subsystems. */ 146 npf_ext_sysfini(); 147 npf_alg_sysfini(); 148 npf_nat_sysfini(); 149 npf_session_sysfini(); 150 npf_tableset_sysfini(); 151 152 if (npf_sysctl) { 153 sysctl_teardown(&npf_sysctl); 154 } 155 percpu_free(npf_stats_percpu, NPF_STATS_SIZE); 156 rw_destroy(&npf_lock); 157 158 return 0; 159 } 160 161 /* 162 * Module interface. 163 */ 164 static int 165 npf_modcmd(modcmd_t cmd, void *arg) 166 { 167 168 switch (cmd) { 169 case MODULE_CMD_INIT: 170 return npf_init(); 171 case MODULE_CMD_FINI: 172 return npf_fini(); 173 case MODULE_CMD_AUTOUNLOAD: 174 if (npf_autounload_p()) { 175 return EBUSY; 176 } 177 break; 178 default: 179 return ENOTTY; 180 } 181 return 0; 182 } 183 184 void 185 npfattach(int nunits) 186 { 187 188 /* Void. */ 189 } 190 191 static int 192 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l) 193 { 194 195 /* Available only for super-user. */ 196 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 197 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 198 return EPERM; 199 } 200 return 0; 201 } 202 203 static int 204 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l) 205 { 206 207 return 0; 208 } 209 210 static int 211 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l) 212 { 213 int error; 214 215 /* Available only for super-user. */ 216 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 217 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 218 return EPERM; 219 } 220 221 switch (cmd) { 222 case IOC_NPF_VERSION: 223 *(int *)data = NPF_VERSION; 224 error = 0; 225 break; 226 case IOC_NPF_SWITCH: 227 error = npfctl_switch(data); 228 break; 229 case IOC_NPF_RELOAD: 230 error = npfctl_reload(cmd, data); 231 break; 232 case IOC_NPF_GETCONF: 233 error = npfctl_getconf(cmd, data); 234 break; 235 case IOC_NPF_TABLE: 236 error = npfctl_table(data); 237 break; 238 case IOC_NPF_STATS: 239 error = npfctl_stats(data); 240 break; 241 case IOC_NPF_SESSIONS_SAVE: 242 error = npfctl_sessions_save(cmd, data); 243 break; 244 case IOC_NPF_SESSIONS_LOAD: 245 error = npfctl_sessions_load(cmd, data); 246 break; 247 case IOC_NPF_UPDATE_RULE: 248 error = npfctl_update_rule(cmd, data); 249 break; 250 default: 251 error = ENOTTY; 252 break; 253 } 254 return error; 255 } 256 257 static int 258 npf_dev_poll(dev_t dev, int events, lwp_t *l) 259 { 260 261 return ENOTSUP; 262 } 263 264 static int 265 npf_dev_read(dev_t dev, struct uio *uio, int flag) 266 { 267 268 return ENOTSUP; 269 } 270 271 /* 272 * NPF core loading/reloading/unloading mechanism. 273 */ 274 275 static void 276 npf_core_destroy(npf_core_t *nc) 277 { 278 279 prop_object_release(nc->n_dict); 280 npf_ruleset_destroy(nc->n_rules); 281 npf_ruleset_destroy(nc->n_nat_rules); 282 npf_tableset_destroy(nc->n_tables); 283 kmem_free(nc, sizeof(npf_core_t)); 284 } 285 286 /* 287 * npf_reload: atomically load new ruleset, tableset and NAT policies. 288 * Then destroy old (unloaded) structures. 289 */ 290 void 291 npf_reload(prop_dictionary_t dict, npf_ruleset_t *rset, 292 npf_tableset_t *tset, npf_ruleset_t *nset, bool flush) 293 { 294 npf_core_t *nc, *onc; 295 296 /* Setup a new core structure. */ 297 nc = kmem_zalloc(sizeof(npf_core_t), KM_SLEEP); 298 nc->n_rules = rset; 299 nc->n_tables = tset; 300 nc->n_nat_rules = nset; 301 nc->n_dict = dict; 302 nc->n_default_pass = flush; 303 304 /* Lock and load the core structure. */ 305 rw_enter(&npf_lock, RW_WRITER); 306 onc = atomic_swap_ptr(&npf_core, nc); 307 if (onc) { 308 /* Reload only the static tables. */ 309 npf_tableset_reload(tset, onc->n_tables); 310 /* Reload only the necessary NAT policies. */ 311 npf_ruleset_natreload(nset, onc->n_nat_rules); 312 } 313 /* Unlock. Everything goes "live" now. */ 314 rw_exit(&npf_lock); 315 316 if (onc) { 317 /* Destroy unloaded structures. */ 318 npf_core_destroy(onc); 319 } 320 } 321 322 void 323 npf_core_enter(void) 324 { 325 rw_enter(&npf_lock, RW_READER); 326 } 327 328 npf_ruleset_t * 329 npf_core_ruleset(void) 330 { 331 KASSERT(rw_lock_held(&npf_lock)); 332 return npf_core->n_rules; 333 } 334 335 npf_ruleset_t * 336 npf_core_natset(void) 337 { 338 KASSERT(rw_lock_held(&npf_lock)); 339 return npf_core->n_nat_rules; 340 } 341 342 npf_tableset_t * 343 npf_core_tableset(void) 344 { 345 KASSERT(rw_lock_held(&npf_lock)); 346 return npf_core->n_tables; 347 } 348 349 void 350 npf_core_exit(void) 351 { 352 rw_exit(&npf_lock); 353 } 354 355 bool 356 npf_core_locked(void) 357 { 358 return rw_lock_held(&npf_lock); 359 } 360 361 prop_dictionary_t 362 npf_core_dict(void) 363 { 364 KASSERT(rw_lock_held(&npf_lock)); 365 return npf_core->n_dict; 366 } 367 368 bool 369 npf_default_pass(void) 370 { 371 KASSERT(rw_lock_held(&npf_lock)); 372 return npf_core->n_default_pass; 373 } 374 375 bool 376 npf_autounload_p(void) 377 { 378 return !npf_pfil_registered_p() && npf_default_pass(); 379 } 380 381 /* 382 * NPF statistics interface. 383 */ 384 385 void 386 npf_stats_inc(npf_stats_t st) 387 { 388 uint64_t *stats = percpu_getref(npf_stats_percpu); 389 stats[st]++; 390 percpu_putref(npf_stats_percpu); 391 } 392 393 void 394 npf_stats_dec(npf_stats_t st) 395 { 396 uint64_t *stats = percpu_getref(npf_stats_percpu); 397 stats[st]--; 398 percpu_putref(npf_stats_percpu); 399 } 400 401 static void 402 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci) 403 { 404 uint64_t *percpu_stats = mem, *full_stats = arg; 405 int i; 406 407 for (i = 0; i < NPF_STATS_COUNT; i++) { 408 full_stats[i] += percpu_stats[i]; 409 } 410 } 411 412 /* 413 * npfctl_stats: export collected statistics. 414 */ 415 static int 416 npfctl_stats(void *data) 417 { 418 uint64_t *fullst, *uptr = *(uint64_t **)data; 419 int error; 420 421 fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP); 422 percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst); 423 error = copyout(fullst, uptr, NPF_STATS_SIZE); 424 kmem_free(fullst, NPF_STATS_SIZE); 425 return error; 426 } 427
Indexes created Wed Oct 22 13:09:56 GMT 2025