npf.c revision 1.19
1 /* $NetBSD: npf.c,v 1.19 2014/03/16 05:20:30 dholland Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF main: dynamic load/initialisation and unload routines. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.19 2014/03/16 05:20:30 dholland Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/atomic.h> 43 #include <sys/conf.h> 44 #include <sys/kauth.h> 45 #include <sys/kmem.h> 46 #include <sys/lwp.h> 47 #include <sys/module.h> 48 #include <sys/percpu.h> 49 #include <sys/rwlock.h> 50 #include <sys/socketvar.h> 51 #include <sys/sysctl.h> 52 #include <sys/uio.h> 53 54 #include "npf_impl.h" 55 56 /* 57 * Module and device structures. 58 */ 59 MODULE(MODULE_CLASS_DRIVER, npf, NULL); 60 61 void npfattach(int); 62 63 static int npf_fini(void); 64 static int npf_dev_open(dev_t, int, int, lwp_t *); 65 static int npf_dev_close(dev_t, int, int, lwp_t *); 66 static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *); 67 static int npf_dev_poll(dev_t, int, lwp_t *); 68 static int npf_dev_read(dev_t, struct uio *, int); 69 70 static int npfctl_stats(void *); 71 72 static percpu_t * npf_stats_percpu __read_mostly; 73 static struct sysctllog * npf_sysctl __read_mostly; 74 75 const struct cdevsw npf_cdevsw = { 76 .d_open = npf_dev_open, 77 .d_close = npf_dev_close, 78 .d_read = npf_dev_read, 79 .d_write = nowrite, 80 .d_ioctl = npf_dev_ioctl, 81 .d_stop = nostop, 82 .d_tty = notty, 83 .d_poll = npf_dev_poll, 84 .d_mmap = nommap, 85 .d_kqfilter = nokqfilter, 86 .d_flag = D_OTHER | D_MPSAFE 87 }; 88 89 static int 90 npf_init(void) 91 { 92 #ifdef _MODULE 93 devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR; 94 #endif 95 int error = 0; 96 97 npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE); 98 npf_sysctl = NULL; 99 100 npf_bpf_sysinit(); 101 npf_worker_sysinit(); 102 npf_tableset_sysinit(); 103 npf_session_sysinit(); 104 npf_nat_sysinit(); 105 npf_alg_sysinit(); 106 npf_ext_sysinit(); 107 108 /* Load empty configuration. */ 109 npf_pfil_register(true); 110 npf_config_init(); 111 112 #ifdef _MODULE 113 /* Attach /dev/npf device. */ 114 error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor); 115 if (error) { 116 /* It will call devsw_detach(), which is safe. */ 117 (void)npf_fini(); 118 } 119 #endif 120 return error; 121 } 122 123 static int 124 npf_fini(void) 125 { 126 /* At first, detach device and remove pfil hooks. */ 127 #ifdef _MODULE 128 devsw_detach(NULL, &npf_cdevsw); 129 #endif 130 npf_pfil_unregister(true); 131 132 /* Flush all sessions, destroy configuration (ruleset, etc). */ 133 npf_session_tracking(false); 134 npf_config_fini(); 135 136 /* Finally, safe to destroy the subsystems. */ 137 npf_ext_sysfini(); 138 npf_alg_sysfini(); 139 npf_nat_sysfini(); 140 npf_session_sysfini(); 141 npf_tableset_sysfini(); 142 npf_bpf_sysfini(); 143 144 /* Note: worker is the last. */ 145 npf_worker_sysfini(); 146 147 if (npf_sysctl) { 148 sysctl_teardown(&npf_sysctl); 149 } 150 percpu_free(npf_stats_percpu, NPF_STATS_SIZE); 151 152 return 0; 153 } 154 155 /* 156 * Module interface. 157 */ 158 static int 159 npf_modcmd(modcmd_t cmd, void *arg) 160 { 161 162 switch (cmd) { 163 case MODULE_CMD_INIT: 164 return npf_init(); 165 case MODULE_CMD_FINI: 166 return npf_fini(); 167 case MODULE_CMD_AUTOUNLOAD: 168 if (npf_autounload_p()) { 169 return EBUSY; 170 } 171 break; 172 default: 173 return ENOTTY; 174 } 175 return 0; 176 } 177 178 void 179 npfattach(int nunits) 180 { 181 182 /* Void. */ 183 } 184 185 static int 186 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l) 187 { 188 189 /* Available only for super-user. */ 190 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 191 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 192 return EPERM; 193 } 194 return 0; 195 } 196 197 static int 198 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l) 199 { 200 201 return 0; 202 } 203 204 static int 205 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l) 206 { 207 int error; 208 209 /* Available only for super-user. */ 210 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 211 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 212 return EPERM; 213 } 214 215 switch (cmd) { 216 case IOC_NPF_TABLE: 217 error = npfctl_table(data); 218 break; 219 case IOC_NPF_RULE: 220 error = npfctl_rule(cmd, data); 221 break; 222 case IOC_NPF_GETCONF: 223 error = npfctl_getconf(cmd, data); 224 break; 225 case IOC_NPF_STATS: 226 error = npfctl_stats(data); 227 break; 228 case IOC_NPF_SESSIONS_SAVE: 229 error = npfctl_sessions_save(cmd, data); 230 break; 231 case IOC_NPF_SESSIONS_LOAD: 232 error = npfctl_sessions_load(cmd, data); 233 break; 234 case IOC_NPF_SWITCH: 235 error = npfctl_switch(data); 236 break; 237 case IOC_NPF_RELOAD: 238 error = npfctl_reload(cmd, data); 239 break; 240 case IOC_NPF_VERSION: 241 *(int *)data = NPF_VERSION; 242 error = 0; 243 break; 244 default: 245 error = ENOTTY; 246 break; 247 } 248 return error; 249 } 250 251 static int 252 npf_dev_poll(dev_t dev, int events, lwp_t *l) 253 { 254 255 return ENOTSUP; 256 } 257 258 static int 259 npf_dev_read(dev_t dev, struct uio *uio, int flag) 260 { 261 262 return ENOTSUP; 263 } 264 265 bool 266 npf_autounload_p(void) 267 { 268 return !npf_pfil_registered_p() && npf_default_pass(); 269 } 270 271 /* 272 * NPF statistics interface. 273 */ 274 275 void 276 npf_stats_inc(npf_stats_t st) 277 { 278 uint64_t *stats = percpu_getref(npf_stats_percpu); 279 stats[st]++; 280 percpu_putref(npf_stats_percpu); 281 } 282 283 void 284 npf_stats_dec(npf_stats_t st) 285 { 286 uint64_t *stats = percpu_getref(npf_stats_percpu); 287 stats[st]--; 288 percpu_putref(npf_stats_percpu); 289 } 290 291 static void 292 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci) 293 { 294 uint64_t *percpu_stats = mem, *full_stats = arg; 295 int i; 296 297 for (i = 0; i < NPF_STATS_COUNT; i++) { 298 full_stats[i] += percpu_stats[i]; 299 } 300 } 301 302 /* 303 * npfctl_stats: export collected statistics. 304 */ 305 static int 306 npfctl_stats(void *data) 307 { 308 uint64_t *fullst, *uptr = *(uint64_t **)data; 309 int error; 310 311 fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP); 312 percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst); 313 error = copyout(fullst, uptr, NPF_STATS_SIZE); 314 kmem_free(fullst, NPF_STATS_SIZE); 315 return error; 316 } 317
Indexes created Tue Sep 23 21:09:50 GMT 2025