npf.c revision 1.20
1 /* $NetBSD: npf.c,v 1.20 2014/07/19 18:24:16 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF main: dynamic load/initialisation and unload routines. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.20 2014/07/19 18:24:16 rmind Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/atomic.h> 43 #include <sys/conf.h> 44 #include <sys/kauth.h> 45 #include <sys/kmem.h> 46 #include <sys/lwp.h> 47 #include <sys/module.h> 48 #include <sys/percpu.h> 49 #include <sys/rwlock.h> 50 #include <sys/socketvar.h> 51 #include <sys/sysctl.h> 52 #include <sys/uio.h> 53 54 #include "npf_impl.h" 55 #include "npf_conn.h" 56 57 /* 58 * Module and device structures. 59 */ 60 MODULE(MODULE_CLASS_DRIVER, npf, NULL); 61 62 void npfattach(int); 63 64 static int npf_fini(void); 65 static int npf_dev_open(dev_t, int, int, lwp_t *); 66 static int npf_dev_close(dev_t, int, int, lwp_t *); 67 static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *); 68 static int npf_dev_poll(dev_t, int, lwp_t *); 69 static int npf_dev_read(dev_t, struct uio *, int); 70 71 static int npfctl_stats(void *); 72 73 static percpu_t * npf_stats_percpu __read_mostly; 74 static struct sysctllog * npf_sysctl __read_mostly; 75 76 const struct cdevsw npf_cdevsw = { 77 .d_open = npf_dev_open, 78 .d_close = npf_dev_close, 79 .d_read = npf_dev_read, 80 .d_write = nowrite, 81 .d_ioctl = npf_dev_ioctl, 82 .d_stop = nostop, 83 .d_tty = notty, 84 .d_poll = npf_dev_poll, 85 .d_mmap = nommap, 86 .d_kqfilter = nokqfilter, 87 .d_flag = D_OTHER | D_MPSAFE 88 }; 89 90 static int 91 npf_init(void) 92 { 93 #ifdef _MODULE 94 devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR; 95 #endif 96 int error = 0; 97 98 npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE); 99 npf_sysctl = NULL; 100 101 npf_bpf_sysinit(); 102 npf_worker_sysinit(); 103 npf_tableset_sysinit(); 104 npf_conn_sysinit(); 105 npf_nat_sysinit(); 106 npf_alg_sysinit(); 107 npf_ext_sysinit(); 108 109 /* Load empty configuration. */ 110 npf_pfil_register(true); 111 npf_config_init(); 112 113 #ifdef _MODULE 114 /* Attach /dev/npf device. */ 115 error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor); 116 if (error) { 117 /* It will call devsw_detach(), which is safe. */ 118 (void)npf_fini(); 119 } 120 #endif 121 return error; 122 } 123 124 static int 125 npf_fini(void) 126 { 127 /* At first, detach device and remove pfil hooks. */ 128 #ifdef _MODULE 129 devsw_detach(NULL, &npf_cdevsw); 130 #endif 131 npf_pfil_unregister(true); 132 133 /* Flush all connections, destroy configuration (ruleset, etc). */ 134 npf_conn_tracking(false); 135 npf_config_fini(); 136 137 /* Finally, safe to destroy the subsystems. */ 138 npf_ext_sysfini(); 139 npf_alg_sysfini(); 140 npf_nat_sysfini(); 141 npf_conn_sysfini(); 142 npf_tableset_sysfini(); 143 npf_bpf_sysfini(); 144 145 /* Note: worker is the last. */ 146 npf_worker_sysfini(); 147 148 if (npf_sysctl) { 149 sysctl_teardown(&npf_sysctl); 150 } 151 percpu_free(npf_stats_percpu, NPF_STATS_SIZE); 152 153 return 0; 154 } 155 156 /* 157 * Module interface. 158 */ 159 static int 160 npf_modcmd(modcmd_t cmd, void *arg) 161 { 162 163 switch (cmd) { 164 case MODULE_CMD_INIT: 165 return npf_init(); 166 case MODULE_CMD_FINI: 167 return npf_fini(); 168 case MODULE_CMD_AUTOUNLOAD: 169 if (npf_autounload_p()) { 170 return EBUSY; 171 } 172 break; 173 default: 174 return ENOTTY; 175 } 176 return 0; 177 } 178 179 void 180 npfattach(int nunits) 181 { 182 183 /* Void. */ 184 } 185 186 static int 187 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l) 188 { 189 190 /* Available only for super-user. */ 191 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 192 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 193 return EPERM; 194 } 195 return 0; 196 } 197 198 static int 199 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l) 200 { 201 202 return 0; 203 } 204 205 static int 206 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l) 207 { 208 int error; 209 210 /* Available only for super-user. */ 211 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 212 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 213 return EPERM; 214 } 215 216 switch (cmd) { 217 case IOC_NPF_TABLE: 218 error = npfctl_table(data); 219 break; 220 case IOC_NPF_RULE: 221 error = npfctl_rule(cmd, data); 222 break; 223 case IOC_NPF_GETCONF: 224 error = npfctl_getconf(cmd, data); 225 break; 226 case IOC_NPF_STATS: 227 error = npfctl_stats(data); 228 break; 229 case IOC_NPF_SESSIONS_SAVE: 230 error = npfctl_conn_save(cmd, data); 231 break; 232 case IOC_NPF_SESSIONS_LOAD: 233 error = npfctl_conn_load(cmd, data); 234 break; 235 case IOC_NPF_SWITCH: 236 error = npfctl_switch(data); 237 break; 238 case IOC_NPF_RELOAD: 239 error = npfctl_reload(cmd, data); 240 break; 241 case IOC_NPF_VERSION: 242 *(int *)data = NPF_VERSION; 243 error = 0; 244 break; 245 default: 246 error = ENOTTY; 247 break; 248 } 249 return error; 250 } 251 252 static int 253 npf_dev_poll(dev_t dev, int events, lwp_t *l) 254 { 255 256 return ENOTSUP; 257 } 258 259 static int 260 npf_dev_read(dev_t dev, struct uio *uio, int flag) 261 { 262 263 return ENOTSUP; 264 } 265 266 bool 267 npf_autounload_p(void) 268 { 269 return !npf_pfil_registered_p() && npf_default_pass(); 270 } 271 272 /* 273 * NPF statistics interface. 274 */ 275 276 void 277 npf_stats_inc(npf_stats_t st) 278 { 279 uint64_t *stats = percpu_getref(npf_stats_percpu); 280 stats[st]++; 281 percpu_putref(npf_stats_percpu); 282 } 283 284 void 285 npf_stats_dec(npf_stats_t st) 286 { 287 uint64_t *stats = percpu_getref(npf_stats_percpu); 288 stats[st]--; 289 percpu_putref(npf_stats_percpu); 290 } 291 292 static void 293 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci) 294 { 295 uint64_t *percpu_stats = mem, *full_stats = arg; 296 int i; 297 298 for (i = 0; i < NPF_STATS_COUNT; i++) { 299 full_stats[i] += percpu_stats[i]; 300 } 301 } 302 303 /* 304 * npfctl_stats: export collected statistics. 305 */ 306 static int 307 npfctl_stats(void *data) 308 { 309 uint64_t *fullst, *uptr = *(uint64_t **)data; 310 int error; 311 312 fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP); 313 percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst); 314 error = copyout(fullst, uptr, NPF_STATS_SIZE); 315 kmem_free(fullst, NPF_STATS_SIZE); 316 return error; 317 } 318
Indexes created Wed Sep 24 05:09:52 GMT 2025