Home | History | Annotate | Line # | Download | only in npf
npf.c revision 1.31.2.1 
      1 /*	$NetBSD: npf.c,v 1.31.2.1 2016/07/18 03:50:00 pgoyette Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * NPF main: dynamic load/initialisation and unload routines.
     34  */
     35 
     36 #include <sys/cdefs.h>
     37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.31.2.1 2016/07/18 03:50:00 pgoyette Exp $");
     38 
     39 #include <sys/param.h>
     40 #include <sys/types.h>
     41 
     42 #include <sys/atomic.h>
     43 #include <sys/conf.h>
     44 #include <sys/kauth.h>
     45 #include <sys/kmem.h>
     46 #include <sys/lwp.h>
     47 #include <sys/module.h>
     48 #include <sys/percpu.h>
     49 #include <sys/rwlock.h>
     50 #include <sys/socketvar.h>
     51 #include <sys/sysctl.h>
     52 #include <sys/uio.h>
     53 #include <sys/localcount.h>
     54 
     55 #include "npf_impl.h"
     56 #include "npf_conn.h"
     57 
     58 #ifndef _MODULE
     59 #include "opt_modular.h"
     60 #endif
     61 
     62 #include "ioconf.h"
     63 
     64 /*
     65  * Module and device structures.
     66  */
     67 #ifndef _MODULE
     68 /*
     69  * Modular kernels load drivers too early, and we need percpu to be inited
     70  * So we make this misc; a better way would be to have early boot and late
     71  * boot drivers.
     72  */
     73 MODULE(MODULE_CLASS_MISC, npf, NULL);
     74 #else
     75 /* This module autoloads via /dev/npf so it needs to be a driver */
     76 MODULE(MODULE_CLASS_DRIVER, npf, NULL);
     77 #endif
     78 
     79 static int	npf_fini(void);
     80 static int	npf_dev_open(dev_t, int, int, lwp_t *);
     81 static int	npf_dev_close(dev_t, int, int, lwp_t *);
     82 static int	npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
     83 static int	npf_dev_poll(dev_t, int, lwp_t *);
     84 static int	npf_dev_read(dev_t, struct uio *, int);
     85 
     86 static int	npfctl_stats(void *);
     87 
     88 static percpu_t *		npf_stats_percpu	__read_mostly;
     89 static struct sysctllog *	npf_sysctl		__read_mostly;
     90 
     91 #ifdef _MODULE
     92 struct localcount npf_localcount;
     93 #endif
     94 
     95 const struct cdevsw npf_cdevsw = {
     96 	.d_open = npf_dev_open,
     97 	.d_close = npf_dev_close,
     98 	.d_read = npf_dev_read,
     99 	.d_write = nowrite,
    100 	.d_ioctl = npf_dev_ioctl,
    101 	.d_stop = nostop,
    102 	.d_tty = notty,
    103 	.d_poll = npf_dev_poll,
    104 	.d_mmap = nommap,
    105 	.d_kqfilter = nokqfilter,
    106 	.d_discard = nodiscard,
    107 #ifdef	_MODULE
    108 	.d_localcount = &npf_localcount,
    109 #endif
    110 	.d_flag = D_OTHER | D_MPSAFE
    111 };
    112 
    113 static int
    114 npf_init(void)
    115 {
    116 	KASSERT(npf_stats_percpu == NULL);
    117 
    118 	npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE);
    119 	npf_sysctl = NULL;
    120 
    121 	npf_bpf_sysinit();
    122 	npf_worker_sysinit();
    123 	npf_tableset_sysinit();
    124 	npf_conn_sysinit();
    125 	npf_nat_sysinit();
    126 	npf_alg_sysinit();
    127 	npf_ext_sysinit();
    128 
    129 	/* Load empty configuration. */
    130 	npf_pfil_register(true);
    131 	npf_config_init();
    132 
    133 #ifdef _MODULE
    134 	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
    135 
    136 	/* Attach /dev/npf device. */
    137 	int error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
    138 	if (error) {
    139 		/* It will call devsw_detach(), which is safe. */
    140 		(void)npf_fini();
    141 	}
    142 	return error;
    143 #else
    144 	return 0;
    145 #endif
    146 }
    147 
    148 static int
    149 npf_fini(void)
    150 {
    151 	/* At first, detach device and remove pfil hooks. */
    152 #ifdef _MODULE
    153 	devsw_detach(NULL, &npf_cdevsw);
    154 #endif
    155 	npf_pfil_unregister(true);
    156 	npf_config_fini();
    157 
    158 	/* Finally, safe to destroy the subsystems. */
    159 	npf_ext_sysfini();
    160 	npf_alg_sysfini();
    161 	npf_nat_sysfini();
    162 	npf_conn_sysfini();
    163 	npf_tableset_sysfini();
    164 	npf_bpf_sysfini();
    165 
    166 	/* Note: worker is the last. */
    167 	npf_worker_sysfini();
    168 
    169 	if (npf_sysctl) {
    170 		sysctl_teardown(&npf_sysctl);
    171 	}
    172 	percpu_free(npf_stats_percpu, NPF_STATS_SIZE);
    173 
    174 	return 0;
    175 }
    176 
    177 /*
    178  * Module interface.
    179  */
    180 static int
    181 npf_modcmd(modcmd_t cmd, void *arg)
    182 {
    183 
    184 	switch (cmd) {
    185 	case MODULE_CMD_INIT:
    186 		return npf_init();
    187 	case MODULE_CMD_FINI:
    188 		return npf_fini();
    189 	case MODULE_CMD_AUTOUNLOAD:
    190 		if (npf_autounload_p()) {
    191 			return EBUSY;
    192 		}
    193 		break;
    194 	default:
    195 		return ENOTTY;
    196 	}
    197 	return 0;
    198 }
    199 
    200 void
    201 npfattach(int nunits)
    202 {
    203 	/* Nothing */
    204 }
    205 
    206 static int
    207 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
    208 {
    209 
    210 	/* Available only for super-user. */
    211 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    212 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    213 		return EPERM;
    214 	}
    215 	return 0;
    216 }
    217 
    218 static int
    219 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
    220 {
    221 
    222 	return 0;
    223 }
    224 
    225 static int
    226 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
    227 {
    228 	int error;
    229 
    230 	/* Available only for super-user. */
    231 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    232 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    233 		return EPERM;
    234 	}
    235 
    236 	switch (cmd) {
    237 	case IOC_NPF_TABLE:
    238 		error = npfctl_table(data);
    239 		break;
    240 	case IOC_NPF_RULE:
    241 		error = npfctl_rule(cmd, data);
    242 		break;
    243 	case IOC_NPF_STATS:
    244 		error = npfctl_stats(data);
    245 		break;
    246 	case IOC_NPF_SAVE:
    247 		error = npfctl_save(cmd, data);
    248 		break;
    249 	case IOC_NPF_SWITCH:
    250 		error = npfctl_switch(data);
    251 		break;
    252 	case IOC_NPF_LOAD:
    253 		error = npfctl_load(cmd, data);
    254 		break;
    255 	case IOC_NPF_VERSION:
    256 		*(int *)data = NPF_VERSION;
    257 		error = 0;
    258 		break;
    259 	default:
    260 		error = ENOTTY;
    261 		break;
    262 	}
    263 	return error;
    264 }
    265 
    266 static int
    267 npf_dev_poll(dev_t dev, int events, lwp_t *l)
    268 {
    269 
    270 	return ENOTSUP;
    271 }
    272 
    273 static int
    274 npf_dev_read(dev_t dev, struct uio *uio, int flag)
    275 {
    276 
    277 	return ENOTSUP;
    278 }
    279 
    280 bool
    281 npf_autounload_p(void)
    282 {
    283 	return !npf_pfil_registered_p() && npf_default_pass();
    284 }
    285 
    286 /*
    287  * NPF statistics interface.
    288  */
    289 
    290 void
    291 npf_stats_inc(npf_stats_t st)
    292 {
    293 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    294 	stats[st]++;
    295 	percpu_putref(npf_stats_percpu);
    296 }
    297 
    298 void
    299 npf_stats_dec(npf_stats_t st)
    300 {
    301 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    302 	stats[st]--;
    303 	percpu_putref(npf_stats_percpu);
    304 }
    305 
    306 static void
    307 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci)
    308 {
    309 	uint64_t *percpu_stats = mem, *full_stats = arg;
    310 	int i;
    311 
    312 	for (i = 0; i < NPF_STATS_COUNT; i++) {
    313 		full_stats[i] += percpu_stats[i];
    314 	}
    315 }
    316 
    317 /*
    318  * npfctl_stats: export collected statistics.
    319  */
    320 static int
    321 npfctl_stats(void *data)
    322 {
    323 	uint64_t *fullst, *uptr = *(uint64_t **)data;
    324 	int error;
    325 
    326 	fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP);
    327 	percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst);
    328 	error = copyout(fullst, uptr, NPF_STATS_SIZE);
    329 	kmem_free(fullst, NPF_STATS_SIZE);
    330 	return error;
    331 }
    332