npf.c revision 1.31.2.3
1 /* $NetBSD: npf.c,v 1.31.2.3 2016/07/26 05:54:40 pgoyette Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF main: dynamic load/initialisation and unload routines. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.31.2.3 2016/07/26 05:54:40 pgoyette Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/atomic.h> 43 #include <sys/conf.h> 44 #include <sys/kauth.h> 45 #include <sys/kmem.h> 46 #include <sys/lwp.h> 47 #include <sys/module.h> 48 #include <sys/percpu.h> 49 #include <sys/rwlock.h> 50 #include <sys/socketvar.h> 51 #include <sys/sysctl.h> 52 #include <sys/uio.h> 53 #include <sys/localcount.h> 54 55 #include "npf_impl.h" 56 #include "npf_conn.h" 57 58 #ifndef _MODULE 59 #include "opt_modular.h" 60 #endif 61 62 #include "ioconf.h" 63 64 /* 65 * Module and device structures. 66 */ 67 #ifndef _MODULE 68 /* 69 * Modular kernels load drivers too early, and we need percpu to be inited 70 * So we make this misc; a better way would be to have early boot and late 71 * boot drivers. 72 */ 73 MODULE(MODULE_CLASS_MISC, npf, NULL); 74 #else 75 /* This module autoloads via /dev/npf so it needs to be a driver */ 76 MODULE(MODULE_CLASS_DRIVER, npf, NULL); 77 #endif 78 79 static int npf_fini(void); 80 static int npf_dev_open(dev_t, int, int, lwp_t *); 81 static int npf_dev_close(dev_t, int, int, lwp_t *); 82 static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *); 83 static int npf_dev_poll(dev_t, int, lwp_t *); 84 static int npf_dev_read(dev_t, struct uio *, int); 85 86 static int npfctl_stats(void *); 87 88 static percpu_t * npf_stats_percpu __read_mostly; 89 static struct sysctllog * npf_sysctl __read_mostly; 90 91 const struct cdevsw npf_cdevsw = { 92 DEVSW_MODULE_INIT 93 .d_open = npf_dev_open, 94 .d_close = npf_dev_close, 95 .d_read = npf_dev_read, 96 .d_write = nowrite, 97 .d_ioctl = npf_dev_ioctl, 98 .d_stop = nostop, 99 .d_tty = notty, 100 .d_poll = npf_dev_poll, 101 .d_mmap = nommap, 102 .d_kqfilter = nokqfilter, 103 .d_discard = nodiscard, 104 .d_flag = D_OTHER | D_MPSAFE 105 }; 106 107 static int 108 npf_init(void) 109 { 110 KASSERT(npf_stats_percpu == NULL); 111 112 npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE); 113 npf_sysctl = NULL; 114 115 npf_bpf_sysinit(); 116 npf_worker_sysinit(); 117 npf_tableset_sysinit(); 118 npf_conn_sysinit(); 119 npf_nat_sysinit(); 120 npf_alg_sysinit(); 121 npf_ext_sysinit(); 122 123 /* Load empty configuration. */ 124 npf_pfil_register(true); 125 npf_config_init(); 126 127 #ifdef _MODULE 128 devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR; 129 130 /* Attach /dev/npf device. */ 131 int error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor); 132 if (error) { 133 /* It will call devsw_detach(), which is safe. */ 134 (void)npf_fini(); 135 } 136 return error; 137 #else 138 return 0; 139 #endif 140 } 141 142 static int 143 npf_fini(void) 144 { 145 /* At first, detach device and remove pfil hooks. */ 146 #ifdef _MODULE 147 devsw_detach(NULL, &npf_cdevsw); 148 #endif 149 npf_pfil_unregister(true); 150 npf_config_fini(); 151 152 /* Finally, safe to destroy the subsystems. */ 153 npf_ext_sysfini(); 154 npf_alg_sysfini(); 155 npf_nat_sysfini(); 156 npf_conn_sysfini(); 157 npf_tableset_sysfini(); 158 npf_bpf_sysfini(); 159 160 /* Note: worker is the last. */ 161 npf_worker_sysfini(); 162 163 if (npf_sysctl) { 164 sysctl_teardown(&npf_sysctl); 165 } 166 percpu_free(npf_stats_percpu, NPF_STATS_SIZE); 167 168 return 0; 169 } 170 171 /* 172 * Module interface. 173 */ 174 static int 175 npf_modcmd(modcmd_t cmd, void *arg) 176 { 177 178 switch (cmd) { 179 case MODULE_CMD_INIT: 180 return npf_init(); 181 case MODULE_CMD_FINI: 182 return npf_fini(); 183 case MODULE_CMD_AUTOUNLOAD: 184 if (npf_autounload_p()) { 185 return EBUSY; 186 } 187 break; 188 default: 189 return ENOTTY; 190 } 191 return 0; 192 } 193 194 void 195 npfattach(int nunits) 196 { 197 /* Nothing */ 198 } 199 200 static int 201 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l) 202 { 203 204 /* Available only for super-user. */ 205 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 206 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 207 return EPERM; 208 } 209 return 0; 210 } 211 212 static int 213 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l) 214 { 215 216 return 0; 217 } 218 219 static int 220 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l) 221 { 222 int error; 223 224 /* Available only for super-user. */ 225 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 226 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 227 return EPERM; 228 } 229 230 switch (cmd) { 231 case IOC_NPF_TABLE: 232 error = npfctl_table(data); 233 break; 234 case IOC_NPF_RULE: 235 error = npfctl_rule(cmd, data); 236 break; 237 case IOC_NPF_STATS: 238 error = npfctl_stats(data); 239 break; 240 case IOC_NPF_SAVE: 241 error = npfctl_save(cmd, data); 242 break; 243 case IOC_NPF_SWITCH: 244 error = npfctl_switch(data); 245 break; 246 case IOC_NPF_LOAD: 247 error = npfctl_load(cmd, data); 248 break; 249 case IOC_NPF_VERSION: 250 *(int *)data = NPF_VERSION; 251 error = 0; 252 break; 253 default: 254 error = ENOTTY; 255 break; 256 } 257 return error; 258 } 259 260 static int 261 npf_dev_poll(dev_t dev, int events, lwp_t *l) 262 { 263 264 return ENOTSUP; 265 } 266 267 static int 268 npf_dev_read(dev_t dev, struct uio *uio, int flag) 269 { 270 271 return ENOTSUP; 272 } 273 274 bool 275 npf_autounload_p(void) 276 { 277 return !npf_pfil_registered_p() && npf_default_pass(); 278 } 279 280 /* 281 * NPF statistics interface. 282 */ 283 284 void 285 npf_stats_inc(npf_stats_t st) 286 { 287 uint64_t *stats = percpu_getref(npf_stats_percpu); 288 stats[st]++; 289 percpu_putref(npf_stats_percpu); 290 } 291 292 void 293 npf_stats_dec(npf_stats_t st) 294 { 295 uint64_t *stats = percpu_getref(npf_stats_percpu); 296 stats[st]--; 297 percpu_putref(npf_stats_percpu); 298 } 299 300 static void 301 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci) 302 { 303 uint64_t *percpu_stats = mem, *full_stats = arg; 304 int i; 305 306 for (i = 0; i < NPF_STATS_COUNT; i++) { 307 full_stats[i] += percpu_stats[i]; 308 } 309 } 310 311 /* 312 * npfctl_stats: export collected statistics. 313 */ 314 static int 315 npfctl_stats(void *data) 316 { 317 uint64_t *fullst, *uptr = *(uint64_t **)data; 318 int error; 319 320 fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP); 321 percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst); 322 error = copyout(fullst, uptr, NPF_STATS_SIZE); 323 kmem_free(fullst, NPF_STATS_SIZE); 324 return error; 325 } 326
Indexes created Sun Oct 19 02:09:48 GMT 2025