Home | History | Annotate | Line # | Download | only in npf
npf.c revision 1.6 
      1 /*	$NetBSD: npf.c,v 1.6 2011/11/06 13:08:04 tron Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * NPF main: dynamic load/initialisation and unload routines.
     34  */
     35 
     36 #include <sys/cdefs.h>
     37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.6 2011/11/06 13:08:04 tron Exp $");
     38 
     39 #include <sys/param.h>
     40 #include <sys/types.h>
     41 
     42 #include <sys/atomic.h>
     43 #include <sys/conf.h>
     44 #include <sys/kauth.h>
     45 #include <sys/kmem.h>
     46 #include <sys/lwp.h>
     47 #include <sys/module.h>
     48 #include <sys/percpu.h>
     49 #include <sys/rwlock.h>
     50 #include <sys/socketvar.h>
     51 #include <sys/uio.h>
     52 
     53 #include "npf_impl.h"
     54 
     55 /*
     56  * Module and device structures.
     57  */
     58 MODULE(MODULE_CLASS_DRIVER, npf, NULL);
     59 
     60 void		npfattach(int);
     61 
     62 static int	npf_fini(void);
     63 static int	npf_dev_open(dev_t, int, int, lwp_t *);
     64 static int	npf_dev_close(dev_t, int, int, lwp_t *);
     65 static int	npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
     66 static int	npf_dev_poll(dev_t, int, lwp_t *);
     67 static int	npf_dev_read(dev_t, struct uio *, int);
     68 
     69 typedef struct {
     70 	npf_ruleset_t *		n_rules;
     71 	npf_tableset_t *	n_tables;
     72 	npf_ruleset_t *		n_nat_rules;
     73 } npf_core_t;
     74 
     75 static void	npf_core_destroy(npf_core_t *);
     76 static int	npfctl_stats(void *);
     77 
     78 static krwlock_t		npf_lock		__cacheline_aligned;
     79 static npf_core_t *		npf_core		__cacheline_aligned;
     80 static percpu_t *		npf_stats_percpu	__read_mostly;
     81 
     82 const struct cdevsw npf_cdevsw = {
     83 	npf_dev_open, npf_dev_close, npf_dev_read, nowrite, npf_dev_ioctl,
     84 	nostop, notty, npf_dev_poll, nommap, nokqfilter, D_OTHER | D_MPSAFE
     85 };
     86 
     87 static int
     88 npf_init(void)
     89 {
     90 #ifdef _MODULE
     91 	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
     92 #endif
     93 	npf_ruleset_t *rset, *nset;
     94 	npf_tableset_t *tset;
     95 	int error = 0;
     96 
     97 	rw_init(&npf_lock);
     98 	npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE);
     99 	npf_tableset_sysinit();
    100 	npf_session_sysinit();
    101 	npf_nat_sysinit();
    102 	npf_alg_sysinit();
    103 	npflogattach(1);
    104 
    105 	/* Load empty configuration. */
    106 	rset = npf_ruleset_create();
    107 	tset = npf_tableset_create();
    108 	nset = npf_ruleset_create();
    109 	npf_reload(rset, tset, nset);
    110 	KASSERT(npf_core != NULL);
    111 
    112 #ifdef _MODULE
    113 	/* Attach /dev/npf device. */
    114 	error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
    115 	if (error) {
    116 		/* It will call devsw_detach(), which is safe. */
    117 		(void)npf_fini();
    118 	}
    119 #endif
    120 	return error;
    121 }
    122 
    123 static int
    124 npf_fini(void)
    125 {
    126 
    127 	/*
    128 	 * At first, detach device, remove pfil hooks and unload existing
    129 	 * configuration, destroy structures.
    130 	 */
    131 #ifdef _MODULE
    132 	devsw_detach(NULL, &npf_cdevsw);
    133 #endif
    134 	npf_unregister_pfil();
    135 	npf_core_destroy(npf_core);
    136 	npflogdetach();
    137 
    138 	/* Note: order is particular. */
    139 	npf_nat_sysfini();
    140 	npf_alg_sysfini();
    141 	npf_session_sysfini();
    142 	npf_tableset_sysfini();
    143 	percpu_free(npf_stats_percpu, NPF_STATS_SIZE);
    144 	rw_destroy(&npf_lock);
    145 
    146 	return 0;
    147 }
    148 
    149 /*
    150  * Module interface.
    151  */
    152 static int
    153 npf_modcmd(modcmd_t cmd, void *arg)
    154 {
    155 
    156 	switch (cmd) {
    157 	case MODULE_CMD_INIT:
    158 		return npf_init();
    159 	case MODULE_CMD_FINI:
    160 		return npf_fini();
    161 	default:
    162 		return ENOTTY;
    163 	}
    164 	return 0;
    165 }
    166 
    167 void
    168 npfattach(int nunits)
    169 {
    170 
    171 	/* Void. */
    172 }
    173 
    174 static int
    175 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
    176 {
    177 
    178 	/* Available only for super-user. */
    179 	if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, NULL)) {
    180 		return EPERM;
    181 	}
    182 	return 0;
    183 }
    184 
    185 static int
    186 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
    187 {
    188 
    189 	return 0;
    190 }
    191 
    192 static int
    193 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
    194 {
    195 	int error;
    196 
    197 	/* Available only for super-user. */
    198 	if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, NULL)) {
    199 		return EPERM;
    200 	}
    201 
    202 	switch (cmd) {
    203 	case IOC_NPF_VERSION:
    204 		*(int *)data = NPF_VERSION;
    205 		error = 0;
    206 		break;
    207 	case IOC_NPF_SWITCH:
    208 		error = npfctl_switch(data);
    209 		break;
    210 	case IOC_NPF_RELOAD:
    211 		error = npfctl_reload(cmd, data);
    212 		break;
    213 	case IOC_NPF_TABLE:
    214 		error = npfctl_table(data);
    215 		break;
    216 	case IOC_NPF_STATS:
    217 		error = npfctl_stats(data);
    218 		break;
    219 	case IOC_NPF_SESSIONS_SAVE:
    220 		error = npfctl_sessions_save(cmd, data);
    221 		break;
    222 	case IOC_NPF_SESSIONS_LOAD:
    223 		error = npfctl_sessions_load(cmd, data);
    224 		break;
    225 	case IOC_NPF_UPDATE_RULE:
    226 		error = npfctl_update_rule(cmd, data);
    227 		break;
    228 	default:
    229 		error = ENOTTY;
    230 		break;
    231 	}
    232 	return error;
    233 }
    234 
    235 static int
    236 npf_dev_poll(dev_t dev, int events, lwp_t *l)
    237 {
    238 
    239 	return ENOTSUP;
    240 }
    241 
    242 static int
    243 npf_dev_read(dev_t dev, struct uio *uio, int flag)
    244 {
    245 
    246 	return ENOTSUP;
    247 }
    248 
    249 /*
    250  * NPF core loading/reloading/unloading mechanism.
    251  */
    252 
    253 static void
    254 npf_core_destroy(npf_core_t *nc)
    255 {
    256 
    257 	npf_ruleset_destroy(nc->n_rules);
    258 	npf_ruleset_destroy(nc->n_nat_rules);
    259 	npf_tableset_destroy(nc->n_tables);
    260 	kmem_free(nc, sizeof(npf_core_t));
    261 }
    262 
    263 /*
    264  * npf_reload: atomically load new ruleset, tableset and NAT policies.
    265  * Then destroy old (unloaded) structures.
    266  */
    267 void
    268 npf_reload(npf_ruleset_t *rset, npf_tableset_t *tset, npf_ruleset_t *nset)
    269 {
    270 	npf_core_t *nc, *onc;
    271 
    272 	/* Setup a new core structure. */
    273 	nc = kmem_alloc(sizeof(npf_core_t), KM_SLEEP);
    274 	nc->n_rules = rset;
    275 	nc->n_tables = tset;
    276 	nc->n_nat_rules = nset;
    277 
    278 	/* Lock and load the core structure. */
    279 	rw_enter(&npf_lock, RW_WRITER);
    280 	onc = atomic_swap_ptr(&npf_core, nc);
    281 	if (onc) {
    282 		/* Reload only necessary NAT policies. */
    283 		npf_ruleset_natreload(nset, onc->n_nat_rules);
    284 	}
    285 	/* Unlock.  Everything goes "live" now. */
    286 	rw_exit(&npf_lock);
    287 
    288 	/* Turn on/off session tracking accordingly. */
    289 	npf_session_tracking(true);
    290 
    291 	if (onc) {
    292 		/* Destroy unloaded structures. */
    293 		npf_core_destroy(onc);
    294 	}
    295 }
    296 
    297 void
    298 npf_core_enter(void)
    299 {
    300 	rw_enter(&npf_lock, RW_READER);
    301 }
    302 
    303 npf_ruleset_t *
    304 npf_core_ruleset(void)
    305 {
    306 	KASSERT(rw_lock_held(&npf_lock));
    307 	return npf_core->n_rules;
    308 }
    309 
    310 npf_ruleset_t *
    311 npf_core_natset(void)
    312 {
    313 	KASSERT(rw_lock_held(&npf_lock));
    314 	return npf_core->n_nat_rules;
    315 }
    316 
    317 npf_tableset_t *
    318 npf_core_tableset(void)
    319 {
    320 	KASSERT(rw_lock_held(&npf_lock));
    321 	return npf_core->n_tables;
    322 }
    323 
    324 void
    325 npf_core_exit(void)
    326 {
    327 	rw_exit(&npf_lock);
    328 }
    329 
    330 bool
    331 npf_core_locked(void)
    332 {
    333 	return rw_lock_held(&npf_lock);
    334 }
    335 
    336 /*
    337  * NPF statistics interface.
    338  */
    339 
    340 void
    341 npf_stats_inc(npf_stats_t st)
    342 {
    343 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    344 	stats[st]++;
    345 	percpu_putref(npf_stats_percpu);
    346 }
    347 
    348 void
    349 npf_stats_dec(npf_stats_t st)
    350 {
    351 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    352 	stats[st]--;
    353 	percpu_putref(npf_stats_percpu);
    354 }
    355 
    356 static void
    357 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci)
    358 {
    359 	uint64_t *percpu_stats = mem, *full_stats = arg;
    360 	int i;
    361 
    362 	for (i = 0; i < NPF_STATS_COUNT; i++) {
    363 		full_stats[i] += percpu_stats[i];
    364 	}
    365 }
    366 
    367 /*
    368  * npfctl_stats: export collected statistics.
    369  */
    370 static int
    371 npfctl_stats(void *data)
    372 {
    373 	uint64_t *fullst, *uptr = *(uint64_t **)data;
    374 	int error;
    375 
    376 	fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP);
    377 	percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst);
    378 	error = copyout(fullst, uptr, NPF_STATS_SIZE);
    379 	kmem_free(fullst, NPF_STATS_SIZE);
    380 	return error;
    381 }
    382