Home | History | Annotate | Line # | Download | only in npf
npf.c revision 1.7.2.6
      1 /*	$NetBSD: npf.c,v 1.7.2.6 2012/11/24 04:34:42 riz Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * NPF main: dynamic load/initialisation and unload routines.
     34  */
     35 
     36 #include <sys/cdefs.h>
     37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.7.2.6 2012/11/24 04:34:42 riz Exp $");
     38 
     39 #include <sys/param.h>
     40 #include <sys/types.h>
     41 
     42 #include <sys/atomic.h>
     43 #include <sys/conf.h>
     44 #include <sys/kauth.h>
     45 #include <sys/kmem.h>
     46 #include <sys/lwp.h>
     47 #include <sys/module.h>
     48 #include <sys/percpu.h>
     49 #include <sys/rwlock.h>
     50 #include <sys/socketvar.h>
     51 #include <sys/sysctl.h>
     52 #include <sys/uio.h>
     53 
     54 #include "npf_impl.h"
     55 
     56 /*
     57  * Module and device structures.
     58  */
     59 MODULE(MODULE_CLASS_DRIVER, npf, NULL);
     60 
     61 void		npfattach(int);
     62 
     63 static int	npf_fini(void);
     64 static int	npf_dev_open(dev_t, int, int, lwp_t *);
     65 static int	npf_dev_close(dev_t, int, int, lwp_t *);
     66 static int	npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
     67 static int	npf_dev_poll(dev_t, int, lwp_t *);
     68 static int	npf_dev_read(dev_t, struct uio *, int);
     69 
     70 typedef struct {
     71 	npf_ruleset_t *		n_rules;
     72 	npf_tableset_t *	n_tables;
     73 	npf_ruleset_t *		n_nat_rules;
     74 	prop_dictionary_t	n_dict;
     75 	bool			n_default_pass;
     76 } npf_core_t;
     77 
     78 static void	npf_core_destroy(npf_core_t *);
     79 static int	npfctl_stats(void *);
     80 
     81 static krwlock_t		npf_lock		__cacheline_aligned;
     82 static npf_core_t *		npf_core		__cacheline_aligned;
     83 static percpu_t *		npf_stats_percpu	__read_mostly;
     84 static struct sysctllog *	npf_sysctl		__read_mostly;
     85 
     86 const struct cdevsw npf_cdevsw = {
     87 	npf_dev_open, npf_dev_close, npf_dev_read, nowrite, npf_dev_ioctl,
     88 	nostop, notty, npf_dev_poll, nommap, nokqfilter, D_OTHER | D_MPSAFE
     89 };
     90 
     91 static int
     92 npf_init(void)
     93 {
     94 #ifdef _MODULE
     95 	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
     96 #endif
     97 	npf_ruleset_t *rset, *nset;
     98 	npf_tableset_t *tset;
     99 	prop_dictionary_t dict;
    100 	int error = 0;
    101 
    102 	rw_init(&npf_lock);
    103 	npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE);
    104 	npf_sysctl = NULL;
    105 
    106 	npf_tableset_sysinit();
    107 	npf_session_sysinit();
    108 	npf_nat_sysinit();
    109 	npf_alg_sysinit();
    110 	npf_ext_sysinit();
    111 
    112 	/* Load empty configuration. */
    113 	dict = prop_dictionary_create();
    114 	rset = npf_ruleset_create();
    115 	tset = npf_tableset_create();
    116 	nset = npf_ruleset_create();
    117 	npf_reload(dict, rset, tset, nset, true);
    118 	KASSERT(npf_core != NULL);
    119 
    120 #ifdef _MODULE
    121 	/* Attach /dev/npf device. */
    122 	error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
    123 	if (error) {
    124 		/* It will call devsw_detach(), which is safe. */
    125 		(void)npf_fini();
    126 	}
    127 #endif
    128 	return error;
    129 }
    130 
    131 static int
    132 npf_fini(void)
    133 {
    134 
    135 	/* At first, detach device and remove pfil hooks. */
    136 #ifdef _MODULE
    137 	devsw_detach(NULL, &npf_cdevsw);
    138 #endif
    139 	npf_pfil_unregister();
    140 
    141 	/* Flush all sessions, destroy configuration (ruleset, etc). */
    142 	npf_session_tracking(false);
    143 	npf_core_destroy(npf_core);
    144 
    145 	/* Finally, safe to destroy the subsystems. */
    146 	npf_ext_sysfini();
    147 	npf_alg_sysfini();
    148 	npf_nat_sysfini();
    149 	npf_session_sysfini();
    150 	npf_tableset_sysfini();
    151 
    152 	if (npf_sysctl) {
    153 		sysctl_teardown(&npf_sysctl);
    154 	}
    155 	percpu_free(npf_stats_percpu, NPF_STATS_SIZE);
    156 	rw_destroy(&npf_lock);
    157 
    158 	return 0;
    159 }
    160 
    161 /*
    162  * Module interface.
    163  */
    164 static int
    165 npf_modcmd(modcmd_t cmd, void *arg)
    166 {
    167 
    168 	switch (cmd) {
    169 	case MODULE_CMD_INIT:
    170 		return npf_init();
    171 	case MODULE_CMD_FINI:
    172 		return npf_fini();
    173 	case MODULE_CMD_AUTOUNLOAD:
    174 		if (npf_autounload_p()) {
    175 			return EBUSY;
    176 		}
    177 		break;
    178 	default:
    179 		return ENOTTY;
    180 	}
    181 	return 0;
    182 }
    183 
    184 void
    185 npfattach(int nunits)
    186 {
    187 
    188 	/* Void. */
    189 }
    190 
    191 static int
    192 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
    193 {
    194 
    195 	/* Available only for super-user. */
    196 	if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, NULL)) {
    197 		return EPERM;
    198 	}
    199 	return 0;
    200 }
    201 
    202 static int
    203 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
    204 {
    205 
    206 	return 0;
    207 }
    208 
    209 static int
    210 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
    211 {
    212 	int error;
    213 
    214 	/* Available only for super-user. */
    215 	if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, NULL)) {
    216 		return EPERM;
    217 	}
    218 
    219 	switch (cmd) {
    220 	case IOC_NPF_VERSION:
    221 		*(int *)data = NPF_VERSION;
    222 		error = 0;
    223 		break;
    224 	case IOC_NPF_SWITCH:
    225 		error = npfctl_switch(data);
    226 		break;
    227 	case IOC_NPF_RELOAD:
    228 		error = npfctl_reload(cmd, data);
    229 		break;
    230 	case IOC_NPF_GETCONF:
    231 		error = npfctl_getconf(cmd, data);
    232 		break;
    233 	case IOC_NPF_TABLE:
    234 		error = npfctl_table(data);
    235 		break;
    236 	case IOC_NPF_STATS:
    237 		error = npfctl_stats(data);
    238 		break;
    239 	case IOC_NPF_SESSIONS_SAVE:
    240 		error = npfctl_sessions_save(cmd, data);
    241 		break;
    242 	case IOC_NPF_SESSIONS_LOAD:
    243 		error = npfctl_sessions_load(cmd, data);
    244 		break;
    245 	case IOC_NPF_UPDATE_RULE:
    246 		error = npfctl_update_rule(cmd, data);
    247 		break;
    248 	default:
    249 		error = ENOTTY;
    250 		break;
    251 	}
    252 	return error;
    253 }
    254 
    255 static int
    256 npf_dev_poll(dev_t dev, int events, lwp_t *l)
    257 {
    258 
    259 	return ENOTSUP;
    260 }
    261 
    262 static int
    263 npf_dev_read(dev_t dev, struct uio *uio, int flag)
    264 {
    265 
    266 	return ENOTSUP;
    267 }
    268 
    269 /*
    270  * NPF core loading/reloading/unloading mechanism.
    271  */
    272 
    273 static void
    274 npf_core_destroy(npf_core_t *nc)
    275 {
    276 
    277 	prop_object_release(nc->n_dict);
    278 	npf_ruleset_destroy(nc->n_rules);
    279 	npf_ruleset_destroy(nc->n_nat_rules);
    280 	npf_tableset_destroy(nc->n_tables);
    281 	kmem_free(nc, sizeof(npf_core_t));
    282 }
    283 
    284 /*
    285  * npf_reload: atomically load new ruleset, tableset and NAT policies.
    286  * Then destroy old (unloaded) structures.
    287  */
    288 void
    289 npf_reload(prop_dictionary_t dict, npf_ruleset_t *rset,
    290     npf_tableset_t *tset, npf_ruleset_t *nset, bool flush)
    291 {
    292 	npf_core_t *nc, *onc;
    293 
    294 	/* Setup a new core structure. */
    295 	nc = kmem_zalloc(sizeof(npf_core_t), KM_SLEEP);
    296 	nc->n_rules = rset;
    297 	nc->n_tables = tset;
    298 	nc->n_nat_rules = nset;
    299 	nc->n_dict = dict;
    300 	nc->n_default_pass = flush;
    301 
    302 	/* Lock and load the core structure. */
    303 	rw_enter(&npf_lock, RW_WRITER);
    304 	onc = atomic_swap_ptr(&npf_core, nc);
    305 	if (onc) {
    306 		/* Reload only the static tables. */
    307 		npf_tableset_reload(tset, onc->n_tables);
    308 		/* Reload only the necessary NAT policies. */
    309 		npf_ruleset_natreload(nset, onc->n_nat_rules);
    310 	}
    311 	/* Unlock.  Everything goes "live" now. */
    312 	rw_exit(&npf_lock);
    313 
    314 	if (onc) {
    315 		/* Destroy unloaded structures. */
    316 		npf_core_destroy(onc);
    317 	}
    318 }
    319 
    320 void
    321 npf_core_enter(void)
    322 {
    323 	rw_enter(&npf_lock, RW_READER);
    324 }
    325 
    326 npf_ruleset_t *
    327 npf_core_ruleset(void)
    328 {
    329 	KASSERT(rw_lock_held(&npf_lock));
    330 	return npf_core->n_rules;
    331 }
    332 
    333 npf_ruleset_t *
    334 npf_core_natset(void)
    335 {
    336 	KASSERT(rw_lock_held(&npf_lock));
    337 	return npf_core->n_nat_rules;
    338 }
    339 
    340 npf_tableset_t *
    341 npf_core_tableset(void)
    342 {
    343 	KASSERT(rw_lock_held(&npf_lock));
    344 	return npf_core->n_tables;
    345 }
    346 
    347 void
    348 npf_core_exit(void)
    349 {
    350 	rw_exit(&npf_lock);
    351 }
    352 
    353 bool
    354 npf_core_locked(void)
    355 {
    356 	return rw_lock_held(&npf_lock);
    357 }
    358 
    359 prop_dictionary_t
    360 npf_core_dict(void)
    361 {
    362 	KASSERT(rw_lock_held(&npf_lock));
    363 	return npf_core->n_dict;
    364 }
    365 
    366 bool
    367 npf_default_pass(void)
    368 {
    369 	KASSERT(rw_lock_held(&npf_lock));
    370 	return npf_core->n_default_pass;
    371 }
    372 
    373 bool
    374 npf_autounload_p(void)
    375 {
    376 	return !npf_pfil_registered_p() && npf_default_pass();
    377 }
    378 
    379 /*
    380  * NPF statistics interface.
    381  */
    382 
    383 void
    384 npf_stats_inc(npf_stats_t st)
    385 {
    386 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    387 	stats[st]++;
    388 	percpu_putref(npf_stats_percpu);
    389 }
    390 
    391 void
    392 npf_stats_dec(npf_stats_t st)
    393 {
    394 	uint64_t *stats = percpu_getref(npf_stats_percpu);
    395 	stats[st]--;
    396 	percpu_putref(npf_stats_percpu);
    397 }
    398 
    399 static void
    400 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci)
    401 {
    402 	uint64_t *percpu_stats = mem, *full_stats = arg;
    403 	int i;
    404 
    405 	for (i = 0; i < NPF_STATS_COUNT; i++) {
    406 		full_stats[i] += percpu_stats[i];
    407 	}
    408 }
    409 
    410 /*
    411  * npfctl_stats: export collected statistics.
    412  */
    413 static int
    414 npfctl_stats(void *data)
    415 {
    416 	uint64_t *fullst, *uptr = *(uint64_t **)data;
    417 	int error;
    418 
    419 	fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP);
    420 	percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst);
    421 	error = copyout(fullst, uptr, NPF_STATS_SIZE);
    422 	kmem_free(fullst, NPF_STATS_SIZE);
    423 	return error;
    424 }
    425