npf.c revision 1.7.2.6 1 /* $NetBSD: npf.c,v 1.7.2.6 2012/11/24 04:34:42 riz Exp $ */
2
3 /*-
4 * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This material is based upon work partially supported by The
8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32 /*
33 * NPF main: dynamic load/initialisation and unload routines.
34 */
35
36 #include <sys/cdefs.h>
37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.7.2.6 2012/11/24 04:34:42 riz Exp $");
38
39 #include <sys/param.h>
40 #include <sys/types.h>
41
42 #include <sys/atomic.h>
43 #include <sys/conf.h>
44 #include <sys/kauth.h>
45 #include <sys/kmem.h>
46 #include <sys/lwp.h>
47 #include <sys/module.h>
48 #include <sys/percpu.h>
49 #include <sys/rwlock.h>
50 #include <sys/socketvar.h>
51 #include <sys/sysctl.h>
52 #include <sys/uio.h>
53
54 #include "npf_impl.h"
55
56 /*
57 * Module and device structures.
58 */
59 MODULE(MODULE_CLASS_DRIVER, npf, NULL);
60
61 void npfattach(int);
62
63 static int npf_fini(void);
64 static int npf_dev_open(dev_t, int, int, lwp_t *);
65 static int npf_dev_close(dev_t, int, int, lwp_t *);
66 static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
67 static int npf_dev_poll(dev_t, int, lwp_t *);
68 static int npf_dev_read(dev_t, struct uio *, int);
69
70 typedef struct {
71 npf_ruleset_t * n_rules;
72 npf_tableset_t * n_tables;
73 npf_ruleset_t * n_nat_rules;
74 prop_dictionary_t n_dict;
75 bool n_default_pass;
76 } npf_core_t;
77
78 static void npf_core_destroy(npf_core_t *);
79 static int npfctl_stats(void *);
80
81 static krwlock_t npf_lock __cacheline_aligned;
82 static npf_core_t * npf_core __cacheline_aligned;
83 static percpu_t * npf_stats_percpu __read_mostly;
84 static struct sysctllog * npf_sysctl __read_mostly;
85
86 const struct cdevsw npf_cdevsw = {
87 npf_dev_open, npf_dev_close, npf_dev_read, nowrite, npf_dev_ioctl,
88 nostop, notty, npf_dev_poll, nommap, nokqfilter, D_OTHER | D_MPSAFE
89 };
90
91 static int
92 npf_init(void)
93 {
94 #ifdef _MODULE
95 devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
96 #endif
97 npf_ruleset_t *rset, *nset;
98 npf_tableset_t *tset;
99 prop_dictionary_t dict;
100 int error = 0;
101
102 rw_init(&npf_lock);
103 npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE);
104 npf_sysctl = NULL;
105
106 npf_tableset_sysinit();
107 npf_session_sysinit();
108 npf_nat_sysinit();
109 npf_alg_sysinit();
110 npf_ext_sysinit();
111
112 /* Load empty configuration. */
113 dict = prop_dictionary_create();
114 rset = npf_ruleset_create();
115 tset = npf_tableset_create();
116 nset = npf_ruleset_create();
117 npf_reload(dict, rset, tset, nset, true);
118 KASSERT(npf_core != NULL);
119
120 #ifdef _MODULE
121 /* Attach /dev/npf device. */
122 error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
123 if (error) {
124 /* It will call devsw_detach(), which is safe. */
125 (void)npf_fini();
126 }
127 #endif
128 return error;
129 }
130
131 static int
132 npf_fini(void)
133 {
134
135 /* At first, detach device and remove pfil hooks. */
136 #ifdef _MODULE
137 devsw_detach(NULL, &npf_cdevsw);
138 #endif
139 npf_pfil_unregister();
140
141 /* Flush all sessions, destroy configuration (ruleset, etc). */
142 npf_session_tracking(false);
143 npf_core_destroy(npf_core);
144
145 /* Finally, safe to destroy the subsystems. */
146 npf_ext_sysfini();
147 npf_alg_sysfini();
148 npf_nat_sysfini();
149 npf_session_sysfini();
150 npf_tableset_sysfini();
151
152 if (npf_sysctl) {
153 sysctl_teardown(&npf_sysctl);
154 }
155 percpu_free(npf_stats_percpu, NPF_STATS_SIZE);
156 rw_destroy(&npf_lock);
157
158 return 0;
159 }
160
161 /*
162 * Module interface.
163 */
164 static int
165 npf_modcmd(modcmd_t cmd, void *arg)
166 {
167
168 switch (cmd) {
169 case MODULE_CMD_INIT:
170 return npf_init();
171 case MODULE_CMD_FINI:
172 return npf_fini();
173 case MODULE_CMD_AUTOUNLOAD:
174 if (npf_autounload_p()) {
175 return EBUSY;
176 }
177 break;
178 default:
179 return ENOTTY;
180 }
181 return 0;
182 }
183
184 void
185 npfattach(int nunits)
186 {
187
188 /* Void. */
189 }
190
191 static int
192 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
193 {
194
195 /* Available only for super-user. */
196 if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, NULL)) {
197 return EPERM;
198 }
199 return 0;
200 }
201
202 static int
203 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
204 {
205
206 return 0;
207 }
208
209 static int
210 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
211 {
212 int error;
213
214 /* Available only for super-user. */
215 if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, NULL)) {
216 return EPERM;
217 }
218
219 switch (cmd) {
220 case IOC_NPF_VERSION:
221 *(int *)data = NPF_VERSION;
222 error = 0;
223 break;
224 case IOC_NPF_SWITCH:
225 error = npfctl_switch(data);
226 break;
227 case IOC_NPF_RELOAD:
228 error = npfctl_reload(cmd, data);
229 break;
230 case IOC_NPF_GETCONF:
231 error = npfctl_getconf(cmd, data);
232 break;
233 case IOC_NPF_TABLE:
234 error = npfctl_table(data);
235 break;
236 case IOC_NPF_STATS:
237 error = npfctl_stats(data);
238 break;
239 case IOC_NPF_SESSIONS_SAVE:
240 error = npfctl_sessions_save(cmd, data);
241 break;
242 case IOC_NPF_SESSIONS_LOAD:
243 error = npfctl_sessions_load(cmd, data);
244 break;
245 case IOC_NPF_UPDATE_RULE:
246 error = npfctl_update_rule(cmd, data);
247 break;
248 default:
249 error = ENOTTY;
250 break;
251 }
252 return error;
253 }
254
255 static int
256 npf_dev_poll(dev_t dev, int events, lwp_t *l)
257 {
258
259 return ENOTSUP;
260 }
261
262 static int
263 npf_dev_read(dev_t dev, struct uio *uio, int flag)
264 {
265
266 return ENOTSUP;
267 }
268
269 /*
270 * NPF core loading/reloading/unloading mechanism.
271 */
272
273 static void
274 npf_core_destroy(npf_core_t *nc)
275 {
276
277 prop_object_release(nc->n_dict);
278 npf_ruleset_destroy(nc->n_rules);
279 npf_ruleset_destroy(nc->n_nat_rules);
280 npf_tableset_destroy(nc->n_tables);
281 kmem_free(nc, sizeof(npf_core_t));
282 }
283
284 /*
285 * npf_reload: atomically load new ruleset, tableset and NAT policies.
286 * Then destroy old (unloaded) structures.
287 */
288 void
289 npf_reload(prop_dictionary_t dict, npf_ruleset_t *rset,
290 npf_tableset_t *tset, npf_ruleset_t *nset, bool flush)
291 {
292 npf_core_t *nc, *onc;
293
294 /* Setup a new core structure. */
295 nc = kmem_zalloc(sizeof(npf_core_t), KM_SLEEP);
296 nc->n_rules = rset;
297 nc->n_tables = tset;
298 nc->n_nat_rules = nset;
299 nc->n_dict = dict;
300 nc->n_default_pass = flush;
301
302 /* Lock and load the core structure. */
303 rw_enter(&npf_lock, RW_WRITER);
304 onc = atomic_swap_ptr(&npf_core, nc);
305 if (onc) {
306 /* Reload only the static tables. */
307 npf_tableset_reload(tset, onc->n_tables);
308 /* Reload only the necessary NAT policies. */
309 npf_ruleset_natreload(nset, onc->n_nat_rules);
310 }
311 /* Unlock. Everything goes "live" now. */
312 rw_exit(&npf_lock);
313
314 if (onc) {
315 /* Destroy unloaded structures. */
316 npf_core_destroy(onc);
317 }
318 }
319
320 void
321 npf_core_enter(void)
322 {
323 rw_enter(&npf_lock, RW_READER);
324 }
325
326 npf_ruleset_t *
327 npf_core_ruleset(void)
328 {
329 KASSERT(rw_lock_held(&npf_lock));
330 return npf_core->n_rules;
331 }
332
333 npf_ruleset_t *
334 npf_core_natset(void)
335 {
336 KASSERT(rw_lock_held(&npf_lock));
337 return npf_core->n_nat_rules;
338 }
339
340 npf_tableset_t *
341 npf_core_tableset(void)
342 {
343 KASSERT(rw_lock_held(&npf_lock));
344 return npf_core->n_tables;
345 }
346
347 void
348 npf_core_exit(void)
349 {
350 rw_exit(&npf_lock);
351 }
352
353 bool
354 npf_core_locked(void)
355 {
356 return rw_lock_held(&npf_lock);
357 }
358
359 prop_dictionary_t
360 npf_core_dict(void)
361 {
362 KASSERT(rw_lock_held(&npf_lock));
363 return npf_core->n_dict;
364 }
365
366 bool
367 npf_default_pass(void)
368 {
369 KASSERT(rw_lock_held(&npf_lock));
370 return npf_core->n_default_pass;
371 }
372
373 bool
374 npf_autounload_p(void)
375 {
376 return !npf_pfil_registered_p() && npf_default_pass();
377 }
378
379 /*
380 * NPF statistics interface.
381 */
382
383 void
384 npf_stats_inc(npf_stats_t st)
385 {
386 uint64_t *stats = percpu_getref(npf_stats_percpu);
387 stats[st]++;
388 percpu_putref(npf_stats_percpu);
389 }
390
391 void
392 npf_stats_dec(npf_stats_t st)
393 {
394 uint64_t *stats = percpu_getref(npf_stats_percpu);
395 stats[st]--;
396 percpu_putref(npf_stats_percpu);
397 }
398
399 static void
400 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci)
401 {
402 uint64_t *percpu_stats = mem, *full_stats = arg;
403 int i;
404
405 for (i = 0; i < NPF_STATS_COUNT; i++) {
406 full_stats[i] += percpu_stats[i];
407 }
408 }
409
410 /*
411 * npfctl_stats: export collected statistics.
412 */
413 static int
414 npfctl_stats(void *data)
415 {
416 uint64_t *fullst, *uptr = *(uint64_t **)data;
417 int error;
418
419 fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP);
420 percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst);
421 error = copyout(fullst, uptr, NPF_STATS_SIZE);
422 kmem_free(fullst, NPF_STATS_SIZE);
423 return error;
424 }
425