Home | History | Annotate | Line # | Download | only in npf
npf_conn.c revision 1.16
      1  1.16     rmind /*	$NetBSD: npf_conn.c,v 1.16 2015/02/05 22:04:03 rmind Exp $	*/
      2   1.1     rmind 
      3   1.1     rmind /*-
      4  1.15     rmind  * Copyright (c) 2014-2015 Mindaugas Rasiukevicius <rmind at netbsd org>
      5   1.1     rmind  * Copyright (c) 2010-2014 The NetBSD Foundation, Inc.
      6   1.1     rmind  * All rights reserved.
      7   1.1     rmind  *
      8   1.1     rmind  * This material is based upon work partially supported by The
      9   1.1     rmind  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
     10   1.1     rmind  *
     11   1.1     rmind  * Redistribution and use in source and binary forms, with or without
     12   1.1     rmind  * modification, are permitted provided that the following conditions
     13   1.1     rmind  * are met:
     14   1.1     rmind  * 1. Redistributions of source code must retain the above copyright
     15   1.1     rmind  *    notice, this list of conditions and the following disclaimer.
     16   1.1     rmind  * 2. Redistributions in binary form must reproduce the above copyright
     17   1.1     rmind  *    notice, this list of conditions and the following disclaimer in the
     18   1.1     rmind  *    documentation and/or other materials provided with the distribution.
     19   1.1     rmind  *
     20   1.1     rmind  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     21   1.1     rmind  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     22   1.1     rmind  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     23   1.1     rmind  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     24   1.1     rmind  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     25   1.1     rmind  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     26   1.1     rmind  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     27   1.1     rmind  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     28   1.1     rmind  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     29   1.1     rmind  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     30   1.1     rmind  * POSSIBILITY OF SUCH DAMAGE.
     31   1.1     rmind  */
     32   1.1     rmind 
     33   1.1     rmind /*
     34   1.1     rmind  * NPF connection tracking for stateful filtering and translation.
     35   1.1     rmind  *
     36   1.1     rmind  * Overview
     37   1.1     rmind  *
     38   1.1     rmind  *	Connection direction is identified by the direction of its first
     39   1.1     rmind  *	packet.  Packets can be incoming or outgoing with respect to an
     40   1.1     rmind  *	interface.  To describe the packet in the context of connection
     41   1.1     rmind  *	direction we will use the terms "forwards stream" and "backwards
     42   1.1     rmind  *	stream".  All connections have two keys and thus two entries:
     43   1.1     rmind  *
     44   1.1     rmind  *		npf_conn_t::c_forw_entry for the forwards stream and
     45   1.1     rmind  *		npf_conn_t::c_back_entry for the backwards stream.
     46   1.1     rmind  *
     47   1.1     rmind  *	The keys are formed from the 5-tuple (source/destination address,
     48   1.1     rmind  *	source/destination port and the protocol).  Additional matching
     49   1.1     rmind  *	is performed for the interface (a common behaviour is equivalent
     50   1.1     rmind  *	to the 6-tuple lookup including the interface ID).  Note that the
     51   1.1     rmind  *	key may be formed using translated values in a case of NAT.
     52   1.1     rmind  *
     53   1.1     rmind  *	Connections can serve two purposes: for the implicit passing or
     54   1.1     rmind  *	to accommodate the dynamic NAT.  Connections for the former purpose
     55   1.1     rmind  *	are created by the rules with "stateful" attribute and are used for
     56   1.1     rmind  *	stateful filtering.  Such connections indicate that the packet of
     57   1.1     rmind  *	the backwards stream should be passed without inspection of the
     58   1.1     rmind  *	ruleset.  The other purpose is to associate a dynamic NAT mechanism
     59   1.1     rmind  *	with a connection.  Such connections are created by the NAT policies
     60   1.1     rmind  *	and they have a relationship with NAT translation structure via
     61   1.1     rmind  *	npf_conn_t::c_nat.  A single connection can serve both purposes,
     62   1.1     rmind  *	which is a common case.
     63   1.1     rmind  *
     64   1.1     rmind  * Connection life-cycle
     65   1.1     rmind  *
     66   1.1     rmind  *	Connections are established when a packet matches said rule or
     67   1.1     rmind  *	NAT policy.  Both keys of the established connection are inserted
     68   1.1     rmind  *	into the connection database.  A garbage collection thread
     69   1.1     rmind  *	periodically scans all connections and depending on connection
     70   1.1     rmind  *	properties (e.g. last activity time, protocol) removes connection
     71   1.1     rmind  *	entries and expires the actual connections.
     72   1.1     rmind  *
     73   1.1     rmind  *	Each connection has a reference count.  The reference is acquired
     74   1.1     rmind  *	on lookup and should be released by the caller.  It guarantees that
     75   1.1     rmind  *	the connection will not be destroyed, although it may be expired.
     76   1.1     rmind  *
     77   1.1     rmind  * Synchronisation
     78   1.1     rmind  *
     79   1.1     rmind  *	Connection database is accessed in a lock-less manner by the main
     80   1.1     rmind  *	routines: npf_conn_inspect() and npf_conn_establish().  Since they
     81   1.1     rmind  *	are always called from a software interrupt, the database is
     82   1.1     rmind  *	protected using passive serialisation.  The main place which can
     83   1.1     rmind  *	destroy a connection is npf_conn_worker().  The database itself
     84   1.1     rmind  *	can be replaced and destroyed in npf_conn_reload().
     85   1.1     rmind  *
     86   1.1     rmind  * ALG support
     87   1.1     rmind  *
     88   1.1     rmind  *	Application-level gateways (ALGs) can override generic connection
     89   1.1     rmind  *	inspection (npf_alg_conn() call in npf_conn_inspect() function) by
     90   1.1     rmind  *	performing their own lookup using different key.  Recursive call
     91   1.1     rmind  *	to npf_conn_inspect() is not allowed.  The ALGs ought to use the
     92   1.1     rmind  *	npf_conn_lookup() function for this purpose.
     93   1.1     rmind  *
     94   1.1     rmind  * Lock order
     95   1.1     rmind  *
     96   1.6     rmind  *	npf_config_lock ->
     97   1.6     rmind  *		conn_lock ->
     98   1.6     rmind  *			npf_conn_t::c_lock
     99   1.1     rmind  */
    100   1.1     rmind 
    101   1.1     rmind #include <sys/cdefs.h>
    102  1.16     rmind __KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.16 2015/02/05 22:04:03 rmind Exp $");
    103   1.1     rmind 
    104   1.1     rmind #include <sys/param.h>
    105   1.1     rmind #include <sys/types.h>
    106   1.1     rmind 
    107   1.1     rmind #include <netinet/in.h>
    108   1.1     rmind #include <netinet/tcp.h>
    109   1.1     rmind 
    110   1.1     rmind #include <sys/atomic.h>
    111   1.1     rmind #include <sys/condvar.h>
    112   1.1     rmind #include <sys/kmem.h>
    113   1.1     rmind #include <sys/kthread.h>
    114   1.1     rmind #include <sys/mutex.h>
    115   1.1     rmind #include <net/pfil.h>
    116   1.1     rmind #include <sys/pool.h>
    117   1.1     rmind #include <sys/queue.h>
    118   1.1     rmind #include <sys/systm.h>
    119   1.1     rmind 
    120   1.1     rmind #define __NPF_CONN_PRIVATE
    121   1.1     rmind #include "npf_conn.h"
    122   1.1     rmind #include "npf_impl.h"
    123   1.1     rmind 
    124   1.1     rmind /*
    125   1.1     rmind  * Connection flags: PFIL_IN and PFIL_OUT values are reserved for direction.
    126   1.1     rmind  */
    127   1.1     rmind CTASSERT(PFIL_ALL == (0x001 | 0x002));
    128   1.1     rmind #define	CONN_ACTIVE	0x004	/* visible on inspection */
    129   1.1     rmind #define	CONN_PASS	0x008	/* perform implicit passing */
    130   1.1     rmind #define	CONN_EXPIRE	0x010	/* explicitly expire */
    131   1.1     rmind #define	CONN_REMOVED	0x020	/* "forw/back" entries removed */
    132   1.1     rmind 
    133   1.1     rmind /*
    134   1.6     rmind  * Connection tracking state: disabled (off) or enabled (on).
    135   1.1     rmind  */
    136   1.6     rmind enum { CONN_TRACKING_OFF, CONN_TRACKING_ON };
    137   1.1     rmind static volatile int	conn_tracking	__cacheline_aligned;
    138   1.1     rmind 
    139   1.1     rmind /* Connection tracking database, connection cache and the lock. */
    140   1.1     rmind static npf_conndb_t *	conn_db		__read_mostly;
    141   1.1     rmind static pool_cache_t	conn_cache	__read_mostly;
    142   1.1     rmind static kmutex_t		conn_lock	__cacheline_aligned;
    143   1.1     rmind 
    144   1.1     rmind static void	npf_conn_worker(void);
    145   1.1     rmind static void	npf_conn_destroy(npf_conn_t *);
    146   1.1     rmind 
    147   1.1     rmind /*
    148   1.1     rmind  * npf_conn_sys{init,fini}: initialise/destroy connection tracking.
    149   1.1     rmind  */
    150   1.1     rmind 
    151   1.1     rmind void
    152   1.1     rmind npf_conn_sysinit(void)
    153   1.1     rmind {
    154   1.1     rmind 	conn_cache = pool_cache_init(sizeof(npf_conn_t), coherency_unit,
    155   1.1     rmind 	    0, 0, "npfconpl", NULL, IPL_NET, NULL, NULL, NULL);
    156   1.1     rmind 	mutex_init(&conn_lock, MUTEX_DEFAULT, IPL_NONE);
    157   1.1     rmind 	conn_tracking = CONN_TRACKING_OFF;
    158   1.6     rmind 	conn_db = npf_conndb_create();
    159   1.1     rmind 
    160   1.1     rmind 	npf_worker_register(npf_conn_worker);
    161   1.1     rmind }
    162   1.1     rmind 
    163   1.1     rmind void
    164   1.1     rmind npf_conn_sysfini(void)
    165   1.1     rmind {
    166   1.6     rmind 	/* Note: the caller should have flushed the connections. */
    167   1.6     rmind 	KASSERT(conn_tracking == CONN_TRACKING_OFF);
    168   1.1     rmind 	npf_worker_unregister(npf_conn_worker);
    169   1.1     rmind 
    170   1.6     rmind 	npf_conndb_destroy(conn_db);
    171   1.1     rmind 	pool_cache_destroy(conn_cache);
    172   1.1     rmind 	mutex_destroy(&conn_lock);
    173   1.1     rmind }
    174   1.1     rmind 
    175   1.1     rmind /*
    176   1.6     rmind  * npf_conn_load: perform the load by flushing the current connection
    177   1.6     rmind  * database and replacing it with the new one or just destroying.
    178   1.1     rmind  *
    179   1.6     rmind  * => The caller must disable the connection tracking and ensure that
    180   1.6     rmind  *    there are no connection database lookups or references in-flight.
    181   1.1     rmind  */
    182   1.6     rmind void
    183   1.6     rmind npf_conn_load(npf_conndb_t *ndb, bool track)
    184   1.1     rmind {
    185   1.6     rmind 	npf_conndb_t *odb = NULL;
    186   1.1     rmind 
    187   1.6     rmind 	KASSERT(npf_config_locked_p());
    188   1.1     rmind 
    189   1.1     rmind 	/*
    190   1.6     rmind 	 * The connection database is in the quiescent state.
    191   1.6     rmind 	 * Prevent G/C thread from running and install a new database.
    192   1.1     rmind 	 */
    193   1.6     rmind 	mutex_enter(&conn_lock);
    194   1.6     rmind 	if (ndb) {
    195   1.6     rmind 		KASSERT(conn_tracking == CONN_TRACKING_OFF);
    196   1.6     rmind 		odb = conn_db;
    197   1.6     rmind 		conn_db = ndb;
    198   1.6     rmind 		membar_sync();
    199   1.6     rmind 	}
    200   1.6     rmind 	if (track) {
    201   1.6     rmind 		/* After this point lookups start flying in. */
    202   1.6     rmind 		conn_tracking = CONN_TRACKING_ON;
    203   1.1     rmind 	}
    204   1.6     rmind 	mutex_exit(&conn_lock);
    205   1.1     rmind 
    206   1.1     rmind 	if (odb) {
    207   1.6     rmind 		/*
    208   1.6     rmind 		 * Flush all, no sync since the caller did it for us.
    209   1.6     rmind 		 * Also, release the pool cache memory.
    210   1.6     rmind 		 */
    211   1.6     rmind 		npf_conn_gc(odb, true, false);
    212   1.1     rmind 		npf_conndb_destroy(odb);
    213   1.6     rmind 		pool_cache_invalidate(conn_cache);
    214   1.1     rmind 	}
    215   1.1     rmind }
    216   1.1     rmind 
    217   1.1     rmind /*
    218   1.1     rmind  * npf_conn_tracking: enable/disable connection tracking.
    219   1.1     rmind  */
    220   1.1     rmind void
    221   1.1     rmind npf_conn_tracking(bool track)
    222   1.1     rmind {
    223   1.6     rmind 	KASSERT(npf_config_locked_p());
    224   1.6     rmind 	conn_tracking = track ? CONN_TRACKING_ON : CONN_TRACKING_OFF;
    225   1.1     rmind }
    226   1.1     rmind 
    227   1.6     rmind static inline bool
    228   1.1     rmind npf_conn_trackable_p(const npf_cache_t *npc)
    229   1.1     rmind {
    230   1.1     rmind 	/*
    231   1.1     rmind 	 * Check if connection tracking is on.  Also, if layer 3 and 4 are
    232   1.1     rmind 	 * not cached - protocol is not supported or packet is invalid.
    233   1.1     rmind 	 */
    234   1.1     rmind 	if (conn_tracking != CONN_TRACKING_ON) {
    235   1.1     rmind 		return false;
    236   1.1     rmind 	}
    237   1.1     rmind 	if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) {
    238   1.1     rmind 		return false;
    239   1.1     rmind 	}
    240   1.1     rmind 	return true;
    241   1.1     rmind }
    242   1.1     rmind 
    243   1.1     rmind /*
    244   1.1     rmind  * npf_conn_conkey: construct a key for the connection lookup.
    245   1.8     rmind  *
    246   1.8     rmind  * => Returns the key length in bytes or zero on failure.
    247   1.1     rmind  */
    248   1.8     rmind unsigned
    249   1.1     rmind npf_conn_conkey(const npf_cache_t *npc, npf_connkey_t *key, const bool forw)
    250   1.1     rmind {
    251   1.1     rmind 	const u_int alen = npc->npc_alen;
    252   1.1     rmind 	const struct tcphdr *th;
    253   1.1     rmind 	const struct udphdr *uh;
    254   1.1     rmind 	u_int keylen, isrc, idst;
    255   1.1     rmind 	uint16_t id[2];
    256   1.1     rmind 
    257   1.1     rmind 	switch (npc->npc_proto) {
    258   1.1     rmind 	case IPPROTO_TCP:
    259   1.1     rmind 		KASSERT(npf_iscached(npc, NPC_TCP));
    260   1.1     rmind 		th = npc->npc_l4.tcp;
    261   1.1     rmind 		id[NPF_SRC] = th->th_sport;
    262   1.1     rmind 		id[NPF_DST] = th->th_dport;
    263   1.1     rmind 		break;
    264   1.1     rmind 	case IPPROTO_UDP:
    265   1.1     rmind 		KASSERT(npf_iscached(npc, NPC_UDP));
    266   1.1     rmind 		uh = npc->npc_l4.udp;
    267   1.1     rmind 		id[NPF_SRC] = uh->uh_sport;
    268   1.1     rmind 		id[NPF_DST] = uh->uh_dport;
    269   1.1     rmind 		break;
    270   1.1     rmind 	case IPPROTO_ICMP:
    271   1.1     rmind 		if (npf_iscached(npc, NPC_ICMP_ID)) {
    272   1.1     rmind 			const struct icmp *ic = npc->npc_l4.icmp;
    273   1.1     rmind 			id[NPF_SRC] = ic->icmp_id;
    274   1.1     rmind 			id[NPF_DST] = ic->icmp_id;
    275   1.1     rmind 			break;
    276   1.1     rmind 		}
    277   1.8     rmind 		return 0;
    278   1.1     rmind 	case IPPROTO_ICMPV6:
    279   1.1     rmind 		if (npf_iscached(npc, NPC_ICMP_ID)) {
    280   1.1     rmind 			const struct icmp6_hdr *ic6 = npc->npc_l4.icmp6;
    281   1.1     rmind 			id[NPF_SRC] = ic6->icmp6_id;
    282   1.1     rmind 			id[NPF_DST] = ic6->icmp6_id;
    283   1.1     rmind 			break;
    284   1.1     rmind 		}
    285   1.8     rmind 		return 0;
    286   1.1     rmind 	default:
    287   1.1     rmind 		/* Unsupported protocol. */
    288   1.8     rmind 		return 0;
    289   1.1     rmind 	}
    290   1.1     rmind 
    291   1.1     rmind 	if (__predict_true(forw)) {
    292   1.1     rmind 		isrc = NPF_SRC, idst = NPF_DST;
    293   1.1     rmind 	} else {
    294   1.1     rmind 		isrc = NPF_DST, idst = NPF_SRC;
    295   1.1     rmind 	}
    296   1.1     rmind 
    297   1.8     rmind 	/*
    298   1.8     rmind 	 * Construct a key formed out of 32-bit integers.  The key layout:
    299   1.8     rmind 	 *
    300   1.9     rmind 	 * Field: | proto  |  alen  | src-id | dst-id | src-addr | dst-addr |
    301   1.9     rmind 	 *        +--------+--------+--------+--------+----------+----------+
    302   1.9     rmind 	 * Bits:  |   16   |   16   |   16   |   16   |  32-128  |  32-128  |
    303   1.8     rmind 	 *
    304   1.8     rmind 	 * The source and destination are inverted if they key is for the
    305   1.8     rmind 	 * backwards stream (forw == false).  The address length depends
    306   1.8     rmind 	 * on the 'alen' field; it is a length in bytes, either 4 or 16.
    307   1.8     rmind 	 */
    308   1.8     rmind 
    309   1.1     rmind 	key->ck_key[0] = ((uint32_t)npc->npc_proto << 16) | (alen & 0xffff);
    310   1.1     rmind 	key->ck_key[1] = ((uint32_t)id[isrc] << 16) | id[idst];
    311   1.1     rmind 
    312   1.1     rmind 	if (__predict_true(alen == sizeof(in_addr_t))) {
    313   1.1     rmind 		key->ck_key[2] = npc->npc_ips[isrc]->s6_addr32[0];
    314   1.1     rmind 		key->ck_key[3] = npc->npc_ips[idst]->s6_addr32[0];
    315   1.1     rmind 		keylen = 4 * sizeof(uint32_t);
    316   1.1     rmind 	} else {
    317   1.1     rmind 		const u_int nwords = alen >> 2;
    318   1.1     rmind 		memcpy(&key->ck_key[2], npc->npc_ips[isrc], alen);
    319   1.1     rmind 		memcpy(&key->ck_key[2 + nwords], npc->npc_ips[idst], alen);
    320   1.1     rmind 		keylen = (2 + (nwords * 2)) * sizeof(uint32_t);
    321   1.1     rmind 	}
    322   1.8     rmind 	return keylen;
    323   1.1     rmind }
    324   1.1     rmind 
    325   1.3  christos static __inline void
    326   1.1     rmind connkey_set_addr(npf_connkey_t *key, const npf_addr_t *naddr, const int di)
    327   1.1     rmind {
    328   1.1     rmind 	const u_int alen = key->ck_key[0] & 0xffff;
    329   1.1     rmind 	uint32_t *addr = &key->ck_key[2 + ((alen >> 2) * di)];
    330   1.1     rmind 
    331   1.1     rmind 	KASSERT(alen > 0);
    332   1.1     rmind 	memcpy(addr, naddr, alen);
    333   1.1     rmind }
    334   1.1     rmind 
    335   1.3  christos static __inline void
    336   1.1     rmind connkey_set_id(npf_connkey_t *key, const uint16_t id, const int di)
    337   1.1     rmind {
    338   1.1     rmind 	const uint32_t oid = key->ck_key[1];
    339   1.1     rmind 	const u_int shift = 16 * !di;
    340   1.1     rmind 	const uint32_t mask = 0xffff0000 >> shift;
    341   1.1     rmind 
    342   1.1     rmind 	key->ck_key[1] = ((uint32_t)id << shift) | (oid & mask);
    343   1.1     rmind }
    344   1.1     rmind 
    345   1.1     rmind /*
    346   1.1     rmind  * npf_conn_lookup: lookup if there is an established connection.
    347   1.1     rmind  *
    348   1.1     rmind  * => If found, we will hold a reference for the caller.
    349   1.1     rmind  */
    350   1.1     rmind npf_conn_t *
    351   1.4     rmind npf_conn_lookup(const npf_cache_t *npc, const int di, bool *forw)
    352   1.1     rmind {
    353   1.4     rmind 	const nbuf_t *nbuf = npc->npc_nbuf;
    354   1.1     rmind 	npf_conn_t *con;
    355   1.1     rmind 	npf_connkey_t key;
    356   1.1     rmind 	u_int flags, cifid;
    357   1.1     rmind 	bool ok, pforw;
    358   1.1     rmind 
    359   1.1     rmind 	/* Construct a key and lookup for a connection in the store. */
    360   1.1     rmind 	if (!npf_conn_conkey(npc, &key, true)) {
    361   1.1     rmind 		return NULL;
    362   1.1     rmind 	}
    363   1.1     rmind 	con = npf_conndb_lookup(conn_db, &key, forw);
    364   1.1     rmind 	if (con == NULL) {
    365   1.1     rmind 		return NULL;
    366   1.1     rmind 	}
    367   1.1     rmind 	KASSERT(npc->npc_proto == con->c_proto);
    368   1.1     rmind 
    369   1.1     rmind 	/* Check if connection is active and not expired. */
    370   1.1     rmind 	flags = con->c_flags;
    371   1.1     rmind 	ok = (flags & (CONN_ACTIVE | CONN_EXPIRE)) == CONN_ACTIVE;
    372   1.1     rmind 	if (__predict_false(!ok)) {
    373   1.1     rmind 		atomic_dec_uint(&con->c_refcnt);
    374   1.1     rmind 		return NULL;
    375   1.1     rmind 	}
    376   1.1     rmind 
    377   1.1     rmind 	/*
    378   1.1     rmind 	 * Match the interface and the direction of the connection entry
    379   1.1     rmind 	 * and the packet.
    380   1.1     rmind 	 */
    381   1.1     rmind 	cifid = con->c_ifid;
    382   1.1     rmind 	if (__predict_false(cifid && cifid != nbuf->nb_ifid)) {
    383   1.1     rmind 		atomic_dec_uint(&con->c_refcnt);
    384   1.1     rmind 		return NULL;
    385   1.1     rmind 	}
    386   1.1     rmind 	pforw = (flags & PFIL_ALL) == di;
    387   1.1     rmind 	if (__predict_false(*forw != pforw)) {
    388   1.1     rmind 		atomic_dec_uint(&con->c_refcnt);
    389   1.1     rmind 		return NULL;
    390   1.1     rmind 	}
    391   1.1     rmind 
    392   1.1     rmind 	/* Update the last activity time. */
    393   1.1     rmind 	getnanouptime(&con->c_atime);
    394   1.1     rmind 	return con;
    395   1.1     rmind }
    396   1.1     rmind 
    397   1.1     rmind /*
    398   1.1     rmind  * npf_conn_inspect: lookup a connection and inspecting the protocol data.
    399   1.1     rmind  *
    400   1.1     rmind  * => If found, we will hold a reference for the caller.
    401   1.1     rmind  */
    402   1.1     rmind npf_conn_t *
    403   1.4     rmind npf_conn_inspect(npf_cache_t *npc, const int di, int *error)
    404   1.1     rmind {
    405   1.4     rmind 	nbuf_t *nbuf = npc->npc_nbuf;
    406   1.1     rmind 	npf_conn_t *con;
    407   1.1     rmind 	bool forw, ok;
    408   1.1     rmind 
    409   1.1     rmind 	KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
    410   1.1     rmind 	if (!npf_conn_trackable_p(npc)) {
    411   1.1     rmind 		return NULL;
    412   1.1     rmind 	}
    413   1.1     rmind 
    414   1.1     rmind 	/* Query ALG which may lookup connection for us. */
    415   1.4     rmind 	if ((con = npf_alg_conn(npc, di)) != NULL) {
    416   1.1     rmind 		/* Note: reference is held. */
    417   1.1     rmind 		return con;
    418   1.1     rmind 	}
    419   1.1     rmind 	if (nbuf_head_mbuf(nbuf) == NULL) {
    420   1.1     rmind 		*error = ENOMEM;
    421   1.1     rmind 		return NULL;
    422   1.1     rmind 	}
    423   1.1     rmind 	KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
    424   1.1     rmind 
    425   1.1     rmind 	/* Main lookup of the connection. */
    426   1.4     rmind 	if ((con = npf_conn_lookup(npc, di, &forw)) == NULL) {
    427   1.1     rmind 		return NULL;
    428   1.1     rmind 	}
    429   1.1     rmind 
    430   1.1     rmind 	/* Inspect the protocol data and handle state changes. */
    431   1.1     rmind 	mutex_enter(&con->c_lock);
    432   1.4     rmind 	ok = npf_state_inspect(npc, &con->c_state, forw);
    433   1.1     rmind 	mutex_exit(&con->c_lock);
    434   1.1     rmind 
    435   1.1     rmind 	if (__predict_false(!ok)) {
    436   1.1     rmind 		/* Invalid: let the rules deal with it. */
    437   1.1     rmind 		npf_conn_release(con);
    438   1.1     rmind 		npf_stats_inc(NPF_STAT_INVALID_STATE);
    439   1.1     rmind 		con = NULL;
    440   1.1     rmind 	}
    441   1.1     rmind 	return con;
    442   1.1     rmind }
    443   1.1     rmind 
    444   1.1     rmind /*
    445   1.1     rmind  * npf_conn_establish: create a new connection, insert into the global list.
    446   1.1     rmind  *
    447   1.1     rmind  * => Connection is created with the reference held for the caller.
    448   1.1     rmind  * => Connection will be activated on the first reference release.
    449   1.1     rmind  */
    450   1.1     rmind npf_conn_t *
    451   1.4     rmind npf_conn_establish(npf_cache_t *npc, int di, bool per_if)
    452   1.1     rmind {
    453   1.4     rmind 	const nbuf_t *nbuf = npc->npc_nbuf;
    454   1.1     rmind 	npf_conn_t *con;
    455  1.15     rmind 	int error = 0;
    456   1.1     rmind 
    457   1.1     rmind 	KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
    458   1.1     rmind 
    459   1.1     rmind 	if (!npf_conn_trackable_p(npc)) {
    460   1.1     rmind 		return NULL;
    461   1.1     rmind 	}
    462   1.1     rmind 
    463   1.1     rmind 	/* Allocate and initialise the new connection. */
    464   1.1     rmind 	con = pool_cache_get(conn_cache, PR_NOWAIT);
    465   1.1     rmind 	if (__predict_false(!con)) {
    466   1.1     rmind 		return NULL;
    467   1.1     rmind 	}
    468   1.1     rmind 	NPF_PRINTF(("NPF: create conn %p\n", con));
    469   1.6     rmind 	npf_stats_inc(NPF_STAT_CONN_CREATE);
    470   1.1     rmind 
    471   1.1     rmind 	mutex_init(&con->c_lock, MUTEX_DEFAULT, IPL_SOFTNET);
    472   1.1     rmind 	con->c_flags = (di & PFIL_ALL);
    473  1.15     rmind 	con->c_refcnt = 0;
    474   1.1     rmind 	con->c_rproc = NULL;
    475   1.1     rmind 	con->c_nat = NULL;
    476   1.1     rmind 
    477  1.15     rmind 	/* Initialize the protocol state. */
    478   1.4     rmind 	if (!npf_state_init(npc, &con->c_state)) {
    479  1.15     rmind 		npf_conn_destroy(con);
    480  1.15     rmind 		return NULL;
    481   1.1     rmind 	}
    482   1.1     rmind 
    483   1.1     rmind 	KASSERT(npf_iscached(npc, NPC_IP46));
    484   1.1     rmind 	npf_connkey_t *fw = &con->c_forw_entry;
    485   1.1     rmind 	npf_connkey_t *bk = &con->c_back_entry;
    486   1.1     rmind 
    487   1.1     rmind 	/*
    488   1.1     rmind 	 * Construct "forwards" and "backwards" keys.  Also, set the
    489   1.1     rmind 	 * interface ID for this connection (unless it is global).
    490   1.1     rmind 	 */
    491  1.15     rmind 	if (!npf_conn_conkey(npc, fw, true) ||
    492  1.15     rmind 	    !npf_conn_conkey(npc, bk, false)) {
    493  1.15     rmind 		npf_conn_destroy(con);
    494  1.15     rmind 		return NULL;
    495   1.1     rmind 	}
    496   1.1     rmind 	fw->ck_backptr = bk->ck_backptr = con;
    497   1.1     rmind 	con->c_ifid = per_if ? nbuf->nb_ifid : 0;
    498   1.1     rmind 	con->c_proto = npc->npc_proto;
    499   1.1     rmind 
    500  1.15     rmind 	/*
    501  1.15     rmind 	 * Set last activity time for a new connection and acquire
    502  1.15     rmind 	 * a reference for the caller before we make it visible.
    503  1.15     rmind 	 */
    504   1.1     rmind 	getnanouptime(&con->c_atime);
    505  1.15     rmind 	con->c_refcnt = 1;
    506   1.1     rmind 
    507   1.1     rmind 	/*
    508   1.1     rmind 	 * Insert both keys (entries representing directions) of the
    509  1.15     rmind 	 * connection.  At this point it becomes visible, but we activate
    510  1.15     rmind 	 * the connection later.
    511   1.1     rmind 	 */
    512  1.15     rmind 	mutex_enter(&con->c_lock);
    513   1.1     rmind 	if (!npf_conndb_insert(conn_db, fw, con)) {
    514  1.15     rmind 		error = EISCONN;
    515   1.1     rmind 		goto err;
    516   1.1     rmind 	}
    517   1.1     rmind 	if (!npf_conndb_insert(conn_db, bk, con)) {
    518  1.15     rmind 		npf_conn_t *ret __diagused;
    519  1.15     rmind 		ret = npf_conndb_remove(conn_db, fw);
    520  1.15     rmind 		KASSERT(ret == con);
    521  1.15     rmind 		error = EISCONN;
    522  1.15     rmind 		goto err;
    523  1.15     rmind 	}
    524  1.15     rmind err:
    525  1.15     rmind 	/*
    526  1.15     rmind 	 * If we have hit the duplicate: mark the connection as expired
    527  1.15     rmind 	 * and let the G/C thread to take care of it.  We cannot do it
    528  1.15     rmind 	 * here since there might be references acquired already.
    529  1.15     rmind 	 */
    530  1.15     rmind 	if (error) {
    531  1.16     rmind 		atomic_or_uint(&con->c_flags, CONN_REMOVED | CONN_EXPIRE);
    532  1.16     rmind 		atomic_dec_uint(&con->c_refcnt);
    533   1.6     rmind 		npf_stats_inc(NPF_STAT_RACE_CONN);
    534  1.15     rmind 	} else {
    535  1.15     rmind 		NPF_PRINTF(("NPF: establish conn %p\n", con));
    536   1.1     rmind 	}
    537   1.1     rmind 
    538   1.1     rmind 	/* Finally, insert into the connection list. */
    539   1.1     rmind 	npf_conndb_enqueue(conn_db, con);
    540  1.15     rmind 	mutex_exit(&con->c_lock);
    541  1.15     rmind 
    542  1.15     rmind 	return error ? NULL : con;
    543   1.1     rmind }
    544   1.1     rmind 
    545   1.1     rmind static void
    546   1.1     rmind npf_conn_destroy(npf_conn_t *con)
    547   1.1     rmind {
    548  1.15     rmind 	KASSERT(con->c_refcnt == 0);
    549  1.15     rmind 
    550   1.1     rmind 	if (con->c_nat) {
    551   1.1     rmind 		/* Release any NAT structures. */
    552   1.1     rmind 		npf_nat_destroy(con->c_nat);
    553   1.1     rmind 	}
    554   1.1     rmind 	if (con->c_rproc) {
    555   1.1     rmind 		/* Release the rule procedure. */
    556   1.1     rmind 		npf_rproc_release(con->c_rproc);
    557   1.1     rmind 	}
    558   1.1     rmind 
    559   1.1     rmind 	/* Destroy the state. */
    560   1.1     rmind 	npf_state_destroy(&con->c_state);
    561   1.1     rmind 	mutex_destroy(&con->c_lock);
    562   1.1     rmind 
    563   1.1     rmind 	/* Free the structure, increase the counter. */
    564   1.1     rmind 	pool_cache_put(conn_cache, con);
    565   1.6     rmind 	npf_stats_inc(NPF_STAT_CONN_DESTROY);
    566   1.1     rmind 	NPF_PRINTF(("NPF: conn %p destroyed\n", con));
    567   1.1     rmind }
    568   1.1     rmind 
    569   1.1     rmind /*
    570   1.1     rmind  * npf_conn_setnat: associate NAT entry with the connection, update and
    571   1.1     rmind  * re-insert connection entry using the translation values.
    572  1.16     rmind  *
    573  1.16     rmind  * => The caller must be holding a reference.
    574   1.1     rmind  */
    575   1.1     rmind int
    576   1.1     rmind npf_conn_setnat(const npf_cache_t *npc, npf_conn_t *con,
    577   1.1     rmind     npf_nat_t *nt, u_int ntype)
    578   1.1     rmind {
    579   1.1     rmind 	static const u_int nat_type_dimap[] = {
    580   1.1     rmind 		[NPF_NATOUT] = NPF_DST,
    581   1.1     rmind 		[NPF_NATIN] = NPF_SRC,
    582   1.1     rmind 	};
    583   1.1     rmind 	npf_connkey_t key, *bk;
    584   1.2     rmind 	npf_conn_t *ret __diagused;
    585   1.1     rmind 	npf_addr_t *taddr;
    586   1.1     rmind 	in_port_t tport;
    587   1.1     rmind 	u_int tidx;
    588   1.1     rmind 
    589   1.1     rmind 	KASSERT(con->c_refcnt > 0);
    590   1.1     rmind 
    591   1.1     rmind 	npf_nat_gettrans(nt, &taddr, &tport);
    592   1.1     rmind 	KASSERT(ntype == NPF_NATOUT || ntype == NPF_NATIN);
    593   1.1     rmind 	tidx = nat_type_dimap[ntype];
    594   1.1     rmind 
    595   1.1     rmind 	/* Construct a "backwards" key. */
    596   1.1     rmind 	if (!npf_conn_conkey(npc, &key, false)) {
    597   1.1     rmind 		return EINVAL;
    598   1.1     rmind 	}
    599   1.1     rmind 
    600   1.1     rmind 	/* Acquire the lock and check for the races. */
    601   1.1     rmind 	mutex_enter(&con->c_lock);
    602   1.1     rmind 	if (__predict_false(con->c_flags & CONN_EXPIRE)) {
    603   1.1     rmind 		/* The connection got expired. */
    604   1.1     rmind 		mutex_exit(&con->c_lock);
    605   1.1     rmind 		return EINVAL;
    606   1.1     rmind 	}
    607  1.15     rmind 	KASSERT((con->c_flags & CONN_REMOVED) == 0);
    608  1.15     rmind 
    609   1.1     rmind 	if (__predict_false(con->c_nat != NULL)) {
    610   1.1     rmind 		/* Race with a duplicate packet. */
    611   1.1     rmind 		mutex_exit(&con->c_lock);
    612   1.1     rmind 		npf_stats_inc(NPF_STAT_RACE_NAT);
    613   1.1     rmind 		return EISCONN;
    614   1.1     rmind 	}
    615   1.1     rmind 
    616   1.1     rmind 	/* Remove the "backwards" entry. */
    617  1.15     rmind 	ret = npf_conndb_remove(conn_db, &con->c_back_entry);
    618   1.1     rmind 	KASSERT(ret == con);
    619   1.1     rmind 
    620   1.1     rmind 	/* Set the source/destination IDs to the translation values. */
    621   1.1     rmind 	bk = &con->c_back_entry;
    622   1.1     rmind 	connkey_set_addr(bk, taddr, tidx);
    623   1.1     rmind 	if (tport) {
    624   1.1     rmind 		connkey_set_id(bk, tport, tidx);
    625   1.1     rmind 	}
    626   1.1     rmind 
    627   1.1     rmind 	/* Finally, re-insert the "backwards" entry. */
    628   1.1     rmind 	if (!npf_conndb_insert(conn_db, bk, con)) {
    629   1.1     rmind 		/*
    630   1.1     rmind 		 * Race: we have hit the duplicate, remove the "forwards"
    631   1.1     rmind 		 * entry and expire our connection; it is no longer valid.
    632   1.1     rmind 		 */
    633  1.15     rmind 		ret = npf_conndb_remove(conn_db, &con->c_forw_entry);
    634  1.15     rmind 		KASSERT(ret == con);
    635  1.15     rmind 
    636   1.1     rmind 		atomic_or_uint(&con->c_flags, CONN_REMOVED | CONN_EXPIRE);
    637   1.1     rmind 		mutex_exit(&con->c_lock);
    638   1.1     rmind 
    639   1.1     rmind 		npf_stats_inc(NPF_STAT_RACE_NAT);
    640   1.1     rmind 		return EISCONN;
    641   1.1     rmind 	}
    642   1.1     rmind 
    643   1.1     rmind 	/* Associate the NAT entry and release the lock. */
    644   1.1     rmind 	con->c_nat = nt;
    645   1.1     rmind 	mutex_exit(&con->c_lock);
    646   1.1     rmind 	return 0;
    647   1.1     rmind }
    648   1.1     rmind 
    649   1.1     rmind /*
    650   1.1     rmind  * npf_conn_expire: explicitly mark connection as expired.
    651   1.1     rmind  */
    652   1.1     rmind void
    653   1.1     rmind npf_conn_expire(npf_conn_t *con)
    654   1.1     rmind {
    655   1.1     rmind 	/* KASSERT(con->c_refcnt > 0); XXX: npf_nat_freepolicy() */
    656   1.1     rmind 	atomic_or_uint(&con->c_flags, CONN_EXPIRE);
    657   1.1     rmind }
    658   1.1     rmind 
    659   1.1     rmind /*
    660   1.1     rmind  * npf_conn_pass: return true if connection is "pass" one, otherwise false.
    661   1.1     rmind  */
    662   1.1     rmind bool
    663   1.1     rmind npf_conn_pass(const npf_conn_t *con, npf_rproc_t **rp)
    664   1.1     rmind {
    665   1.1     rmind 	KASSERT(con->c_refcnt > 0);
    666   1.1     rmind 	if (__predict_true(con->c_flags & CONN_PASS)) {
    667   1.1     rmind 		*rp = con->c_rproc;
    668   1.1     rmind 		return true;
    669   1.1     rmind 	}
    670   1.1     rmind 	return false;
    671   1.1     rmind }
    672   1.1     rmind 
    673   1.1     rmind /*
    674   1.1     rmind  * npf_conn_setpass: mark connection as a "pass" one and associate the
    675   1.1     rmind  * rule procedure with it.
    676   1.1     rmind  */
    677   1.1     rmind void
    678   1.1     rmind npf_conn_setpass(npf_conn_t *con, npf_rproc_t *rp)
    679   1.1     rmind {
    680   1.1     rmind 	KASSERT((con->c_flags & CONN_ACTIVE) == 0);
    681   1.1     rmind 	KASSERT(con->c_refcnt > 0);
    682   1.1     rmind 	KASSERT(con->c_rproc == NULL);
    683   1.1     rmind 
    684   1.1     rmind 	/*
    685   1.1     rmind 	 * No need for atomic since the connection is not yet active.
    686   1.1     rmind 	 * If rproc is set, the caller transfers its reference to us,
    687   1.1     rmind 	 * which will be released on npf_conn_destroy().
    688   1.1     rmind 	 */
    689  1.14     rmind 	atomic_or_uint(&con->c_flags, CONN_PASS);
    690   1.1     rmind 	con->c_rproc = rp;
    691   1.1     rmind }
    692   1.1     rmind 
    693   1.1     rmind /*
    694   1.1     rmind  * npf_conn_release: release a reference, which might allow G/C thread
    695   1.1     rmind  * to destroy this connection.
    696   1.1     rmind  */
    697   1.1     rmind void
    698   1.1     rmind npf_conn_release(npf_conn_t *con)
    699   1.1     rmind {
    700   1.1     rmind 	if ((con->c_flags & (CONN_ACTIVE | CONN_EXPIRE)) == 0) {
    701   1.1     rmind 		/* Activate: after this, connection is globally visible. */
    702  1.14     rmind 		atomic_or_uint(&con->c_flags, CONN_ACTIVE);
    703   1.1     rmind 	}
    704   1.1     rmind 	KASSERT(con->c_refcnt > 0);
    705   1.1     rmind 	atomic_dec_uint(&con->c_refcnt);
    706   1.1     rmind }
    707   1.1     rmind 
    708   1.1     rmind /*
    709  1.13     rmind  * npf_conn_getnat: return associated NAT data entry and indicate
    710   1.1     rmind  * whether it is a "forwards" or "backwards" stream.
    711   1.1     rmind  */
    712   1.1     rmind npf_nat_t *
    713  1.13     rmind npf_conn_getnat(npf_conn_t *con, const int di, bool *forw)
    714   1.1     rmind {
    715   1.1     rmind 	KASSERT(con->c_refcnt > 0);
    716   1.1     rmind 	*forw = (con->c_flags & PFIL_ALL) == di;
    717   1.1     rmind 	return con->c_nat;
    718   1.1     rmind }
    719   1.1     rmind 
    720   1.1     rmind /*
    721   1.1     rmind  * npf_conn_expired: criterion to check if connection is expired.
    722   1.1     rmind  */
    723   1.1     rmind static inline bool
    724   1.1     rmind npf_conn_expired(const npf_conn_t *con, const struct timespec *tsnow)
    725   1.1     rmind {
    726   1.1     rmind 	const int etime = npf_state_etime(&con->c_state, con->c_proto);
    727   1.1     rmind 	struct timespec tsdiff;
    728   1.1     rmind 
    729   1.1     rmind 	if (__predict_false(con->c_flags & CONN_EXPIRE)) {
    730   1.1     rmind 		/* Explicitly marked to be expired. */
    731   1.1     rmind 		return true;
    732   1.1     rmind 	}
    733   1.1     rmind 	timespecsub(tsnow, &con->c_atime, &tsdiff);
    734   1.1     rmind 	return tsdiff.tv_sec > etime;
    735   1.1     rmind }
    736   1.1     rmind 
    737   1.1     rmind /*
    738   1.6     rmind  * npf_conn_gc: garbage collect the expired connections.
    739   1.6     rmind  *
    740   1.6     rmind  * => Must run in a single-threaded manner.
    741   1.6     rmind  * => If it is a flush request, then destroy all connections.
    742   1.6     rmind  * => If 'sync' is true, then perform passive serialisation.
    743   1.1     rmind  */
    744   1.7     rmind void
    745   1.6     rmind npf_conn_gc(npf_conndb_t *cd, bool flush, bool sync)
    746   1.1     rmind {
    747   1.1     rmind 	npf_conn_t *con, *prev, *gclist = NULL;
    748   1.1     rmind 	struct timespec tsnow;
    749   1.1     rmind 
    750   1.1     rmind 	getnanouptime(&tsnow);
    751   1.1     rmind 
    752   1.1     rmind 	/*
    753   1.1     rmind 	 * Scan all connections and check them for expiration.
    754   1.1     rmind 	 */
    755   1.1     rmind 	prev = NULL;
    756   1.1     rmind 	con = npf_conndb_getlist(cd);
    757   1.1     rmind 	while (con) {
    758   1.1     rmind 		npf_conn_t *next = con->c_next;
    759   1.1     rmind 
    760   1.1     rmind 		/* Expired?  Flushing all? */
    761   1.6     rmind 		if (!npf_conn_expired(con, &tsnow) && !flush) {
    762   1.1     rmind 			prev = con;
    763   1.1     rmind 			con = next;
    764   1.1     rmind 			continue;
    765   1.1     rmind 		}
    766   1.1     rmind 
    767   1.1     rmind 		/* Remove both entries of the connection. */
    768   1.1     rmind 		mutex_enter(&con->c_lock);
    769   1.1     rmind 		if ((con->c_flags & CONN_REMOVED) == 0) {
    770   1.1     rmind 			npf_conn_t *ret __diagused;
    771   1.1     rmind 
    772   1.1     rmind 			ret = npf_conndb_remove(cd, &con->c_forw_entry);
    773   1.1     rmind 			KASSERT(ret == con);
    774   1.1     rmind 			ret = npf_conndb_remove(cd, &con->c_back_entry);
    775   1.1     rmind 			KASSERT(ret == con);
    776   1.1     rmind 		}
    777   1.1     rmind 
    778   1.1     rmind 		/* Flag the removal and expiration. */
    779   1.1     rmind 		atomic_or_uint(&con->c_flags, CONN_REMOVED | CONN_EXPIRE);
    780   1.1     rmind 		mutex_exit(&con->c_lock);
    781   1.1     rmind 
    782   1.1     rmind 		/* Move to the G/C list. */
    783   1.1     rmind 		npf_conndb_dequeue(cd, con, prev);
    784   1.1     rmind 		con->c_next = gclist;
    785   1.1     rmind 		gclist = con;
    786   1.1     rmind 
    787   1.1     rmind 		/* Next.. */
    788   1.1     rmind 		con = next;
    789   1.1     rmind 	}
    790   1.1     rmind 	npf_conndb_settail(cd, prev);
    791   1.6     rmind 
    792   1.6     rmind 	/*
    793   1.6     rmind 	 * Ensure it is safe to destroy the connections.
    794   1.6     rmind 	 * Note: drop the conn_lock (see the lock order).
    795   1.6     rmind 	 */
    796   1.6     rmind 	if (sync) {
    797   1.6     rmind 		mutex_exit(&conn_lock);
    798   1.6     rmind 		if (gclist) {
    799   1.6     rmind 			npf_config_enter();
    800   1.6     rmind 			npf_config_sync();
    801   1.6     rmind 			npf_config_exit();
    802   1.6     rmind 		}
    803   1.1     rmind 	}
    804   1.1     rmind 
    805   1.1     rmind 	/*
    806   1.1     rmind 	 * Garbage collect all expired connections.
    807   1.1     rmind 	 * May need to wait for the references to drain.
    808   1.1     rmind 	 */
    809   1.1     rmind 	con = gclist;
    810   1.1     rmind 	while (con) {
    811   1.1     rmind 		npf_conn_t *next = con->c_next;
    812   1.1     rmind 
    813   1.1     rmind 		/*
    814   1.1     rmind 		 * Destroy only if removed and no references.
    815   1.1     rmind 		 * Otherwise, wait for a tiny moment.
    816   1.1     rmind 		 */
    817   1.1     rmind 		if (__predict_false(con->c_refcnt)) {
    818   1.1     rmind 			kpause("npfcongc", false, 1, NULL);
    819   1.1     rmind 			continue;
    820   1.1     rmind 		}
    821   1.1     rmind 		npf_conn_destroy(con);
    822   1.1     rmind 		con = next;
    823   1.1     rmind 	}
    824   1.1     rmind }
    825   1.1     rmind 
    826   1.6     rmind /*
    827   1.6     rmind  * npf_conn_worker: G/C to run from a worker thread.
    828   1.6     rmind  */
    829   1.6     rmind static void
    830   1.6     rmind npf_conn_worker(void)
    831   1.1     rmind {
    832   1.6     rmind 	mutex_enter(&conn_lock);
    833   1.6     rmind 	/* Note: the conn_lock will be released (sync == true). */
    834   1.6     rmind 	npf_conn_gc(conn_db, false, true);
    835   1.1     rmind }
    836   1.1     rmind 
    837   1.1     rmind /*
    838  1.10     rmind  * npf_conndb_export: construct a list of connections prepared for saving.
    839   1.1     rmind  * Note: this is expected to be an expensive operation.
    840   1.1     rmind  */
    841   1.1     rmind int
    842  1.10     rmind npf_conndb_export(prop_array_t conlist)
    843   1.1     rmind {
    844   1.1     rmind 	npf_conn_t *con, *prev;
    845   1.1     rmind 
    846   1.1     rmind 	/*
    847   1.1     rmind 	 * Note: acquire conn_lock to prevent from the database
    848   1.1     rmind 	 * destruction and G/C thread.
    849   1.1     rmind 	 */
    850   1.1     rmind 	mutex_enter(&conn_lock);
    851   1.6     rmind 	if (conn_tracking != CONN_TRACKING_ON) {
    852   1.1     rmind 		mutex_exit(&conn_lock);
    853   1.1     rmind 		return 0;
    854   1.1     rmind 	}
    855   1.1     rmind 	prev = NULL;
    856   1.1     rmind 	con = npf_conndb_getlist(conn_db);
    857   1.1     rmind 	while (con) {
    858   1.1     rmind 		npf_conn_t *next = con->c_next;
    859  1.10     rmind 		prop_dictionary_t cdict;
    860   1.1     rmind 
    861  1.10     rmind 		if ((cdict = npf_conn_export(con)) != NULL) {
    862  1.10     rmind 			prop_array_add(conlist, cdict);
    863  1.10     rmind 			prop_object_release(cdict);
    864   1.1     rmind 		}
    865   1.1     rmind 		prev = con;
    866   1.1     rmind 		con = next;
    867   1.1     rmind 	}
    868   1.1     rmind 	npf_conndb_settail(conn_db, prev);
    869   1.1     rmind 	mutex_exit(&conn_lock);
    870   1.5     joerg 	return 0;
    871   1.1     rmind }
    872   1.1     rmind 
    873   1.1     rmind /*
    874  1.10     rmind  * npf_conn_export: serialise a single connection.
    875  1.10     rmind  */
    876  1.10     rmind prop_dictionary_t
    877  1.10     rmind npf_conn_export(const npf_conn_t *con)
    878  1.10     rmind {
    879  1.10     rmind 	prop_dictionary_t cdict;
    880  1.10     rmind 	prop_data_t d;
    881  1.10     rmind 
    882  1.10     rmind 	if ((con->c_flags & (CONN_ACTIVE|CONN_EXPIRE)) != CONN_ACTIVE) {
    883  1.10     rmind 		return NULL;
    884  1.10     rmind 	}
    885  1.10     rmind 	cdict = prop_dictionary_create();
    886  1.10     rmind 	prop_dictionary_set_uint32(cdict, "flags", con->c_flags);
    887  1.10     rmind 	prop_dictionary_set_uint32(cdict, "proto", con->c_proto);
    888  1.10     rmind 	if (con->c_ifid) {
    889  1.10     rmind 		const char *ifname = npf_ifmap_getname(con->c_ifid);
    890  1.10     rmind 		prop_dictionary_set_cstring(cdict, "ifname", ifname);
    891  1.10     rmind 	}
    892  1.10     rmind 
    893  1.10     rmind 	d = prop_data_create_data(&con->c_state, sizeof(npf_state_t));
    894  1.10     rmind 	prop_dictionary_set_and_rel(cdict, "state", d);
    895  1.10     rmind 
    896  1.10     rmind 	const uint32_t *fkey = con->c_forw_entry.ck_key;
    897  1.10     rmind 	d = prop_data_create_data(fkey, NPF_CONN_MAXKEYLEN);
    898  1.10     rmind 	prop_dictionary_set_and_rel(cdict, "forw-key", d);
    899  1.10     rmind 
    900  1.10     rmind 	const uint32_t *bkey = con->c_back_entry.ck_key;
    901  1.10     rmind 	d = prop_data_create_data(bkey, NPF_CONN_MAXKEYLEN);
    902  1.10     rmind 	prop_dictionary_set_and_rel(cdict, "back-key", d);
    903  1.10     rmind 
    904  1.10     rmind 	if (con->c_nat) {
    905  1.10     rmind 		npf_nat_export(cdict, con->c_nat);
    906  1.10     rmind 	}
    907  1.10     rmind 	return cdict;
    908  1.10     rmind }
    909  1.10     rmind 
    910  1.10     rmind /*
    911   1.6     rmind  * npf_conn_import: fully reconstruct a single connection from a
    912   1.6     rmind  * directory and insert into the given database.
    913   1.1     rmind  */
    914   1.1     rmind int
    915   1.6     rmind npf_conn_import(npf_conndb_t *cd, prop_dictionary_t cdict,
    916   1.6     rmind     npf_ruleset_t *natlist)
    917   1.1     rmind {
    918   1.1     rmind 	npf_conn_t *con;
    919   1.1     rmind 	npf_connkey_t *fw, *bk;
    920   1.1     rmind 	prop_object_t obj;
    921  1.10     rmind 	const char *ifname;
    922   1.1     rmind 	const void *d;
    923   1.1     rmind 
    924   1.1     rmind 	/* Allocate a connection and initialise it (clear first). */
    925   1.1     rmind 	con = pool_cache_get(conn_cache, PR_WAITOK);
    926   1.1     rmind 	memset(con, 0, sizeof(npf_conn_t));
    927   1.1     rmind 	mutex_init(&con->c_lock, MUTEX_DEFAULT, IPL_SOFTNET);
    928  1.12     rmind 	npf_stats_inc(NPF_STAT_CONN_CREATE);
    929   1.1     rmind 
    930   1.1     rmind 	prop_dictionary_get_uint32(cdict, "proto", &con->c_proto);
    931   1.1     rmind 	prop_dictionary_get_uint32(cdict, "flags", &con->c_flags);
    932   1.1     rmind 	con->c_flags &= PFIL_ALL | CONN_ACTIVE | CONN_PASS;
    933   1.1     rmind 	getnanouptime(&con->c_atime);
    934   1.1     rmind 
    935  1.10     rmind 	if (prop_dictionary_get_cstring_nocopy(cdict, "ifname", &ifname) &&
    936  1.10     rmind 	    (con->c_ifid = npf_ifmap_register(ifname)) == 0) {
    937  1.10     rmind 		goto err;
    938  1.10     rmind 	}
    939  1.10     rmind 
    940   1.1     rmind 	obj = prop_dictionary_get(cdict, "state");
    941   1.1     rmind 	if ((d = prop_data_data_nocopy(obj)) == NULL ||
    942   1.1     rmind 	    prop_data_size(obj) != sizeof(npf_state_t)) {
    943   1.1     rmind 		goto err;
    944   1.1     rmind 	}
    945   1.1     rmind 	memcpy(&con->c_state, d, sizeof(npf_state_t));
    946   1.1     rmind 
    947  1.11     rmind 	/* Reconstruct NAT association, if any. */
    948  1.11     rmind 	if ((obj = prop_dictionary_get(cdict, "nat")) != NULL &&
    949  1.11     rmind 	    (con->c_nat = npf_nat_import(obj, natlist, con)) == NULL) {
    950  1.11     rmind 		goto err;
    951  1.11     rmind 	}
    952   1.1     rmind 
    953   1.1     rmind 	/*
    954   1.1     rmind 	 * Fetch and copy the keys for each direction.
    955   1.1     rmind 	 */
    956   1.1     rmind 	obj = prop_dictionary_get(cdict, "forw-key");
    957   1.1     rmind 	if ((d = prop_data_data_nocopy(obj)) == NULL ||
    958   1.1     rmind 	    prop_data_size(obj) != NPF_CONN_MAXKEYLEN) {
    959   1.1     rmind 		goto err;
    960   1.1     rmind 	}
    961   1.1     rmind 	fw = &con->c_forw_entry;
    962   1.1     rmind 	memcpy(&fw->ck_key, d, NPF_CONN_MAXKEYLEN);
    963   1.1     rmind 
    964   1.1     rmind 	obj = prop_dictionary_get(cdict, "back-key");
    965   1.1     rmind 	if ((d = prop_data_data_nocopy(obj)) == NULL ||
    966   1.1     rmind 	    prop_data_size(obj) != NPF_CONN_MAXKEYLEN) {
    967   1.1     rmind 		goto err;
    968   1.1     rmind 	}
    969   1.1     rmind 	bk = &con->c_back_entry;
    970   1.1     rmind 	memcpy(&bk->ck_key, d, NPF_CONN_MAXKEYLEN);
    971   1.1     rmind 
    972   1.1     rmind 	fw->ck_backptr = bk->ck_backptr = con;
    973   1.1     rmind 
    974   1.1     rmind 	/* Insert the entries and the connection itself. */
    975   1.1     rmind 	if (!npf_conndb_insert(cd, fw, con)) {
    976   1.1     rmind 		goto err;
    977   1.1     rmind 	}
    978   1.1     rmind 	if (!npf_conndb_insert(cd, bk, con)) {
    979   1.1     rmind 		npf_conndb_remove(cd, fw);
    980   1.1     rmind 		goto err;
    981   1.1     rmind 	}
    982  1.12     rmind 
    983  1.12     rmind 	NPF_PRINTF(("NPF: imported conn %p\n", con));
    984   1.1     rmind 	npf_conndb_enqueue(cd, con);
    985   1.1     rmind 	return 0;
    986   1.1     rmind err:
    987   1.1     rmind 	npf_conn_destroy(con);
    988   1.1     rmind 	return EINVAL;
    989   1.1     rmind }
    990   1.1     rmind 
    991   1.1     rmind #if defined(DDB) || defined(_NPF_TESTING)
    992   1.1     rmind 
    993   1.1     rmind void
    994   1.1     rmind npf_conn_print(const npf_conn_t *con)
    995   1.1     rmind {
    996   1.1     rmind 	const u_int alen = NPF_CONN_GETALEN(&con->c_forw_entry);
    997   1.1     rmind 	const uint32_t *fkey = con->c_forw_entry.ck_key;
    998   1.1     rmind 	const uint32_t *bkey = con->c_back_entry.ck_key;
    999   1.1     rmind 	const u_int proto = con->c_proto;
   1000   1.1     rmind 	struct timespec tsnow, tsdiff;
   1001   1.1     rmind 	const void *src, *dst;
   1002   1.1     rmind 	int etime;
   1003   1.1     rmind 
   1004   1.1     rmind 	getnanouptime(&tsnow);
   1005   1.1     rmind 	timespecsub(&tsnow, &con->c_atime, &tsdiff);
   1006   1.1     rmind 	etime = npf_state_etime(&con->c_state, proto);
   1007   1.1     rmind 
   1008   1.1     rmind 	printf("%p:\n\tproto %d flags 0x%x tsdiff %d etime %d\n",
   1009   1.1     rmind 	    con, proto, con->c_flags, (int)tsdiff.tv_sec, etime);
   1010   1.1     rmind 
   1011   1.1     rmind 	src = &fkey[2], dst = &fkey[2 + (alen >> 2)];
   1012   1.1     rmind 	printf("\tforw %s:%d", npf_addr_dump(src, alen), ntohs(fkey[1] >> 16));
   1013   1.1     rmind 	printf("-> %s:%d\n", npf_addr_dump(dst, alen), ntohs(fkey[1] & 0xffff));
   1014   1.1     rmind 
   1015   1.1     rmind 	src = &bkey[2], dst = &bkey[2 + (alen >> 2)];
   1016   1.1     rmind 	printf("\tback %s:%d", npf_addr_dump(src, alen), ntohs(bkey[1] >> 16));
   1017   1.1     rmind 	printf("-> %s:%d\n", npf_addr_dump(dst, alen), ntohs(bkey[1] & 0xffff));
   1018   1.1     rmind 
   1019   1.1     rmind 	npf_state_dump(&con->c_state);
   1020   1.1     rmind 	if (con->c_nat) {
   1021   1.1     rmind 		npf_nat_dump(con->c_nat);
   1022   1.1     rmind 	}
   1023   1.1     rmind }
   1024   1.1     rmind 
   1025   1.1     rmind #endif
   1026