npf_conn.c revision 1.24 1 1.24 rmind /* $NetBSD: npf_conn.c,v 1.24 2017/12/10 00:07:36 rmind Exp $ */
2 1.1 rmind
3 1.1 rmind /*-
4 1.15 rmind * Copyright (c) 2014-2015 Mindaugas Rasiukevicius <rmind at netbsd org>
5 1.1 rmind * Copyright (c) 2010-2014 The NetBSD Foundation, Inc.
6 1.1 rmind * All rights reserved.
7 1.1 rmind *
8 1.1 rmind * This material is based upon work partially supported by The
9 1.1 rmind * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
10 1.1 rmind *
11 1.1 rmind * Redistribution and use in source and binary forms, with or without
12 1.1 rmind * modification, are permitted provided that the following conditions
13 1.1 rmind * are met:
14 1.1 rmind * 1. Redistributions of source code must retain the above copyright
15 1.1 rmind * notice, this list of conditions and the following disclaimer.
16 1.1 rmind * 2. Redistributions in binary form must reproduce the above copyright
17 1.1 rmind * notice, this list of conditions and the following disclaimer in the
18 1.1 rmind * documentation and/or other materials provided with the distribution.
19 1.1 rmind *
20 1.1 rmind * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 1.1 rmind * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 1.1 rmind * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 1.1 rmind * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 1.1 rmind * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 1.1 rmind * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 1.1 rmind * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 1.1 rmind * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 1.1 rmind * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 1.1 rmind * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 1.1 rmind * POSSIBILITY OF SUCH DAMAGE.
31 1.1 rmind */
32 1.1 rmind
33 1.1 rmind /*
34 1.1 rmind * NPF connection tracking for stateful filtering and translation.
35 1.1 rmind *
36 1.1 rmind * Overview
37 1.1 rmind *
38 1.1 rmind * Connection direction is identified by the direction of its first
39 1.1 rmind * packet. Packets can be incoming or outgoing with respect to an
40 1.1 rmind * interface. To describe the packet in the context of connection
41 1.1 rmind * direction we will use the terms "forwards stream" and "backwards
42 1.1 rmind * stream". All connections have two keys and thus two entries:
43 1.1 rmind *
44 1.1 rmind * npf_conn_t::c_forw_entry for the forwards stream and
45 1.1 rmind * npf_conn_t::c_back_entry for the backwards stream.
46 1.1 rmind *
47 1.1 rmind * The keys are formed from the 5-tuple (source/destination address,
48 1.1 rmind * source/destination port and the protocol). Additional matching
49 1.1 rmind * is performed for the interface (a common behaviour is equivalent
50 1.1 rmind * to the 6-tuple lookup including the interface ID). Note that the
51 1.1 rmind * key may be formed using translated values in a case of NAT.
52 1.1 rmind *
53 1.1 rmind * Connections can serve two purposes: for the implicit passing or
54 1.1 rmind * to accommodate the dynamic NAT. Connections for the former purpose
55 1.1 rmind * are created by the rules with "stateful" attribute and are used for
56 1.1 rmind * stateful filtering. Such connections indicate that the packet of
57 1.1 rmind * the backwards stream should be passed without inspection of the
58 1.1 rmind * ruleset. The other purpose is to associate a dynamic NAT mechanism
59 1.1 rmind * with a connection. Such connections are created by the NAT policies
60 1.1 rmind * and they have a relationship with NAT translation structure via
61 1.1 rmind * npf_conn_t::c_nat. A single connection can serve both purposes,
62 1.1 rmind * which is a common case.
63 1.1 rmind *
64 1.1 rmind * Connection life-cycle
65 1.1 rmind *
66 1.1 rmind * Connections are established when a packet matches said rule or
67 1.1 rmind * NAT policy. Both keys of the established connection are inserted
68 1.1 rmind * into the connection database. A garbage collection thread
69 1.1 rmind * periodically scans all connections and depending on connection
70 1.1 rmind * properties (e.g. last activity time, protocol) removes connection
71 1.1 rmind * entries and expires the actual connections.
72 1.1 rmind *
73 1.1 rmind * Each connection has a reference count. The reference is acquired
74 1.1 rmind * on lookup and should be released by the caller. It guarantees that
75 1.1 rmind * the connection will not be destroyed, although it may be expired.
76 1.1 rmind *
77 1.1 rmind * Synchronisation
78 1.1 rmind *
79 1.1 rmind * Connection database is accessed in a lock-less manner by the main
80 1.1 rmind * routines: npf_conn_inspect() and npf_conn_establish(). Since they
81 1.1 rmind * are always called from a software interrupt, the database is
82 1.1 rmind * protected using passive serialisation. The main place which can
83 1.1 rmind * destroy a connection is npf_conn_worker(). The database itself
84 1.1 rmind * can be replaced and destroyed in npf_conn_reload().
85 1.1 rmind *
86 1.1 rmind * ALG support
87 1.1 rmind *
88 1.1 rmind * Application-level gateways (ALGs) can override generic connection
89 1.1 rmind * inspection (npf_alg_conn() call in npf_conn_inspect() function) by
90 1.1 rmind * performing their own lookup using different key. Recursive call
91 1.1 rmind * to npf_conn_inspect() is not allowed. The ALGs ought to use the
92 1.1 rmind * npf_conn_lookup() function for this purpose.
93 1.1 rmind *
94 1.1 rmind * Lock order
95 1.1 rmind *
96 1.6 rmind * npf_config_lock ->
97 1.6 rmind * conn_lock ->
98 1.6 rmind * npf_conn_t::c_lock
99 1.1 rmind */
100 1.1 rmind
101 1.22 christos #ifdef _KERNEL
102 1.1 rmind #include <sys/cdefs.h>
103 1.24 rmind __KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.24 2017/12/10 00:07:36 rmind Exp $");
104 1.1 rmind
105 1.1 rmind #include <sys/param.h>
106 1.1 rmind #include <sys/types.h>
107 1.1 rmind
108 1.1 rmind #include <netinet/in.h>
109 1.1 rmind #include <netinet/tcp.h>
110 1.1 rmind
111 1.1 rmind #include <sys/atomic.h>
112 1.1 rmind #include <sys/condvar.h>
113 1.1 rmind #include <sys/kmem.h>
114 1.1 rmind #include <sys/kthread.h>
115 1.1 rmind #include <sys/mutex.h>
116 1.1 rmind #include <net/pfil.h>
117 1.1 rmind #include <sys/pool.h>
118 1.1 rmind #include <sys/queue.h>
119 1.1 rmind #include <sys/systm.h>
120 1.22 christos #endif
121 1.1 rmind
122 1.1 rmind #define __NPF_CONN_PRIVATE
123 1.1 rmind #include "npf_conn.h"
124 1.1 rmind #include "npf_impl.h"
125 1.1 rmind
126 1.1 rmind /*
127 1.1 rmind * Connection flags: PFIL_IN and PFIL_OUT values are reserved for direction.
128 1.1 rmind */
129 1.1 rmind CTASSERT(PFIL_ALL == (0x001 | 0x002));
130 1.1 rmind #define CONN_ACTIVE 0x004 /* visible on inspection */
131 1.1 rmind #define CONN_PASS 0x008 /* perform implicit passing */
132 1.1 rmind #define CONN_EXPIRE 0x010 /* explicitly expire */
133 1.1 rmind #define CONN_REMOVED 0x020 /* "forw/back" entries removed */
134 1.1 rmind
135 1.6 rmind enum { CONN_TRACKING_OFF, CONN_TRACKING_ON };
136 1.1 rmind
137 1.22 christos static void npf_conn_destroy(npf_t *, npf_conn_t *);
138 1.1 rmind
139 1.1 rmind /*
140 1.1 rmind * npf_conn_sys{init,fini}: initialise/destroy connection tracking.
141 1.1 rmind */
142 1.1 rmind
143 1.1 rmind void
144 1.22 christos npf_conn_init(npf_t *npf, int flags)
145 1.1 rmind {
146 1.22 christos npf->conn_cache = pool_cache_init(sizeof(npf_conn_t), coherency_unit,
147 1.1 rmind 0, 0, "npfconpl", NULL, IPL_NET, NULL, NULL, NULL);
148 1.22 christos mutex_init(&npf->conn_lock, MUTEX_DEFAULT, IPL_NONE);
149 1.22 christos npf->conn_tracking = CONN_TRACKING_OFF;
150 1.22 christos npf->conn_db = npf_conndb_create();
151 1.1 rmind
152 1.22 christos if ((flags & NPF_NO_GC) == 0) {
153 1.22 christos npf_worker_register(npf, npf_conn_worker);
154 1.22 christos }
155 1.1 rmind }
156 1.1 rmind
157 1.1 rmind void
158 1.22 christos npf_conn_fini(npf_t *npf)
159 1.1 rmind {
160 1.6 rmind /* Note: the caller should have flushed the connections. */
161 1.22 christos KASSERT(npf->conn_tracking == CONN_TRACKING_OFF);
162 1.22 christos npf_worker_unregister(npf, npf_conn_worker);
163 1.1 rmind
164 1.22 christos npf_conndb_destroy(npf->conn_db);
165 1.22 christos pool_cache_destroy(npf->conn_cache);
166 1.22 christos mutex_destroy(&npf->conn_lock);
167 1.1 rmind }
168 1.1 rmind
169 1.1 rmind /*
170 1.6 rmind * npf_conn_load: perform the load by flushing the current connection
171 1.6 rmind * database and replacing it with the new one or just destroying.
172 1.1 rmind *
173 1.6 rmind * => The caller must disable the connection tracking and ensure that
174 1.6 rmind * there are no connection database lookups or references in-flight.
175 1.1 rmind */
176 1.6 rmind void
177 1.22 christos npf_conn_load(npf_t *npf, npf_conndb_t *ndb, bool track)
178 1.1 rmind {
179 1.6 rmind npf_conndb_t *odb = NULL;
180 1.1 rmind
181 1.22 christos KASSERT(npf_config_locked_p(npf));
182 1.1 rmind
183 1.1 rmind /*
184 1.6 rmind * The connection database is in the quiescent state.
185 1.6 rmind * Prevent G/C thread from running and install a new database.
186 1.1 rmind */
187 1.22 christos mutex_enter(&npf->conn_lock);
188 1.6 rmind if (ndb) {
189 1.22 christos KASSERT(npf->conn_tracking == CONN_TRACKING_OFF);
190 1.22 christos odb = npf->conn_db;
191 1.22 christos npf->conn_db = ndb;
192 1.6 rmind membar_sync();
193 1.6 rmind }
194 1.6 rmind if (track) {
195 1.6 rmind /* After this point lookups start flying in. */
196 1.22 christos npf->conn_tracking = CONN_TRACKING_ON;
197 1.1 rmind }
198 1.22 christos mutex_exit(&npf->conn_lock);
199 1.1 rmind
200 1.1 rmind if (odb) {
201 1.6 rmind /*
202 1.6 rmind * Flush all, no sync since the caller did it for us.
203 1.6 rmind * Also, release the pool cache memory.
204 1.6 rmind */
205 1.22 christos npf_conn_gc(npf, odb, true, false);
206 1.1 rmind npf_conndb_destroy(odb);
207 1.22 christos pool_cache_invalidate(npf->conn_cache);
208 1.1 rmind }
209 1.1 rmind }
210 1.1 rmind
211 1.1 rmind /*
212 1.1 rmind * npf_conn_tracking: enable/disable connection tracking.
213 1.1 rmind */
214 1.1 rmind void
215 1.22 christos npf_conn_tracking(npf_t *npf, bool track)
216 1.1 rmind {
217 1.22 christos KASSERT(npf_config_locked_p(npf));
218 1.22 christos npf->conn_tracking = track ? CONN_TRACKING_ON : CONN_TRACKING_OFF;
219 1.1 rmind }
220 1.1 rmind
221 1.6 rmind static inline bool
222 1.1 rmind npf_conn_trackable_p(const npf_cache_t *npc)
223 1.1 rmind {
224 1.22 christos const npf_t *npf = npc->npc_ctx;
225 1.22 christos
226 1.1 rmind /*
227 1.1 rmind * Check if connection tracking is on. Also, if layer 3 and 4 are
228 1.1 rmind * not cached - protocol is not supported or packet is invalid.
229 1.1 rmind */
230 1.22 christos if (npf->conn_tracking != CONN_TRACKING_ON) {
231 1.1 rmind return false;
232 1.1 rmind }
233 1.1 rmind if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) {
234 1.1 rmind return false;
235 1.1 rmind }
236 1.1 rmind return true;
237 1.1 rmind }
238 1.1 rmind
239 1.18 christos static uint32_t
240 1.20 christos connkey_setkey(npf_connkey_t *key, uint16_t proto, const void *ipv,
241 1.22 christos const uint16_t *id, unsigned alen, bool forw)
242 1.18 christos {
243 1.20 christos uint32_t isrc, idst, *k = key->ck_key;
244 1.18 christos const npf_addr_t * const *ips = ipv;
245 1.22 christos
246 1.18 christos if (__predict_true(forw)) {
247 1.18 christos isrc = NPF_SRC, idst = NPF_DST;
248 1.18 christos } else {
249 1.18 christos isrc = NPF_DST, idst = NPF_SRC;
250 1.18 christos }
251 1.18 christos
252 1.18 christos /*
253 1.18 christos * Construct a key formed out of 32-bit integers. The key layout:
254 1.18 christos *
255 1.18 christos * Field: | proto | alen | src-id | dst-id | src-addr | dst-addr |
256 1.18 christos * +--------+--------+--------+--------+----------+----------+
257 1.18 christos * Bits: | 16 | 16 | 16 | 16 | 32-128 | 32-128 |
258 1.18 christos *
259 1.18 christos * The source and destination are inverted if they key is for the
260 1.18 christos * backwards stream (forw == false). The address length depends
261 1.18 christos * on the 'alen' field; it is a length in bytes, either 4 or 16.
262 1.18 christos */
263 1.18 christos
264 1.20 christos k[0] = ((uint32_t)proto << 16) | (alen & 0xffff);
265 1.20 christos k[1] = ((uint32_t)id[isrc] << 16) | id[idst];
266 1.18 christos
267 1.18 christos if (__predict_true(alen == sizeof(in_addr_t))) {
268 1.22 christos k[2] = ips[isrc]->word32[0];
269 1.22 christos k[3] = ips[idst]->word32[0];
270 1.18 christos return 4 * sizeof(uint32_t);
271 1.18 christos } else {
272 1.18 christos const u_int nwords = alen >> 2;
273 1.20 christos memcpy(&k[2], ips[isrc], alen);
274 1.20 christos memcpy(&k[2 + nwords], ips[idst], alen);
275 1.18 christos return (2 + (nwords * 2)) * sizeof(uint32_t);
276 1.18 christos }
277 1.18 christos }
278 1.18 christos
279 1.20 christos static void
280 1.20 christos connkey_getkey(const npf_connkey_t *key, uint16_t *proto, npf_addr_t *ips,
281 1.20 christos uint16_t *id, uint16_t *alen)
282 1.20 christos {
283 1.20 christos const uint32_t *k = key->ck_key;
284 1.20 christos
285 1.20 christos *proto = k[0] >> 16;
286 1.20 christos *alen = k[0] & 0xffff;
287 1.20 christos id[NPF_SRC] = k[1] >> 16;
288 1.20 christos id[NPF_DST] = k[1] & 0xffff;
289 1.20 christos
290 1.20 christos switch (*alen) {
291 1.20 christos case sizeof(struct in6_addr):
292 1.20 christos case sizeof(struct in_addr):
293 1.20 christos memcpy(&ips[NPF_SRC], &k[2], *alen);
294 1.20 christos memcpy(&ips[NPF_DST], &k[2 + ((unsigned)*alen >> 2)], *alen);
295 1.20 christos return;
296 1.20 christos default:
297 1.20 christos KASSERT(0);
298 1.20 christos }
299 1.20 christos }
300 1.20 christos
301 1.1 rmind /*
302 1.1 rmind * npf_conn_conkey: construct a key for the connection lookup.
303 1.8 rmind *
304 1.8 rmind * => Returns the key length in bytes or zero on failure.
305 1.1 rmind */
306 1.8 rmind unsigned
307 1.1 rmind npf_conn_conkey(const npf_cache_t *npc, npf_connkey_t *key, const bool forw)
308 1.1 rmind {
309 1.22 christos const u_int proto = npc->npc_proto;
310 1.22 christos const u_int alen = npc->npc_alen;
311 1.1 rmind const struct tcphdr *th;
312 1.1 rmind const struct udphdr *uh;
313 1.1 rmind uint16_t id[2];
314 1.1 rmind
315 1.22 christos switch (proto) {
316 1.1 rmind case IPPROTO_TCP:
317 1.1 rmind KASSERT(npf_iscached(npc, NPC_TCP));
318 1.1 rmind th = npc->npc_l4.tcp;
319 1.1 rmind id[NPF_SRC] = th->th_sport;
320 1.1 rmind id[NPF_DST] = th->th_dport;
321 1.1 rmind break;
322 1.1 rmind case IPPROTO_UDP:
323 1.1 rmind KASSERT(npf_iscached(npc, NPC_UDP));
324 1.1 rmind uh = npc->npc_l4.udp;
325 1.1 rmind id[NPF_SRC] = uh->uh_sport;
326 1.1 rmind id[NPF_DST] = uh->uh_dport;
327 1.1 rmind break;
328 1.1 rmind case IPPROTO_ICMP:
329 1.1 rmind if (npf_iscached(npc, NPC_ICMP_ID)) {
330 1.1 rmind const struct icmp *ic = npc->npc_l4.icmp;
331 1.1 rmind id[NPF_SRC] = ic->icmp_id;
332 1.1 rmind id[NPF_DST] = ic->icmp_id;
333 1.1 rmind break;
334 1.1 rmind }
335 1.8 rmind return 0;
336 1.1 rmind case IPPROTO_ICMPV6:
337 1.1 rmind if (npf_iscached(npc, NPC_ICMP_ID)) {
338 1.1 rmind const struct icmp6_hdr *ic6 = npc->npc_l4.icmp6;
339 1.1 rmind id[NPF_SRC] = ic6->icmp6_id;
340 1.1 rmind id[NPF_DST] = ic6->icmp6_id;
341 1.1 rmind break;
342 1.1 rmind }
343 1.8 rmind return 0;
344 1.1 rmind default:
345 1.1 rmind /* Unsupported protocol. */
346 1.8 rmind return 0;
347 1.1 rmind }
348 1.22 christos return connkey_setkey(key, proto, npc->npc_ips, id, alen, forw);
349 1.1 rmind }
350 1.1 rmind
351 1.3 christos static __inline void
352 1.1 rmind connkey_set_addr(npf_connkey_t *key, const npf_addr_t *naddr, const int di)
353 1.1 rmind {
354 1.1 rmind const u_int alen = key->ck_key[0] & 0xffff;
355 1.1 rmind uint32_t *addr = &key->ck_key[2 + ((alen >> 2) * di)];
356 1.1 rmind
357 1.1 rmind KASSERT(alen > 0);
358 1.1 rmind memcpy(addr, naddr, alen);
359 1.1 rmind }
360 1.1 rmind
361 1.3 christos static __inline void
362 1.1 rmind connkey_set_id(npf_connkey_t *key, const uint16_t id, const int di)
363 1.1 rmind {
364 1.1 rmind const uint32_t oid = key->ck_key[1];
365 1.1 rmind const u_int shift = 16 * !di;
366 1.1 rmind const uint32_t mask = 0xffff0000 >> shift;
367 1.1 rmind
368 1.1 rmind key->ck_key[1] = ((uint32_t)id << shift) | (oid & mask);
369 1.1 rmind }
370 1.1 rmind
371 1.22 christos static inline void
372 1.22 christos conn_update_atime(npf_conn_t *con)
373 1.22 christos {
374 1.22 christos struct timespec tsnow;
375 1.22 christos
376 1.22 christos getnanouptime(&tsnow);
377 1.22 christos con->c_atime = tsnow.tv_sec;
378 1.22 christos }
379 1.22 christos
380 1.1 rmind /*
381 1.18 christos * npf_conn_ok: check if the connection is active, and has the right direction.
382 1.18 christos */
383 1.18 christos static bool
384 1.22 christos npf_conn_ok(const npf_conn_t *con, const int di, bool forw)
385 1.18 christos {
386 1.22 christos const uint32_t flags = con->c_flags;
387 1.18 christos
388 1.18 christos /* Check if connection is active and not expired. */
389 1.18 christos bool ok = (flags & (CONN_ACTIVE | CONN_EXPIRE)) == CONN_ACTIVE;
390 1.18 christos if (__predict_false(!ok)) {
391 1.18 christos return false;
392 1.18 christos }
393 1.18 christos
394 1.18 christos /* Check if the direction is consistent */
395 1.22 christos bool pforw = (flags & PFIL_ALL) == (unsigned)di;
396 1.18 christos if (__predict_false(forw != pforw)) {
397 1.18 christos return false;
398 1.18 christos }
399 1.18 christos return true;
400 1.18 christos }
401 1.18 christos
402 1.18 christos /*
403 1.1 rmind * npf_conn_lookup: lookup if there is an established connection.
404 1.1 rmind *
405 1.1 rmind * => If found, we will hold a reference for the caller.
406 1.1 rmind */
407 1.1 rmind npf_conn_t *
408 1.4 rmind npf_conn_lookup(const npf_cache_t *npc, const int di, bool *forw)
409 1.1 rmind {
410 1.22 christos npf_t *npf = npc->npc_ctx;
411 1.4 rmind const nbuf_t *nbuf = npc->npc_nbuf;
412 1.1 rmind npf_conn_t *con;
413 1.1 rmind npf_connkey_t key;
414 1.18 christos u_int cifid;
415 1.1 rmind
416 1.1 rmind /* Construct a key and lookup for a connection in the store. */
417 1.1 rmind if (!npf_conn_conkey(npc, &key, true)) {
418 1.1 rmind return NULL;
419 1.1 rmind }
420 1.22 christos con = npf_conndb_lookup(npf->conn_db, &key, forw);
421 1.1 rmind if (con == NULL) {
422 1.1 rmind return NULL;
423 1.1 rmind }
424 1.1 rmind KASSERT(npc->npc_proto == con->c_proto);
425 1.1 rmind
426 1.1 rmind /* Check if connection is active and not expired. */
427 1.18 christos if (!npf_conn_ok(con, di, *forw)) {
428 1.1 rmind atomic_dec_uint(&con->c_refcnt);
429 1.1 rmind return NULL;
430 1.1 rmind }
431 1.1 rmind
432 1.1 rmind /*
433 1.1 rmind * Match the interface and the direction of the connection entry
434 1.1 rmind * and the packet.
435 1.1 rmind */
436 1.1 rmind cifid = con->c_ifid;
437 1.1 rmind if (__predict_false(cifid && cifid != nbuf->nb_ifid)) {
438 1.1 rmind atomic_dec_uint(&con->c_refcnt);
439 1.1 rmind return NULL;
440 1.1 rmind }
441 1.1 rmind
442 1.1 rmind /* Update the last activity time. */
443 1.22 christos conn_update_atime(con);
444 1.1 rmind return con;
445 1.1 rmind }
446 1.1 rmind
447 1.1 rmind /*
448 1.1 rmind * npf_conn_inspect: lookup a connection and inspecting the protocol data.
449 1.1 rmind *
450 1.1 rmind * => If found, we will hold a reference for the caller.
451 1.1 rmind */
452 1.1 rmind npf_conn_t *
453 1.4 rmind npf_conn_inspect(npf_cache_t *npc, const int di, int *error)
454 1.1 rmind {
455 1.4 rmind nbuf_t *nbuf = npc->npc_nbuf;
456 1.1 rmind npf_conn_t *con;
457 1.1 rmind bool forw, ok;
458 1.1 rmind
459 1.1 rmind KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
460 1.1 rmind if (!npf_conn_trackable_p(npc)) {
461 1.1 rmind return NULL;
462 1.1 rmind }
463 1.1 rmind
464 1.1 rmind /* Query ALG which may lookup connection for us. */
465 1.4 rmind if ((con = npf_alg_conn(npc, di)) != NULL) {
466 1.1 rmind /* Note: reference is held. */
467 1.1 rmind return con;
468 1.1 rmind }
469 1.1 rmind if (nbuf_head_mbuf(nbuf) == NULL) {
470 1.1 rmind *error = ENOMEM;
471 1.1 rmind return NULL;
472 1.1 rmind }
473 1.1 rmind KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
474 1.1 rmind
475 1.1 rmind /* Main lookup of the connection. */
476 1.4 rmind if ((con = npf_conn_lookup(npc, di, &forw)) == NULL) {
477 1.1 rmind return NULL;
478 1.1 rmind }
479 1.1 rmind
480 1.1 rmind /* Inspect the protocol data and handle state changes. */
481 1.1 rmind mutex_enter(&con->c_lock);
482 1.4 rmind ok = npf_state_inspect(npc, &con->c_state, forw);
483 1.1 rmind mutex_exit(&con->c_lock);
484 1.1 rmind
485 1.17 rmind /* If invalid state: let the rules deal with it. */
486 1.1 rmind if (__predict_false(!ok)) {
487 1.1 rmind npf_conn_release(con);
488 1.22 christos npf_stats_inc(npc->npc_ctx, NPF_STAT_INVALID_STATE);
489 1.17 rmind return NULL;
490 1.17 rmind }
491 1.17 rmind
492 1.17 rmind /*
493 1.17 rmind * If this is multi-end state, then specially tag the packet
494 1.17 rmind * so it will be just passed-through on other interfaces.
495 1.17 rmind */
496 1.17 rmind if (con->c_ifid == 0 && nbuf_add_tag(nbuf, NPF_NTAG_PASS) != 0) {
497 1.17 rmind npf_conn_release(con);
498 1.17 rmind *error = ENOMEM;
499 1.17 rmind return NULL;
500 1.1 rmind }
501 1.1 rmind return con;
502 1.1 rmind }
503 1.1 rmind
504 1.1 rmind /*
505 1.1 rmind * npf_conn_establish: create a new connection, insert into the global list.
506 1.1 rmind *
507 1.1 rmind * => Connection is created with the reference held for the caller.
508 1.1 rmind * => Connection will be activated on the first reference release.
509 1.1 rmind */
510 1.1 rmind npf_conn_t *
511 1.4 rmind npf_conn_establish(npf_cache_t *npc, int di, bool per_if)
512 1.1 rmind {
513 1.22 christos npf_t *npf = npc->npc_ctx;
514 1.4 rmind const nbuf_t *nbuf = npc->npc_nbuf;
515 1.1 rmind npf_conn_t *con;
516 1.15 rmind int error = 0;
517 1.1 rmind
518 1.1 rmind KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
519 1.1 rmind
520 1.1 rmind if (!npf_conn_trackable_p(npc)) {
521 1.1 rmind return NULL;
522 1.1 rmind }
523 1.1 rmind
524 1.1 rmind /* Allocate and initialise the new connection. */
525 1.22 christos con = pool_cache_get(npf->conn_cache, PR_NOWAIT);
526 1.1 rmind if (__predict_false(!con)) {
527 1.22 christos npf_worker_signal(npf);
528 1.1 rmind return NULL;
529 1.1 rmind }
530 1.1 rmind NPF_PRINTF(("NPF: create conn %p\n", con));
531 1.22 christos npf_stats_inc(npf, NPF_STAT_CONN_CREATE);
532 1.1 rmind
533 1.1 rmind mutex_init(&con->c_lock, MUTEX_DEFAULT, IPL_SOFTNET);
534 1.1 rmind con->c_flags = (di & PFIL_ALL);
535 1.15 rmind con->c_refcnt = 0;
536 1.1 rmind con->c_rproc = NULL;
537 1.1 rmind con->c_nat = NULL;
538 1.1 rmind
539 1.15 rmind /* Initialize the protocol state. */
540 1.4 rmind if (!npf_state_init(npc, &con->c_state)) {
541 1.22 christos npf_conn_destroy(npf, con);
542 1.15 rmind return NULL;
543 1.1 rmind }
544 1.1 rmind
545 1.1 rmind KASSERT(npf_iscached(npc, NPC_IP46));
546 1.1 rmind npf_connkey_t *fw = &con->c_forw_entry;
547 1.1 rmind npf_connkey_t *bk = &con->c_back_entry;
548 1.1 rmind
549 1.1 rmind /*
550 1.1 rmind * Construct "forwards" and "backwards" keys. Also, set the
551 1.1 rmind * interface ID for this connection (unless it is global).
552 1.1 rmind */
553 1.15 rmind if (!npf_conn_conkey(npc, fw, true) ||
554 1.15 rmind !npf_conn_conkey(npc, bk, false)) {
555 1.22 christos npf_conn_destroy(npf, con);
556 1.15 rmind return NULL;
557 1.1 rmind }
558 1.1 rmind fw->ck_backptr = bk->ck_backptr = con;
559 1.1 rmind con->c_ifid = per_if ? nbuf->nb_ifid : 0;
560 1.1 rmind con->c_proto = npc->npc_proto;
561 1.1 rmind
562 1.15 rmind /*
563 1.15 rmind * Set last activity time for a new connection and acquire
564 1.15 rmind * a reference for the caller before we make it visible.
565 1.15 rmind */
566 1.22 christos conn_update_atime(con);
567 1.15 rmind con->c_refcnt = 1;
568 1.1 rmind
569 1.1 rmind /*
570 1.1 rmind * Insert both keys (entries representing directions) of the
571 1.15 rmind * connection. At this point it becomes visible, but we activate
572 1.15 rmind * the connection later.
573 1.1 rmind */
574 1.15 rmind mutex_enter(&con->c_lock);
575 1.22 christos if (!npf_conndb_insert(npf->conn_db, fw, con)) {
576 1.15 rmind error = EISCONN;
577 1.1 rmind goto err;
578 1.1 rmind }
579 1.22 christos if (!npf_conndb_insert(npf->conn_db, bk, con)) {
580 1.15 rmind npf_conn_t *ret __diagused;
581 1.22 christos ret = npf_conndb_remove(npf->conn_db, fw);
582 1.15 rmind KASSERT(ret == con);
583 1.15 rmind error = EISCONN;
584 1.15 rmind goto err;
585 1.15 rmind }
586 1.15 rmind err:
587 1.15 rmind /*
588 1.15 rmind * If we have hit the duplicate: mark the connection as expired
589 1.15 rmind * and let the G/C thread to take care of it. We cannot do it
590 1.15 rmind * here since there might be references acquired already.
591 1.15 rmind */
592 1.15 rmind if (error) {
593 1.16 rmind atomic_or_uint(&con->c_flags, CONN_REMOVED | CONN_EXPIRE);
594 1.16 rmind atomic_dec_uint(&con->c_refcnt);
595 1.22 christos npf_stats_inc(npf, NPF_STAT_RACE_CONN);
596 1.15 rmind } else {
597 1.15 rmind NPF_PRINTF(("NPF: establish conn %p\n", con));
598 1.1 rmind }
599 1.1 rmind
600 1.1 rmind /* Finally, insert into the connection list. */
601 1.22 christos npf_conndb_enqueue(npf->conn_db, con);
602 1.15 rmind mutex_exit(&con->c_lock);
603 1.15 rmind
604 1.15 rmind return error ? NULL : con;
605 1.1 rmind }
606 1.1 rmind
607 1.1 rmind static void
608 1.22 christos npf_conn_destroy(npf_t *npf, npf_conn_t *con)
609 1.1 rmind {
610 1.15 rmind KASSERT(con->c_refcnt == 0);
611 1.15 rmind
612 1.1 rmind if (con->c_nat) {
613 1.1 rmind /* Release any NAT structures. */
614 1.1 rmind npf_nat_destroy(con->c_nat);
615 1.1 rmind }
616 1.1 rmind if (con->c_rproc) {
617 1.1 rmind /* Release the rule procedure. */
618 1.1 rmind npf_rproc_release(con->c_rproc);
619 1.1 rmind }
620 1.1 rmind
621 1.1 rmind /* Destroy the state. */
622 1.1 rmind npf_state_destroy(&con->c_state);
623 1.1 rmind mutex_destroy(&con->c_lock);
624 1.1 rmind
625 1.1 rmind /* Free the structure, increase the counter. */
626 1.22 christos pool_cache_put(npf->conn_cache, con);
627 1.22 christos npf_stats_inc(npf, NPF_STAT_CONN_DESTROY);
628 1.1 rmind NPF_PRINTF(("NPF: conn %p destroyed\n", con));
629 1.1 rmind }
630 1.1 rmind
631 1.1 rmind /*
632 1.1 rmind * npf_conn_setnat: associate NAT entry with the connection, update and
633 1.1 rmind * re-insert connection entry using the translation values.
634 1.16 rmind *
635 1.16 rmind * => The caller must be holding a reference.
636 1.1 rmind */
637 1.1 rmind int
638 1.1 rmind npf_conn_setnat(const npf_cache_t *npc, npf_conn_t *con,
639 1.1 rmind npf_nat_t *nt, u_int ntype)
640 1.1 rmind {
641 1.1 rmind static const u_int nat_type_dimap[] = {
642 1.1 rmind [NPF_NATOUT] = NPF_DST,
643 1.1 rmind [NPF_NATIN] = NPF_SRC,
644 1.1 rmind };
645 1.22 christos npf_t *npf = npc->npc_ctx;
646 1.1 rmind npf_connkey_t key, *bk;
647 1.2 rmind npf_conn_t *ret __diagused;
648 1.1 rmind npf_addr_t *taddr;
649 1.1 rmind in_port_t tport;
650 1.1 rmind u_int tidx;
651 1.1 rmind
652 1.1 rmind KASSERT(con->c_refcnt > 0);
653 1.1 rmind
654 1.1 rmind npf_nat_gettrans(nt, &taddr, &tport);
655 1.1 rmind KASSERT(ntype == NPF_NATOUT || ntype == NPF_NATIN);
656 1.1 rmind tidx = nat_type_dimap[ntype];
657 1.1 rmind
658 1.1 rmind /* Construct a "backwards" key. */
659 1.1 rmind if (!npf_conn_conkey(npc, &key, false)) {
660 1.1 rmind return EINVAL;
661 1.1 rmind }
662 1.1 rmind
663 1.1 rmind /* Acquire the lock and check for the races. */
664 1.1 rmind mutex_enter(&con->c_lock);
665 1.1 rmind if (__predict_false(con->c_flags & CONN_EXPIRE)) {
666 1.1 rmind /* The connection got expired. */
667 1.1 rmind mutex_exit(&con->c_lock);
668 1.1 rmind return EINVAL;
669 1.1 rmind }
670 1.15 rmind KASSERT((con->c_flags & CONN_REMOVED) == 0);
671 1.15 rmind
672 1.1 rmind if (__predict_false(con->c_nat != NULL)) {
673 1.1 rmind /* Race with a duplicate packet. */
674 1.1 rmind mutex_exit(&con->c_lock);
675 1.22 christos npf_stats_inc(npc->npc_ctx, NPF_STAT_RACE_NAT);
676 1.1 rmind return EISCONN;
677 1.1 rmind }
678 1.1 rmind
679 1.1 rmind /* Remove the "backwards" entry. */
680 1.22 christos ret = npf_conndb_remove(npf->conn_db, &con->c_back_entry);
681 1.1 rmind KASSERT(ret == con);
682 1.1 rmind
683 1.1 rmind /* Set the source/destination IDs to the translation values. */
684 1.1 rmind bk = &con->c_back_entry;
685 1.1 rmind connkey_set_addr(bk, taddr, tidx);
686 1.1 rmind if (tport) {
687 1.1 rmind connkey_set_id(bk, tport, tidx);
688 1.1 rmind }
689 1.1 rmind
690 1.1 rmind /* Finally, re-insert the "backwards" entry. */
691 1.22 christos if (!npf_conndb_insert(npf->conn_db, bk, con)) {
692 1.1 rmind /*
693 1.1 rmind * Race: we have hit the duplicate, remove the "forwards"
694 1.1 rmind * entry and expire our connection; it is no longer valid.
695 1.1 rmind */
696 1.22 christos ret = npf_conndb_remove(npf->conn_db, &con->c_forw_entry);
697 1.15 rmind KASSERT(ret == con);
698 1.15 rmind
699 1.1 rmind atomic_or_uint(&con->c_flags, CONN_REMOVED | CONN_EXPIRE);
700 1.1 rmind mutex_exit(&con->c_lock);
701 1.1 rmind
702 1.22 christos npf_stats_inc(npc->npc_ctx, NPF_STAT_RACE_NAT);
703 1.1 rmind return EISCONN;
704 1.1 rmind }
705 1.1 rmind
706 1.1 rmind /* Associate the NAT entry and release the lock. */
707 1.1 rmind con->c_nat = nt;
708 1.1 rmind mutex_exit(&con->c_lock);
709 1.1 rmind return 0;
710 1.1 rmind }
711 1.1 rmind
712 1.1 rmind /*
713 1.1 rmind * npf_conn_expire: explicitly mark connection as expired.
714 1.1 rmind */
715 1.1 rmind void
716 1.1 rmind npf_conn_expire(npf_conn_t *con)
717 1.1 rmind {
718 1.1 rmind /* KASSERT(con->c_refcnt > 0); XXX: npf_nat_freepolicy() */
719 1.1 rmind atomic_or_uint(&con->c_flags, CONN_EXPIRE);
720 1.1 rmind }
721 1.1 rmind
722 1.1 rmind /*
723 1.1 rmind * npf_conn_pass: return true if connection is "pass" one, otherwise false.
724 1.1 rmind */
725 1.1 rmind bool
726 1.23 christos npf_conn_pass(const npf_conn_t *con, npf_match_info_t *mi, npf_rproc_t **rp)
727 1.1 rmind {
728 1.1 rmind KASSERT(con->c_refcnt > 0);
729 1.1 rmind if (__predict_true(con->c_flags & CONN_PASS)) {
730 1.24 rmind mi->mi_rid = con->c_rid;
731 1.24 rmind mi->mi_retfl = con->c_retfl;
732 1.1 rmind *rp = con->c_rproc;
733 1.1 rmind return true;
734 1.1 rmind }
735 1.1 rmind return false;
736 1.1 rmind }
737 1.1 rmind
738 1.1 rmind /*
739 1.1 rmind * npf_conn_setpass: mark connection as a "pass" one and associate the
740 1.1 rmind * rule procedure with it.
741 1.1 rmind */
742 1.1 rmind void
743 1.23 christos npf_conn_setpass(npf_conn_t *con, const npf_match_info_t *mi, npf_rproc_t *rp)
744 1.1 rmind {
745 1.1 rmind KASSERT((con->c_flags & CONN_ACTIVE) == 0);
746 1.1 rmind KASSERT(con->c_refcnt > 0);
747 1.1 rmind KASSERT(con->c_rproc == NULL);
748 1.1 rmind
749 1.1 rmind /*
750 1.1 rmind * No need for atomic since the connection is not yet active.
751 1.1 rmind * If rproc is set, the caller transfers its reference to us,
752 1.1 rmind * which will be released on npf_conn_destroy().
753 1.1 rmind */
754 1.14 rmind atomic_or_uint(&con->c_flags, CONN_PASS);
755 1.1 rmind con->c_rproc = rp;
756 1.24 rmind if (rp) {
757 1.24 rmind con->c_rid = mi->mi_rid;
758 1.24 rmind con->c_retfl = mi->mi_retfl;
759 1.24 rmind }
760 1.1 rmind }
761 1.1 rmind
762 1.1 rmind /*
763 1.1 rmind * npf_conn_release: release a reference, which might allow G/C thread
764 1.1 rmind * to destroy this connection.
765 1.1 rmind */
766 1.1 rmind void
767 1.1 rmind npf_conn_release(npf_conn_t *con)
768 1.1 rmind {
769 1.1 rmind if ((con->c_flags & (CONN_ACTIVE | CONN_EXPIRE)) == 0) {
770 1.1 rmind /* Activate: after this, connection is globally visible. */
771 1.14 rmind atomic_or_uint(&con->c_flags, CONN_ACTIVE);
772 1.1 rmind }
773 1.1 rmind KASSERT(con->c_refcnt > 0);
774 1.1 rmind atomic_dec_uint(&con->c_refcnt);
775 1.1 rmind }
776 1.1 rmind
777 1.1 rmind /*
778 1.13 rmind * npf_conn_getnat: return associated NAT data entry and indicate
779 1.1 rmind * whether it is a "forwards" or "backwards" stream.
780 1.1 rmind */
781 1.1 rmind npf_nat_t *
782 1.13 rmind npf_conn_getnat(npf_conn_t *con, const int di, bool *forw)
783 1.1 rmind {
784 1.1 rmind KASSERT(con->c_refcnt > 0);
785 1.22 christos *forw = (con->c_flags & PFIL_ALL) == (u_int)di;
786 1.1 rmind return con->c_nat;
787 1.1 rmind }
788 1.1 rmind
789 1.1 rmind /*
790 1.1 rmind * npf_conn_expired: criterion to check if connection is expired.
791 1.1 rmind */
792 1.1 rmind static inline bool
793 1.22 christos npf_conn_expired(const npf_conn_t *con, uint64_t tsnow)
794 1.1 rmind {
795 1.1 rmind const int etime = npf_state_etime(&con->c_state, con->c_proto);
796 1.22 christos int elapsed;
797 1.1 rmind
798 1.1 rmind if (__predict_false(con->c_flags & CONN_EXPIRE)) {
799 1.1 rmind /* Explicitly marked to be expired. */
800 1.1 rmind return true;
801 1.1 rmind }
802 1.22 christos
803 1.22 christos /*
804 1.22 christos * Note: another thread may update 'atime' and it might
805 1.22 christos * become greater than 'now'.
806 1.22 christos */
807 1.22 christos elapsed = (int64_t)tsnow - con->c_atime;
808 1.22 christos return elapsed > etime;
809 1.1 rmind }
810 1.1 rmind
811 1.1 rmind /*
812 1.6 rmind * npf_conn_gc: garbage collect the expired connections.
813 1.6 rmind *
814 1.6 rmind * => Must run in a single-threaded manner.
815 1.6 rmind * => If it is a flush request, then destroy all connections.
816 1.6 rmind * => If 'sync' is true, then perform passive serialisation.
817 1.1 rmind */
818 1.7 rmind void
819 1.22 christos npf_conn_gc(npf_t *npf, npf_conndb_t *cd, bool flush, bool sync)
820 1.1 rmind {
821 1.1 rmind npf_conn_t *con, *prev, *gclist = NULL;
822 1.1 rmind struct timespec tsnow;
823 1.1 rmind
824 1.1 rmind getnanouptime(&tsnow);
825 1.1 rmind
826 1.1 rmind /*
827 1.1 rmind * Scan all connections and check them for expiration.
828 1.1 rmind */
829 1.1 rmind prev = NULL;
830 1.1 rmind con = npf_conndb_getlist(cd);
831 1.1 rmind while (con) {
832 1.1 rmind npf_conn_t *next = con->c_next;
833 1.1 rmind
834 1.1 rmind /* Expired? Flushing all? */
835 1.22 christos if (!npf_conn_expired(con, tsnow.tv_sec) && !flush) {
836 1.1 rmind prev = con;
837 1.1 rmind con = next;
838 1.1 rmind continue;
839 1.1 rmind }
840 1.1 rmind
841 1.1 rmind /* Remove both entries of the connection. */
842 1.1 rmind mutex_enter(&con->c_lock);
843 1.1 rmind if ((con->c_flags & CONN_REMOVED) == 0) {
844 1.1 rmind npf_conn_t *ret __diagused;
845 1.1 rmind
846 1.1 rmind ret = npf_conndb_remove(cd, &con->c_forw_entry);
847 1.1 rmind KASSERT(ret == con);
848 1.1 rmind ret = npf_conndb_remove(cd, &con->c_back_entry);
849 1.1 rmind KASSERT(ret == con);
850 1.1 rmind }
851 1.1 rmind
852 1.1 rmind /* Flag the removal and expiration. */
853 1.1 rmind atomic_or_uint(&con->c_flags, CONN_REMOVED | CONN_EXPIRE);
854 1.1 rmind mutex_exit(&con->c_lock);
855 1.1 rmind
856 1.1 rmind /* Move to the G/C list. */
857 1.1 rmind npf_conndb_dequeue(cd, con, prev);
858 1.1 rmind con->c_next = gclist;
859 1.1 rmind gclist = con;
860 1.1 rmind
861 1.1 rmind /* Next.. */
862 1.1 rmind con = next;
863 1.1 rmind }
864 1.1 rmind npf_conndb_settail(cd, prev);
865 1.6 rmind
866 1.6 rmind /*
867 1.6 rmind * Ensure it is safe to destroy the connections.
868 1.6 rmind * Note: drop the conn_lock (see the lock order).
869 1.6 rmind */
870 1.6 rmind if (sync) {
871 1.22 christos mutex_exit(&npf->conn_lock);
872 1.6 rmind if (gclist) {
873 1.22 christos npf_config_enter(npf);
874 1.22 christos npf_config_sync(npf);
875 1.22 christos npf_config_exit(npf);
876 1.6 rmind }
877 1.1 rmind }
878 1.1 rmind
879 1.1 rmind /*
880 1.1 rmind * Garbage collect all expired connections.
881 1.1 rmind * May need to wait for the references to drain.
882 1.1 rmind */
883 1.1 rmind con = gclist;
884 1.1 rmind while (con) {
885 1.1 rmind npf_conn_t *next = con->c_next;
886 1.1 rmind
887 1.1 rmind /*
888 1.1 rmind * Destroy only if removed and no references.
889 1.1 rmind * Otherwise, wait for a tiny moment.
890 1.1 rmind */
891 1.1 rmind if (__predict_false(con->c_refcnt)) {
892 1.1 rmind kpause("npfcongc", false, 1, NULL);
893 1.1 rmind continue;
894 1.1 rmind }
895 1.22 christos npf_conn_destroy(npf, con);
896 1.1 rmind con = next;
897 1.1 rmind }
898 1.1 rmind }
899 1.1 rmind
900 1.6 rmind /*
901 1.6 rmind * npf_conn_worker: G/C to run from a worker thread.
902 1.6 rmind */
903 1.22 christos void
904 1.22 christos npf_conn_worker(npf_t *npf)
905 1.1 rmind {
906 1.22 christos mutex_enter(&npf->conn_lock);
907 1.6 rmind /* Note: the conn_lock will be released (sync == true). */
908 1.22 christos npf_conn_gc(npf, npf->conn_db, false, true);
909 1.1 rmind }
910 1.1 rmind
911 1.1 rmind /*
912 1.10 rmind * npf_conndb_export: construct a list of connections prepared for saving.
913 1.1 rmind * Note: this is expected to be an expensive operation.
914 1.1 rmind */
915 1.1 rmind int
916 1.22 christos npf_conndb_export(npf_t *npf, prop_array_t conlist)
917 1.1 rmind {
918 1.1 rmind npf_conn_t *con, *prev;
919 1.1 rmind
920 1.1 rmind /*
921 1.1 rmind * Note: acquire conn_lock to prevent from the database
922 1.1 rmind * destruction and G/C thread.
923 1.1 rmind */
924 1.22 christos mutex_enter(&npf->conn_lock);
925 1.22 christos if (npf->conn_tracking != CONN_TRACKING_ON) {
926 1.22 christos mutex_exit(&npf->conn_lock);
927 1.1 rmind return 0;
928 1.1 rmind }
929 1.1 rmind prev = NULL;
930 1.22 christos con = npf_conndb_getlist(npf->conn_db);
931 1.1 rmind while (con) {
932 1.1 rmind npf_conn_t *next = con->c_next;
933 1.10 rmind prop_dictionary_t cdict;
934 1.1 rmind
935 1.22 christos if ((cdict = npf_conn_export(npf, con)) != NULL) {
936 1.10 rmind prop_array_add(conlist, cdict);
937 1.10 rmind prop_object_release(cdict);
938 1.1 rmind }
939 1.1 rmind prev = con;
940 1.1 rmind con = next;
941 1.1 rmind }
942 1.22 christos npf_conndb_settail(npf->conn_db, prev);
943 1.22 christos mutex_exit(&npf->conn_lock);
944 1.5 joerg return 0;
945 1.1 rmind }
946 1.1 rmind
947 1.20 christos static prop_dictionary_t
948 1.20 christos npf_connkey_export(const npf_connkey_t *key)
949 1.20 christos {
950 1.20 christos uint16_t id[2], alen, proto;
951 1.22 christos prop_dictionary_t kdict;
952 1.20 christos npf_addr_t ips[2];
953 1.20 christos prop_data_t d;
954 1.20 christos
955 1.22 christos kdict = prop_dictionary_create();
956 1.20 christos connkey_getkey(key, &proto, ips, id, &alen);
957 1.20 christos
958 1.20 christos prop_dictionary_set_uint16(kdict, "proto", proto);
959 1.20 christos
960 1.20 christos prop_dictionary_set_uint16(kdict, "sport", id[NPF_SRC]);
961 1.20 christos prop_dictionary_set_uint16(kdict, "dport", id[NPF_DST]);
962 1.20 christos
963 1.20 christos d = prop_data_create_data(&ips[NPF_SRC], alen);
964 1.20 christos prop_dictionary_set_and_rel(kdict, "saddr", d);
965 1.20 christos
966 1.20 christos d = prop_data_create_data(&ips[NPF_DST], alen);
967 1.20 christos prop_dictionary_set_and_rel(kdict, "daddr", d);
968 1.20 christos
969 1.20 christos return kdict;
970 1.20 christos }
971 1.20 christos
972 1.1 rmind /*
973 1.10 rmind * npf_conn_export: serialise a single connection.
974 1.10 rmind */
975 1.10 rmind prop_dictionary_t
976 1.22 christos npf_conn_export(npf_t *npf, const npf_conn_t *con)
977 1.10 rmind {
978 1.20 christos prop_dictionary_t cdict, kdict;
979 1.10 rmind prop_data_t d;
980 1.10 rmind
981 1.10 rmind if ((con->c_flags & (CONN_ACTIVE|CONN_EXPIRE)) != CONN_ACTIVE) {
982 1.10 rmind return NULL;
983 1.10 rmind }
984 1.10 rmind cdict = prop_dictionary_create();
985 1.10 rmind prop_dictionary_set_uint32(cdict, "flags", con->c_flags);
986 1.10 rmind prop_dictionary_set_uint32(cdict, "proto", con->c_proto);
987 1.10 rmind if (con->c_ifid) {
988 1.22 christos const char *ifname = npf_ifmap_getname(npf, con->c_ifid);
989 1.10 rmind prop_dictionary_set_cstring(cdict, "ifname", ifname);
990 1.10 rmind }
991 1.10 rmind
992 1.10 rmind d = prop_data_create_data(&con->c_state, sizeof(npf_state_t));
993 1.10 rmind prop_dictionary_set_and_rel(cdict, "state", d);
994 1.10 rmind
995 1.20 christos kdict = npf_connkey_export(&con->c_forw_entry);
996 1.20 christos prop_dictionary_set_and_rel(cdict, "forw-key", kdict);
997 1.10 rmind
998 1.20 christos kdict = npf_connkey_export(&con->c_back_entry);
999 1.20 christos prop_dictionary_set_and_rel(cdict, "back-key", kdict);
1000 1.10 rmind
1001 1.10 rmind if (con->c_nat) {
1002 1.10 rmind npf_nat_export(cdict, con->c_nat);
1003 1.10 rmind }
1004 1.10 rmind return cdict;
1005 1.10 rmind }
1006 1.10 rmind
1007 1.18 christos static uint32_t
1008 1.20 christos npf_connkey_import(prop_dictionary_t kdict, npf_connkey_t *key)
1009 1.18 christos {
1010 1.18 christos prop_object_t sobj, dobj;
1011 1.18 christos npf_addr_t const * ips[2];
1012 1.22 christos uint16_t alen, proto, id[2];
1013 1.18 christos
1014 1.20 christos if (!prop_dictionary_get_uint16(kdict, "proto", &proto))
1015 1.20 christos return 0;
1016 1.20 christos
1017 1.20 christos if (!prop_dictionary_get_uint16(kdict, "sport", &id[NPF_SRC]))
1018 1.20 christos return 0;
1019 1.18 christos
1020 1.20 christos if (!prop_dictionary_get_uint16(kdict, "dport", &id[NPF_DST]))
1021 1.20 christos return 0;
1022 1.18 christos
1023 1.20 christos sobj = prop_dictionary_get(kdict, "saddr");
1024 1.18 christos if ((ips[NPF_SRC] = prop_data_data_nocopy(sobj)) == NULL)
1025 1.18 christos return 0;
1026 1.18 christos
1027 1.20 christos dobj = prop_dictionary_get(kdict, "daddr");
1028 1.18 christos if ((ips[NPF_DST] = prop_data_data_nocopy(dobj)) == NULL)
1029 1.18 christos return 0;
1030 1.18 christos
1031 1.22 christos alen = prop_data_size(sobj);
1032 1.18 christos if (alen != prop_data_size(dobj))
1033 1.18 christos return 0;
1034 1.19 kre
1035 1.18 christos return connkey_setkey(key, proto, ips, id, alen, true);
1036 1.18 christos }
1037 1.18 christos
1038 1.10 rmind /*
1039 1.6 rmind * npf_conn_import: fully reconstruct a single connection from a
1040 1.6 rmind * directory and insert into the given database.
1041 1.1 rmind */
1042 1.1 rmind int
1043 1.22 christos npf_conn_import(npf_t *npf, npf_conndb_t *cd, prop_dictionary_t cdict,
1044 1.6 rmind npf_ruleset_t *natlist)
1045 1.1 rmind {
1046 1.1 rmind npf_conn_t *con;
1047 1.1 rmind npf_connkey_t *fw, *bk;
1048 1.1 rmind prop_object_t obj;
1049 1.10 rmind const char *ifname;
1050 1.1 rmind const void *d;
1051 1.1 rmind
1052 1.1 rmind /* Allocate a connection and initialise it (clear first). */
1053 1.22 christos con = pool_cache_get(npf->conn_cache, PR_WAITOK);
1054 1.1 rmind memset(con, 0, sizeof(npf_conn_t));
1055 1.1 rmind mutex_init(&con->c_lock, MUTEX_DEFAULT, IPL_SOFTNET);
1056 1.22 christos npf_stats_inc(npf, NPF_STAT_CONN_CREATE);
1057 1.1 rmind
1058 1.1 rmind prop_dictionary_get_uint32(cdict, "proto", &con->c_proto);
1059 1.1 rmind prop_dictionary_get_uint32(cdict, "flags", &con->c_flags);
1060 1.1 rmind con->c_flags &= PFIL_ALL | CONN_ACTIVE | CONN_PASS;
1061 1.22 christos conn_update_atime(con);
1062 1.1 rmind
1063 1.10 rmind if (prop_dictionary_get_cstring_nocopy(cdict, "ifname", &ifname) &&
1064 1.22 christos (con->c_ifid = npf_ifmap_register(npf, ifname)) == 0) {
1065 1.10 rmind goto err;
1066 1.10 rmind }
1067 1.10 rmind
1068 1.1 rmind obj = prop_dictionary_get(cdict, "state");
1069 1.1 rmind if ((d = prop_data_data_nocopy(obj)) == NULL ||
1070 1.1 rmind prop_data_size(obj) != sizeof(npf_state_t)) {
1071 1.1 rmind goto err;
1072 1.1 rmind }
1073 1.1 rmind memcpy(&con->c_state, d, sizeof(npf_state_t));
1074 1.1 rmind
1075 1.11 rmind /* Reconstruct NAT association, if any. */
1076 1.11 rmind if ((obj = prop_dictionary_get(cdict, "nat")) != NULL &&
1077 1.22 christos (con->c_nat = npf_nat_import(npf, obj, natlist, con)) == NULL) {
1078 1.11 rmind goto err;
1079 1.11 rmind }
1080 1.1 rmind
1081 1.1 rmind /*
1082 1.1 rmind * Fetch and copy the keys for each direction.
1083 1.1 rmind */
1084 1.1 rmind obj = prop_dictionary_get(cdict, "forw-key");
1085 1.20 christos fw = &con->c_forw_entry;
1086 1.20 christos if (obj == NULL || !npf_connkey_import(obj, fw)) {
1087 1.1 rmind goto err;
1088 1.1 rmind }
1089 1.1 rmind
1090 1.1 rmind obj = prop_dictionary_get(cdict, "back-key");
1091 1.20 christos bk = &con->c_back_entry;
1092 1.20 christos if (obj == NULL || !npf_connkey_import(obj, bk)) {
1093 1.1 rmind goto err;
1094 1.1 rmind }
1095 1.1 rmind
1096 1.1 rmind fw->ck_backptr = bk->ck_backptr = con;
1097 1.1 rmind
1098 1.1 rmind /* Insert the entries and the connection itself. */
1099 1.1 rmind if (!npf_conndb_insert(cd, fw, con)) {
1100 1.1 rmind goto err;
1101 1.1 rmind }
1102 1.1 rmind if (!npf_conndb_insert(cd, bk, con)) {
1103 1.1 rmind npf_conndb_remove(cd, fw);
1104 1.1 rmind goto err;
1105 1.1 rmind }
1106 1.12 rmind
1107 1.12 rmind NPF_PRINTF(("NPF: imported conn %p\n", con));
1108 1.1 rmind npf_conndb_enqueue(cd, con);
1109 1.1 rmind return 0;
1110 1.1 rmind err:
1111 1.22 christos npf_conn_destroy(npf, con);
1112 1.1 rmind return EINVAL;
1113 1.1 rmind }
1114 1.1 rmind
1115 1.20 christos int
1116 1.22 christos npf_conn_find(npf_t *npf, prop_dictionary_t idict, prop_dictionary_t *odict)
1117 1.20 christos {
1118 1.22 christos prop_dictionary_t kdict;
1119 1.20 christos npf_connkey_t key;
1120 1.20 christos npf_conn_t *con;
1121 1.20 christos uint16_t dir;
1122 1.20 christos bool forw;
1123 1.20 christos
1124 1.20 christos if ((kdict = prop_dictionary_get(idict, "key")) == NULL)
1125 1.20 christos return EINVAL;
1126 1.20 christos
1127 1.20 christos if (!npf_connkey_import(kdict, &key))
1128 1.20 christos return EINVAL;
1129 1.20 christos
1130 1.20 christos if (!prop_dictionary_get_uint16(idict, "direction", &dir))
1131 1.20 christos return EINVAL;
1132 1.20 christos
1133 1.22 christos con = npf_conndb_lookup(npf->conn_db, &key, &forw);
1134 1.20 christos if (con == NULL) {
1135 1.20 christos return ESRCH;
1136 1.20 christos }
1137 1.20 christos
1138 1.20 christos if (!npf_conn_ok(con, dir, true)) {
1139 1.20 christos atomic_dec_uint(&con->c_refcnt);
1140 1.20 christos return ESRCH;
1141 1.20 christos }
1142 1.20 christos
1143 1.22 christos *odict = npf_conn_export(npf, con);
1144 1.20 christos if (*odict == NULL) {
1145 1.20 christos atomic_dec_uint(&con->c_refcnt);
1146 1.20 christos return ENOSPC;
1147 1.20 christos }
1148 1.20 christos atomic_dec_uint(&con->c_refcnt);
1149 1.20 christos
1150 1.20 christos return 0;
1151 1.20 christos }
1152 1.20 christos
1153 1.1 rmind #if defined(DDB) || defined(_NPF_TESTING)
1154 1.1 rmind
1155 1.1 rmind void
1156 1.1 rmind npf_conn_print(const npf_conn_t *con)
1157 1.1 rmind {
1158 1.1 rmind const u_int alen = NPF_CONN_GETALEN(&con->c_forw_entry);
1159 1.1 rmind const uint32_t *fkey = con->c_forw_entry.ck_key;
1160 1.1 rmind const uint32_t *bkey = con->c_back_entry.ck_key;
1161 1.1 rmind const u_int proto = con->c_proto;
1162 1.22 christos struct timespec tspnow;
1163 1.1 rmind const void *src, *dst;
1164 1.1 rmind int etime;
1165 1.1 rmind
1166 1.22 christos getnanouptime(&tspnow);
1167 1.1 rmind etime = npf_state_etime(&con->c_state, proto);
1168 1.1 rmind
1169 1.22 christos printf("%p:\n\tproto %d flags 0x%x tsdiff %ld etime %d\n", con,
1170 1.22 christos proto, con->c_flags, (long)(tspnow.tv_sec - con->c_atime), etime);
1171 1.1 rmind
1172 1.1 rmind src = &fkey[2], dst = &fkey[2 + (alen >> 2)];
1173 1.1 rmind printf("\tforw %s:%d", npf_addr_dump(src, alen), ntohs(fkey[1] >> 16));
1174 1.1 rmind printf("-> %s:%d\n", npf_addr_dump(dst, alen), ntohs(fkey[1] & 0xffff));
1175 1.1 rmind
1176 1.1 rmind src = &bkey[2], dst = &bkey[2 + (alen >> 2)];
1177 1.1 rmind printf("\tback %s:%d", npf_addr_dump(src, alen), ntohs(bkey[1] >> 16));
1178 1.1 rmind printf("-> %s:%d\n", npf_addr_dump(dst, alen), ntohs(bkey[1] & 0xffff));
1179 1.1 rmind
1180 1.1 rmind npf_state_dump(&con->c_state);
1181 1.1 rmind if (con->c_nat) {
1182 1.1 rmind npf_nat_dump(con->c_nat);
1183 1.1 rmind }
1184 1.1 rmind }
1185 1.1 rmind
1186 1.1 rmind #endif
1187