Home | History | Annotate | Line # | Download | only in npf
npf_os.c revision 1.7
      1  1.7  pgoyette /*	$NetBSD: npf_os.c,v 1.7 2017/07/20 23:37:56 pgoyette Exp $	*/
      2  1.1  christos 
      3  1.1  christos /*-
      4  1.1  christos  * Copyright (c) 2009-2016 The NetBSD Foundation, Inc.
      5  1.1  christos  * All rights reserved.
      6  1.1  christos  *
      7  1.1  christos  * This material is based upon work partially supported by The
      8  1.1  christos  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  1.1  christos  *
     10  1.1  christos  * Redistribution and use in source and binary forms, with or without
     11  1.1  christos  * modification, are permitted provided that the following conditions
     12  1.1  christos  * are met:
     13  1.1  christos  * 1. Redistributions of source code must retain the above copyright
     14  1.1  christos  *    notice, this list of conditions and the following disclaimer.
     15  1.1  christos  * 2. Redistributions in binary form must reproduce the above copyright
     16  1.1  christos  *    notice, this list of conditions and the following disclaimer in the
     17  1.1  christos  *    documentation and/or other materials provided with the distribution.
     18  1.1  christos  *
     19  1.1  christos  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  1.1  christos  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  1.1  christos  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  1.1  christos  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  1.1  christos  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  1.1  christos  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  1.1  christos  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  1.1  christos  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  1.1  christos  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  1.1  christos  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  1.1  christos  * POSSIBILITY OF SUCH DAMAGE.
     30  1.1  christos  */
     31  1.1  christos 
     32  1.1  christos /*
     33  1.1  christos  * NPF main: dynamic load/initialisation and unload routines.
     34  1.1  christos  */
     35  1.1  christos 
     36  1.1  christos #ifdef _KERNEL
     37  1.1  christos #include <sys/cdefs.h>
     38  1.7  pgoyette __KERNEL_RCSID(0, "$NetBSD: npf_os.c,v 1.7 2017/07/20 23:37:56 pgoyette Exp $");
     39  1.1  christos 
     40  1.1  christos #ifdef _KERNEL_OPT
     41  1.1  christos #include "pf.h"
     42  1.1  christos #if NPF > 0
     43  1.1  christos #error "NPF and PF are mutually exclusive; please select one"
     44  1.1  christos #endif
     45  1.1  christos #endif
     46  1.1  christos 
     47  1.1  christos #include <sys/param.h>
     48  1.1  christos #include <sys/types.h>
     49  1.1  christos 
     50  1.1  christos #include <sys/conf.h>
     51  1.1  christos #include <sys/kauth.h>
     52  1.1  christos #include <sys/kmem.h>
     53  1.1  christos #include <sys/lwp.h>
     54  1.1  christos #include <sys/module.h>
     55  1.1  christos #include <sys/socketvar.h>
     56  1.1  christos #include <sys/uio.h>
     57  1.4  christos 
     58  1.4  christos #include <netinet/in.h>
     59  1.4  christos #include <netinet6/in6_var.h>
     60  1.1  christos #endif
     61  1.1  christos 
     62  1.1  christos #include "npf_impl.h"
     63  1.1  christos #include "npfkern.h"
     64  1.1  christos 
     65  1.1  christos #ifdef _KERNEL
     66  1.1  christos #ifndef _MODULE
     67  1.1  christos #include "opt_modular.h"
     68  1.6       ryo #include "opt_net_mpsafe.h"
     69  1.1  christos #endif
     70  1.1  christos #include "ioconf.h"
     71  1.1  christos #endif
     72  1.1  christos 
     73  1.1  christos /*
     74  1.1  christos  * Module and device structures.
     75  1.1  christos  */
     76  1.1  christos #ifndef _MODULE
     77  1.1  christos /*
     78  1.1  christos  * Modular kernels load drivers too early, and we need percpu to be inited
     79  1.1  christos  * So we make this misc; a better way would be to have early boot and late
     80  1.1  christos  * boot drivers.
     81  1.1  christos  */
     82  1.7  pgoyette MODULE(MODULE_CLASS_MISC, npf, "bpf");
     83  1.1  christos #else
     84  1.1  christos /* This module autoloads via /dev/npf so it needs to be a driver */
     85  1.7  pgoyette MODULE(MODULE_CLASS_DRIVER, npf, "bpf");
     86  1.1  christos #endif
     87  1.1  christos 
     88  1.1  christos static int	npf_dev_open(dev_t, int, int, lwp_t *);
     89  1.1  christos static int	npf_dev_close(dev_t, int, int, lwp_t *);
     90  1.1  christos static int	npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
     91  1.1  christos static int	npf_dev_poll(dev_t, int, lwp_t *);
     92  1.1  christos static int	npf_dev_read(dev_t, struct uio *, int);
     93  1.1  christos 
     94  1.1  christos const struct cdevsw npf_cdevsw = {
     95  1.1  christos 	.d_open = npf_dev_open,
     96  1.1  christos 	.d_close = npf_dev_close,
     97  1.1  christos 	.d_read = npf_dev_read,
     98  1.1  christos 	.d_write = nowrite,
     99  1.1  christos 	.d_ioctl = npf_dev_ioctl,
    100  1.1  christos 	.d_stop = nostop,
    101  1.1  christos 	.d_tty = notty,
    102  1.1  christos 	.d_poll = npf_dev_poll,
    103  1.1  christos 	.d_mmap = nommap,
    104  1.1  christos 	.d_kqfilter = nokqfilter,
    105  1.1  christos 	.d_discard = nodiscard,
    106  1.1  christos 	.d_flag = D_OTHER | D_MPSAFE
    107  1.1  christos };
    108  1.1  christos 
    109  1.1  christos static const char *	npf_ifop_getname(ifnet_t *);
    110  1.1  christos static ifnet_t *	npf_ifop_lookup(const char *);
    111  1.1  christos static void		npf_ifop_flush(void *);
    112  1.1  christos static void *		npf_ifop_getmeta(const ifnet_t *);
    113  1.1  christos static void		npf_ifop_setmeta(ifnet_t *, void *);
    114  1.1  christos 
    115  1.1  christos static const unsigned	nworkers = 1;
    116  1.1  christos 
    117  1.1  christos static bool		pfil_registered = false;
    118  1.1  christos static pfil_head_t *	npf_ph_if = NULL;
    119  1.1  christos static pfil_head_t *	npf_ph_inet = NULL;
    120  1.1  christos static pfil_head_t *	npf_ph_inet6 = NULL;
    121  1.1  christos 
    122  1.1  christos static const npf_ifops_t kern_ifops = {
    123  1.1  christos 	.getname	= npf_ifop_getname,
    124  1.1  christos 	.lookup		= npf_ifop_lookup,
    125  1.1  christos 	.flush		= npf_ifop_flush,
    126  1.1  christos 	.getmeta	= npf_ifop_getmeta,
    127  1.1  christos 	.setmeta	= npf_ifop_setmeta,
    128  1.1  christos };
    129  1.1  christos 
    130  1.1  christos static int
    131  1.1  christos npf_fini(void)
    132  1.1  christos {
    133  1.1  christos 	npf_t *npf = npf_getkernctx();
    134  1.1  christos 
    135  1.1  christos 	/* At first, detach device and remove pfil hooks. */
    136  1.1  christos #ifdef _MODULE
    137  1.1  christos 	devsw_detach(NULL, &npf_cdevsw);
    138  1.1  christos #endif
    139  1.1  christos 	npf_pfil_unregister(true);
    140  1.1  christos 	npf_destroy(npf);
    141  1.1  christos 	npf_sysfini();
    142  1.1  christos 	return 0;
    143  1.1  christos }
    144  1.1  christos 
    145  1.1  christos static int
    146  1.1  christos npf_init(void)
    147  1.1  christos {
    148  1.1  christos 	npf_t *npf;
    149  1.1  christos 	int error = 0;
    150  1.1  christos 
    151  1.1  christos 	error = npf_sysinit(nworkers);
    152  1.1  christos 	if (error)
    153  1.1  christos 		return error;
    154  1.1  christos 	npf = npf_create(0, NULL, &kern_ifops);
    155  1.1  christos 	npf_setkernctx(npf);
    156  1.1  christos 	npf_pfil_register(true);
    157  1.1  christos 
    158  1.1  christos #ifdef _MODULE
    159  1.1  christos 	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
    160  1.1  christos 
    161  1.1  christos 	/* Attach /dev/npf device. */
    162  1.1  christos 	error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
    163  1.1  christos 	if (error) {
    164  1.1  christos 		/* It will call devsw_detach(), which is safe. */
    165  1.1  christos 		(void)npf_fini();
    166  1.1  christos 	}
    167  1.1  christos #endif
    168  1.1  christos 	return error;
    169  1.1  christos }
    170  1.1  christos 
    171  1.1  christos 
    172  1.1  christos /*
    173  1.1  christos  * Module interface.
    174  1.1  christos  */
    175  1.1  christos static int
    176  1.1  christos npf_modcmd(modcmd_t cmd, void *arg)
    177  1.1  christos {
    178  1.1  christos 	switch (cmd) {
    179  1.1  christos 	case MODULE_CMD_INIT:
    180  1.1  christos 		return npf_init();
    181  1.1  christos 	case MODULE_CMD_FINI:
    182  1.1  christos 		return npf_fini();
    183  1.1  christos 	case MODULE_CMD_AUTOUNLOAD:
    184  1.1  christos 		if (npf_autounload_p()) {
    185  1.1  christos 			return EBUSY;
    186  1.1  christos 		}
    187  1.1  christos 		break;
    188  1.1  christos 	default:
    189  1.1  christos 		return ENOTTY;
    190  1.1  christos 	}
    191  1.1  christos 	return 0;
    192  1.1  christos }
    193  1.1  christos 
    194  1.1  christos void
    195  1.1  christos npfattach(int nunits)
    196  1.1  christos {
    197  1.1  christos 	/* Nothing */
    198  1.1  christos }
    199  1.1  christos 
    200  1.1  christos static int
    201  1.1  christos npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
    202  1.1  christos {
    203  1.1  christos 	/* Available only for super-user. */
    204  1.1  christos 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    205  1.1  christos 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    206  1.1  christos 		return EPERM;
    207  1.1  christos 	}
    208  1.1  christos 	return 0;
    209  1.1  christos }
    210  1.1  christos 
    211  1.1  christos static int
    212  1.1  christos npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
    213  1.1  christos {
    214  1.1  christos 	return 0;
    215  1.1  christos }
    216  1.1  christos 
    217  1.1  christos static int
    218  1.1  christos npf_stats_export(npf_t *npf, void *data)
    219  1.1  christos {
    220  1.1  christos 	uint64_t *fullst, *uptr = *(uint64_t **)data;
    221  1.1  christos 	int error;
    222  1.1  christos 
    223  1.1  christos 	fullst = kmem_alloc(NPF_STATS_SIZE, KM_SLEEP);
    224  1.1  christos 	npf_stats(npf, fullst); /* will zero the buffer */
    225  1.1  christos 	error = copyout(fullst, uptr, NPF_STATS_SIZE);
    226  1.1  christos 	kmem_free(fullst, NPF_STATS_SIZE);
    227  1.1  christos 	return error;
    228  1.1  christos }
    229  1.1  christos 
    230  1.1  christos static int
    231  1.1  christos npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
    232  1.1  christos {
    233  1.1  christos 	npf_t *npf = npf_getkernctx();
    234  1.1  christos 	int error;
    235  1.1  christos 
    236  1.1  christos 	/* Available only for super-user. */
    237  1.1  christos 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    238  1.1  christos 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    239  1.1  christos 		return EPERM;
    240  1.1  christos 	}
    241  1.1  christos 
    242  1.1  christos 	switch (cmd) {
    243  1.1  christos 	case IOC_NPF_TABLE:
    244  1.1  christos 		error = npfctl_table(npf, data);
    245  1.1  christos 		break;
    246  1.1  christos 	case IOC_NPF_RULE:
    247  1.1  christos 		error = npfctl_rule(npf, cmd, data);
    248  1.1  christos 		break;
    249  1.1  christos 	case IOC_NPF_STATS:
    250  1.1  christos 		error = npf_stats_export(npf, data);
    251  1.1  christos 		break;
    252  1.1  christos 	case IOC_NPF_SAVE:
    253  1.1  christos 		error = npfctl_save(npf, cmd, data);
    254  1.1  christos 		break;
    255  1.1  christos 	case IOC_NPF_SWITCH:
    256  1.1  christos 		error = npfctl_switch(data);
    257  1.1  christos 		break;
    258  1.1  christos 	case IOC_NPF_LOAD:
    259  1.1  christos 		error = npfctl_load(npf, cmd, data);
    260  1.1  christos 		break;
    261  1.1  christos 	case IOC_NPF_CONN_LOOKUP:
    262  1.1  christos 		error = npfctl_conn_lookup(npf, cmd, data);
    263  1.1  christos 		break;
    264  1.1  christos 	case IOC_NPF_VERSION:
    265  1.1  christos 		*(int *)data = NPF_VERSION;
    266  1.1  christos 		error = 0;
    267  1.1  christos 		break;
    268  1.1  christos 	default:
    269  1.1  christos 		error = ENOTTY;
    270  1.1  christos 		break;
    271  1.1  christos 	}
    272  1.1  christos 	return error;
    273  1.1  christos }
    274  1.1  christos 
    275  1.1  christos static int
    276  1.1  christos npf_dev_poll(dev_t dev, int events, lwp_t *l)
    277  1.1  christos {
    278  1.1  christos 	return ENOTSUP;
    279  1.1  christos }
    280  1.1  christos 
    281  1.1  christos static int
    282  1.1  christos npf_dev_read(dev_t dev, struct uio *uio, int flag)
    283  1.1  christos {
    284  1.1  christos 	return ENOTSUP;
    285  1.1  christos }
    286  1.1  christos 
    287  1.1  christos bool
    288  1.1  christos npf_autounload_p(void)
    289  1.1  christos {
    290  1.1  christos 	npf_t *npf = npf_getkernctx();
    291  1.1  christos 	return !npf_pfil_registered_p() && npf_default_pass(npf);
    292  1.1  christos }
    293  1.1  christos 
    294  1.1  christos /*
    295  1.1  christos  * Interface operations.
    296  1.1  christos  */
    297  1.1  christos 
    298  1.1  christos static const char *
    299  1.1  christos npf_ifop_getname(ifnet_t *ifp)
    300  1.1  christos {
    301  1.1  christos 	return ifp->if_xname;
    302  1.1  christos }
    303  1.1  christos 
    304  1.1  christos static ifnet_t *
    305  1.1  christos npf_ifop_lookup(const char *name)
    306  1.1  christos {
    307  1.1  christos 	return ifunit(name);
    308  1.1  christos }
    309  1.1  christos 
    310  1.1  christos static void
    311  1.1  christos npf_ifop_flush(void *arg)
    312  1.1  christos {
    313  1.1  christos 	ifnet_t *ifp;
    314  1.1  christos 
    315  1.1  christos 	KERNEL_LOCK(1, NULL);
    316  1.1  christos 	IFNET_LOCK();
    317  1.1  christos 	IFNET_WRITER_FOREACH(ifp) {
    318  1.1  christos 		ifp->if_pf_kif = arg;
    319  1.1  christos 	}
    320  1.1  christos 	IFNET_UNLOCK();
    321  1.1  christos 	KERNEL_UNLOCK_ONE(NULL);
    322  1.1  christos }
    323  1.1  christos 
    324  1.1  christos static void *
    325  1.1  christos npf_ifop_getmeta(const ifnet_t *ifp)
    326  1.1  christos {
    327  1.1  christos 	return ifp->if_pf_kif;
    328  1.1  christos }
    329  1.1  christos 
    330  1.1  christos static void
    331  1.1  christos npf_ifop_setmeta(ifnet_t *ifp, void *arg)
    332  1.1  christos {
    333  1.1  christos 	ifp->if_pf_kif = arg;
    334  1.1  christos }
    335  1.1  christos 
    336  1.1  christos #ifdef _KERNEL
    337  1.1  christos 
    338  1.1  christos /*
    339  1.1  christos  * Wrapper of the main packet handler to pass the kernel NPF context.
    340  1.1  christos  */
    341  1.1  christos static int
    342  1.1  christos npfkern_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
    343  1.1  christos {
    344  1.1  christos 	npf_t *npf = npf_getkernctx();
    345  1.1  christos 	return npf_packet_handler(npf, mp, ifp, di);
    346  1.1  christos }
    347  1.1  christos 
    348  1.1  christos /*
    349  1.1  christos  * npf_ifhook: hook handling interface changes.
    350  1.1  christos  */
    351  1.2     rmind static void
    352  1.2     rmind npf_ifhook(void *arg, unsigned long cmd, void *arg2)
    353  1.1  christos {
    354  1.1  christos 	npf_t *npf = npf_getkernctx();
    355  1.2     rmind 	ifnet_t *ifp = arg2;
    356  1.1  christos 
    357  1.2     rmind 	switch (cmd) {
    358  1.2     rmind 	case PFIL_IFNET_ATTACH:
    359  1.2     rmind 		npf_ifmap_attach(npf, ifp);
    360  1.3     rmind 		npf_ifaddr_sync(npf, ifp);
    361  1.2     rmind 		break;
    362  1.2     rmind 	case PFIL_IFNET_DETACH:
    363  1.2     rmind 		npf_ifmap_detach(npf, ifp);
    364  1.3     rmind 		npf_ifaddr_flush(npf, ifp);
    365  1.2     rmind 		break;
    366  1.1  christos 	}
    367  1.1  christos }
    368  1.1  christos 
    369  1.3     rmind static void
    370  1.3     rmind npf_ifaddrhook(void *arg, u_long cmd, void *arg2)
    371  1.3     rmind {
    372  1.3     rmind 	npf_t *npf = npf_getkernctx();
    373  1.3     rmind 	struct ifaddr *ifa = arg2;
    374  1.3     rmind 
    375  1.3     rmind 	switch (cmd) {
    376  1.3     rmind 	case SIOCSIFADDR:
    377  1.3     rmind 	case SIOCAIFADDR:
    378  1.3     rmind 	case SIOCDIFADDR:
    379  1.3     rmind #ifdef INET6
    380  1.3     rmind 	case SIOCSIFADDR_IN6:
    381  1.3     rmind 	case SIOCAIFADDR_IN6:
    382  1.3     rmind 	case SIOCDIFADDR_IN6:
    383  1.3     rmind #endif
    384  1.3     rmind 		break;
    385  1.3     rmind 	default:
    386  1.3     rmind 		return;
    387  1.3     rmind 	}
    388  1.3     rmind 	npf_ifaddr_sync(npf, ifa->ifa_ifp);
    389  1.3     rmind }
    390  1.3     rmind 
    391  1.1  christos /*
    392  1.1  christos  * npf_pfil_register: register pfil(9) hooks.
    393  1.1  christos  */
    394  1.1  christos int
    395  1.1  christos npf_pfil_register(bool init)
    396  1.1  christos {
    397  1.1  christos 	npf_t *npf = npf_getkernctx();
    398  1.1  christos 	int error = 0;
    399  1.1  christos 
    400  1.6       ryo #ifndef NET_MPSAFE
    401  1.1  christos 	mutex_enter(softnet_lock);
    402  1.1  christos 	KERNEL_LOCK(1, NULL);
    403  1.6       ryo #endif
    404  1.1  christos 
    405  1.1  christos 	/* Init: interface re-config and attach/detach hook. */
    406  1.1  christos 	if (!npf_ph_if) {
    407  1.1  christos 		npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
    408  1.1  christos 		if (!npf_ph_if) {
    409  1.1  christos 			error = ENOENT;
    410  1.1  christos 			goto out;
    411  1.1  christos 		}
    412  1.3     rmind 
    413  1.3     rmind 		error = pfil_add_ihook(npf_ifhook, NULL,
    414  1.3     rmind 		    PFIL_IFNET, npf_ph_if);
    415  1.3     rmind 		KASSERT(error == 0);
    416  1.3     rmind 
    417  1.3     rmind 		error = pfil_add_ihook(npf_ifaddrhook, NULL,
    418  1.3     rmind 		    PFIL_IFADDR, npf_ph_if);
    419  1.1  christos 		KASSERT(error == 0);
    420  1.1  christos 	}
    421  1.1  christos 	if (init) {
    422  1.1  christos 		goto out;
    423  1.1  christos 	}
    424  1.1  christos 
    425  1.1  christos 	/* Check if pfil hooks are not already registered. */
    426  1.1  christos 	if (pfil_registered) {
    427  1.1  christos 		error = EEXIST;
    428  1.1  christos 		goto out;
    429  1.1  christos 	}
    430  1.1  christos 
    431  1.1  christos 	/* Capture points of the activity in the IP layer. */
    432  1.1  christos 	npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
    433  1.1  christos 	npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
    434  1.1  christos 	if (!npf_ph_inet && !npf_ph_inet6) {
    435  1.1  christos 		error = ENOENT;
    436  1.1  christos 		goto out;
    437  1.1  christos 	}
    438  1.1  christos 
    439  1.1  christos 	/* Packet IN/OUT handlers for IP layer. */
    440  1.1  christos 	if (npf_ph_inet) {
    441  1.1  christos 		error = pfil_add_hook(npfkern_packet_handler, npf,
    442  1.1  christos 		    PFIL_ALL, npf_ph_inet);
    443  1.1  christos 		KASSERT(error == 0);
    444  1.1  christos 	}
    445  1.1  christos 	if (npf_ph_inet6) {
    446  1.1  christos 		error = pfil_add_hook(npfkern_packet_handler, npf,
    447  1.1  christos 		    PFIL_ALL, npf_ph_inet6);
    448  1.1  christos 		KASSERT(error == 0);
    449  1.1  christos 	}
    450  1.5     rmind 
    451  1.5     rmind 	/*
    452  1.5     rmind 	 * It is necessary to re-sync all/any interface address tables,
    453  1.5     rmind 	 * since we did not listen for any changes.
    454  1.5     rmind 	 */
    455  1.5     rmind 	npf_ifaddr_syncall(npf);
    456  1.1  christos 	pfil_registered = true;
    457  1.1  christos out:
    458  1.6       ryo #ifndef NET_MPSAFE
    459  1.1  christos 	KERNEL_UNLOCK_ONE(NULL);
    460  1.1  christos 	mutex_exit(softnet_lock);
    461  1.6       ryo #endif
    462  1.1  christos 
    463  1.1  christos 	return error;
    464  1.1  christos }
    465  1.1  christos 
    466  1.1  christos /*
    467  1.1  christos  * npf_pfil_unregister: unregister pfil(9) hooks.
    468  1.1  christos  */
    469  1.1  christos void
    470  1.1  christos npf_pfil_unregister(bool fini)
    471  1.1  christos {
    472  1.1  christos 	npf_t *npf = npf_getkernctx();
    473  1.1  christos 
    474  1.6       ryo #ifndef NET_MPSAFE
    475  1.1  christos 	mutex_enter(softnet_lock);
    476  1.1  christos 	KERNEL_LOCK(1, NULL);
    477  1.6       ryo #endif
    478  1.1  christos 
    479  1.1  christos 	if (fini && npf_ph_if) {
    480  1.3     rmind 		(void)pfil_remove_ihook(npf_ifhook, NULL,
    481  1.3     rmind 		    PFIL_IFNET, npf_ph_if);
    482  1.3     rmind 		(void)pfil_remove_ihook(npf_ifaddrhook, NULL,
    483  1.3     rmind 		    PFIL_IFADDR, npf_ph_if);
    484  1.1  christos 	}
    485  1.1  christos 	if (npf_ph_inet) {
    486  1.1  christos 		(void)pfil_remove_hook(npfkern_packet_handler, npf,
    487  1.1  christos 		    PFIL_ALL, npf_ph_inet);
    488  1.1  christos 	}
    489  1.1  christos 	if (npf_ph_inet6) {
    490  1.1  christos 		(void)pfil_remove_hook(npfkern_packet_handler, npf,
    491  1.1  christos 		    PFIL_ALL, npf_ph_inet6);
    492  1.1  christos 	}
    493  1.1  christos 	pfil_registered = false;
    494  1.1  christos 
    495  1.6       ryo #ifndef NET_MPSAFE
    496  1.1  christos 	KERNEL_UNLOCK_ONE(NULL);
    497  1.1  christos 	mutex_exit(softnet_lock);
    498  1.6       ryo #endif
    499  1.1  christos }
    500  1.1  christos 
    501  1.1  christos bool
    502  1.1  christos npf_pfil_registered_p(void)
    503  1.1  christos {
    504  1.1  christos 	return pfil_registered;
    505  1.1  christos }
    506  1.1  christos #endif
    507