npf_os.c revision 1.7 1 1.7 pgoyette /* $NetBSD: npf_os.c,v 1.7 2017/07/20 23:37:56 pgoyette Exp $ */
2 1.1 christos
3 1.1 christos /*-
4 1.1 christos * Copyright (c) 2009-2016 The NetBSD Foundation, Inc.
5 1.1 christos * All rights reserved.
6 1.1 christos *
7 1.1 christos * This material is based upon work partially supported by The
8 1.1 christos * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 1.1 christos *
10 1.1 christos * Redistribution and use in source and binary forms, with or without
11 1.1 christos * modification, are permitted provided that the following conditions
12 1.1 christos * are met:
13 1.1 christos * 1. Redistributions of source code must retain the above copyright
14 1.1 christos * notice, this list of conditions and the following disclaimer.
15 1.1 christos * 2. Redistributions in binary form must reproduce the above copyright
16 1.1 christos * notice, this list of conditions and the following disclaimer in the
17 1.1 christos * documentation and/or other materials provided with the distribution.
18 1.1 christos *
19 1.1 christos * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 1.1 christos * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 1.1 christos * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 1.1 christos * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 1.1 christos * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 1.1 christos * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 1.1 christos * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 1.1 christos * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 1.1 christos * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 1.1 christos * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 1.1 christos * POSSIBILITY OF SUCH DAMAGE.
30 1.1 christos */
31 1.1 christos
32 1.1 christos /*
33 1.1 christos * NPF main: dynamic load/initialisation and unload routines.
34 1.1 christos */
35 1.1 christos
36 1.1 christos #ifdef _KERNEL
37 1.1 christos #include <sys/cdefs.h>
38 1.7 pgoyette __KERNEL_RCSID(0, "$NetBSD: npf_os.c,v 1.7 2017/07/20 23:37:56 pgoyette Exp $");
39 1.1 christos
40 1.1 christos #ifdef _KERNEL_OPT
41 1.1 christos #include "pf.h"
42 1.1 christos #if NPF > 0
43 1.1 christos #error "NPF and PF are mutually exclusive; please select one"
44 1.1 christos #endif
45 1.1 christos #endif
46 1.1 christos
47 1.1 christos #include <sys/param.h>
48 1.1 christos #include <sys/types.h>
49 1.1 christos
50 1.1 christos #include <sys/conf.h>
51 1.1 christos #include <sys/kauth.h>
52 1.1 christos #include <sys/kmem.h>
53 1.1 christos #include <sys/lwp.h>
54 1.1 christos #include <sys/module.h>
55 1.1 christos #include <sys/socketvar.h>
56 1.1 christos #include <sys/uio.h>
57 1.4 christos
58 1.4 christos #include <netinet/in.h>
59 1.4 christos #include <netinet6/in6_var.h>
60 1.1 christos #endif
61 1.1 christos
62 1.1 christos #include "npf_impl.h"
63 1.1 christos #include "npfkern.h"
64 1.1 christos
65 1.1 christos #ifdef _KERNEL
66 1.1 christos #ifndef _MODULE
67 1.1 christos #include "opt_modular.h"
68 1.6 ryo #include "opt_net_mpsafe.h"
69 1.1 christos #endif
70 1.1 christos #include "ioconf.h"
71 1.1 christos #endif
72 1.1 christos
73 1.1 christos /*
74 1.1 christos * Module and device structures.
75 1.1 christos */
76 1.1 christos #ifndef _MODULE
77 1.1 christos /*
78 1.1 christos * Modular kernels load drivers too early, and we need percpu to be inited
79 1.1 christos * So we make this misc; a better way would be to have early boot and late
80 1.1 christos * boot drivers.
81 1.1 christos */
82 1.7 pgoyette MODULE(MODULE_CLASS_MISC, npf, "bpf");
83 1.1 christos #else
84 1.1 christos /* This module autoloads via /dev/npf so it needs to be a driver */
85 1.7 pgoyette MODULE(MODULE_CLASS_DRIVER, npf, "bpf");
86 1.1 christos #endif
87 1.1 christos
88 1.1 christos static int npf_dev_open(dev_t, int, int, lwp_t *);
89 1.1 christos static int npf_dev_close(dev_t, int, int, lwp_t *);
90 1.1 christos static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
91 1.1 christos static int npf_dev_poll(dev_t, int, lwp_t *);
92 1.1 christos static int npf_dev_read(dev_t, struct uio *, int);
93 1.1 christos
94 1.1 christos const struct cdevsw npf_cdevsw = {
95 1.1 christos .d_open = npf_dev_open,
96 1.1 christos .d_close = npf_dev_close,
97 1.1 christos .d_read = npf_dev_read,
98 1.1 christos .d_write = nowrite,
99 1.1 christos .d_ioctl = npf_dev_ioctl,
100 1.1 christos .d_stop = nostop,
101 1.1 christos .d_tty = notty,
102 1.1 christos .d_poll = npf_dev_poll,
103 1.1 christos .d_mmap = nommap,
104 1.1 christos .d_kqfilter = nokqfilter,
105 1.1 christos .d_discard = nodiscard,
106 1.1 christos .d_flag = D_OTHER | D_MPSAFE
107 1.1 christos };
108 1.1 christos
109 1.1 christos static const char * npf_ifop_getname(ifnet_t *);
110 1.1 christos static ifnet_t * npf_ifop_lookup(const char *);
111 1.1 christos static void npf_ifop_flush(void *);
112 1.1 christos static void * npf_ifop_getmeta(const ifnet_t *);
113 1.1 christos static void npf_ifop_setmeta(ifnet_t *, void *);
114 1.1 christos
115 1.1 christos static const unsigned nworkers = 1;
116 1.1 christos
117 1.1 christos static bool pfil_registered = false;
118 1.1 christos static pfil_head_t * npf_ph_if = NULL;
119 1.1 christos static pfil_head_t * npf_ph_inet = NULL;
120 1.1 christos static pfil_head_t * npf_ph_inet6 = NULL;
121 1.1 christos
122 1.1 christos static const npf_ifops_t kern_ifops = {
123 1.1 christos .getname = npf_ifop_getname,
124 1.1 christos .lookup = npf_ifop_lookup,
125 1.1 christos .flush = npf_ifop_flush,
126 1.1 christos .getmeta = npf_ifop_getmeta,
127 1.1 christos .setmeta = npf_ifop_setmeta,
128 1.1 christos };
129 1.1 christos
130 1.1 christos static int
131 1.1 christos npf_fini(void)
132 1.1 christos {
133 1.1 christos npf_t *npf = npf_getkernctx();
134 1.1 christos
135 1.1 christos /* At first, detach device and remove pfil hooks. */
136 1.1 christos #ifdef _MODULE
137 1.1 christos devsw_detach(NULL, &npf_cdevsw);
138 1.1 christos #endif
139 1.1 christos npf_pfil_unregister(true);
140 1.1 christos npf_destroy(npf);
141 1.1 christos npf_sysfini();
142 1.1 christos return 0;
143 1.1 christos }
144 1.1 christos
145 1.1 christos static int
146 1.1 christos npf_init(void)
147 1.1 christos {
148 1.1 christos npf_t *npf;
149 1.1 christos int error = 0;
150 1.1 christos
151 1.1 christos error = npf_sysinit(nworkers);
152 1.1 christos if (error)
153 1.1 christos return error;
154 1.1 christos npf = npf_create(0, NULL, &kern_ifops);
155 1.1 christos npf_setkernctx(npf);
156 1.1 christos npf_pfil_register(true);
157 1.1 christos
158 1.1 christos #ifdef _MODULE
159 1.1 christos devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
160 1.1 christos
161 1.1 christos /* Attach /dev/npf device. */
162 1.1 christos error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
163 1.1 christos if (error) {
164 1.1 christos /* It will call devsw_detach(), which is safe. */
165 1.1 christos (void)npf_fini();
166 1.1 christos }
167 1.1 christos #endif
168 1.1 christos return error;
169 1.1 christos }
170 1.1 christos
171 1.1 christos
172 1.1 christos /*
173 1.1 christos * Module interface.
174 1.1 christos */
175 1.1 christos static int
176 1.1 christos npf_modcmd(modcmd_t cmd, void *arg)
177 1.1 christos {
178 1.1 christos switch (cmd) {
179 1.1 christos case MODULE_CMD_INIT:
180 1.1 christos return npf_init();
181 1.1 christos case MODULE_CMD_FINI:
182 1.1 christos return npf_fini();
183 1.1 christos case MODULE_CMD_AUTOUNLOAD:
184 1.1 christos if (npf_autounload_p()) {
185 1.1 christos return EBUSY;
186 1.1 christos }
187 1.1 christos break;
188 1.1 christos default:
189 1.1 christos return ENOTTY;
190 1.1 christos }
191 1.1 christos return 0;
192 1.1 christos }
193 1.1 christos
194 1.1 christos void
195 1.1 christos npfattach(int nunits)
196 1.1 christos {
197 1.1 christos /* Nothing */
198 1.1 christos }
199 1.1 christos
200 1.1 christos static int
201 1.1 christos npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
202 1.1 christos {
203 1.1 christos /* Available only for super-user. */
204 1.1 christos if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
205 1.1 christos KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
206 1.1 christos return EPERM;
207 1.1 christos }
208 1.1 christos return 0;
209 1.1 christos }
210 1.1 christos
211 1.1 christos static int
212 1.1 christos npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
213 1.1 christos {
214 1.1 christos return 0;
215 1.1 christos }
216 1.1 christos
217 1.1 christos static int
218 1.1 christos npf_stats_export(npf_t *npf, void *data)
219 1.1 christos {
220 1.1 christos uint64_t *fullst, *uptr = *(uint64_t **)data;
221 1.1 christos int error;
222 1.1 christos
223 1.1 christos fullst = kmem_alloc(NPF_STATS_SIZE, KM_SLEEP);
224 1.1 christos npf_stats(npf, fullst); /* will zero the buffer */
225 1.1 christos error = copyout(fullst, uptr, NPF_STATS_SIZE);
226 1.1 christos kmem_free(fullst, NPF_STATS_SIZE);
227 1.1 christos return error;
228 1.1 christos }
229 1.1 christos
230 1.1 christos static int
231 1.1 christos npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
232 1.1 christos {
233 1.1 christos npf_t *npf = npf_getkernctx();
234 1.1 christos int error;
235 1.1 christos
236 1.1 christos /* Available only for super-user. */
237 1.1 christos if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
238 1.1 christos KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
239 1.1 christos return EPERM;
240 1.1 christos }
241 1.1 christos
242 1.1 christos switch (cmd) {
243 1.1 christos case IOC_NPF_TABLE:
244 1.1 christos error = npfctl_table(npf, data);
245 1.1 christos break;
246 1.1 christos case IOC_NPF_RULE:
247 1.1 christos error = npfctl_rule(npf, cmd, data);
248 1.1 christos break;
249 1.1 christos case IOC_NPF_STATS:
250 1.1 christos error = npf_stats_export(npf, data);
251 1.1 christos break;
252 1.1 christos case IOC_NPF_SAVE:
253 1.1 christos error = npfctl_save(npf, cmd, data);
254 1.1 christos break;
255 1.1 christos case IOC_NPF_SWITCH:
256 1.1 christos error = npfctl_switch(data);
257 1.1 christos break;
258 1.1 christos case IOC_NPF_LOAD:
259 1.1 christos error = npfctl_load(npf, cmd, data);
260 1.1 christos break;
261 1.1 christos case IOC_NPF_CONN_LOOKUP:
262 1.1 christos error = npfctl_conn_lookup(npf, cmd, data);
263 1.1 christos break;
264 1.1 christos case IOC_NPF_VERSION:
265 1.1 christos *(int *)data = NPF_VERSION;
266 1.1 christos error = 0;
267 1.1 christos break;
268 1.1 christos default:
269 1.1 christos error = ENOTTY;
270 1.1 christos break;
271 1.1 christos }
272 1.1 christos return error;
273 1.1 christos }
274 1.1 christos
275 1.1 christos static int
276 1.1 christos npf_dev_poll(dev_t dev, int events, lwp_t *l)
277 1.1 christos {
278 1.1 christos return ENOTSUP;
279 1.1 christos }
280 1.1 christos
281 1.1 christos static int
282 1.1 christos npf_dev_read(dev_t dev, struct uio *uio, int flag)
283 1.1 christos {
284 1.1 christos return ENOTSUP;
285 1.1 christos }
286 1.1 christos
287 1.1 christos bool
288 1.1 christos npf_autounload_p(void)
289 1.1 christos {
290 1.1 christos npf_t *npf = npf_getkernctx();
291 1.1 christos return !npf_pfil_registered_p() && npf_default_pass(npf);
292 1.1 christos }
293 1.1 christos
294 1.1 christos /*
295 1.1 christos * Interface operations.
296 1.1 christos */
297 1.1 christos
298 1.1 christos static const char *
299 1.1 christos npf_ifop_getname(ifnet_t *ifp)
300 1.1 christos {
301 1.1 christos return ifp->if_xname;
302 1.1 christos }
303 1.1 christos
304 1.1 christos static ifnet_t *
305 1.1 christos npf_ifop_lookup(const char *name)
306 1.1 christos {
307 1.1 christos return ifunit(name);
308 1.1 christos }
309 1.1 christos
310 1.1 christos static void
311 1.1 christos npf_ifop_flush(void *arg)
312 1.1 christos {
313 1.1 christos ifnet_t *ifp;
314 1.1 christos
315 1.1 christos KERNEL_LOCK(1, NULL);
316 1.1 christos IFNET_LOCK();
317 1.1 christos IFNET_WRITER_FOREACH(ifp) {
318 1.1 christos ifp->if_pf_kif = arg;
319 1.1 christos }
320 1.1 christos IFNET_UNLOCK();
321 1.1 christos KERNEL_UNLOCK_ONE(NULL);
322 1.1 christos }
323 1.1 christos
324 1.1 christos static void *
325 1.1 christos npf_ifop_getmeta(const ifnet_t *ifp)
326 1.1 christos {
327 1.1 christos return ifp->if_pf_kif;
328 1.1 christos }
329 1.1 christos
330 1.1 christos static void
331 1.1 christos npf_ifop_setmeta(ifnet_t *ifp, void *arg)
332 1.1 christos {
333 1.1 christos ifp->if_pf_kif = arg;
334 1.1 christos }
335 1.1 christos
336 1.1 christos #ifdef _KERNEL
337 1.1 christos
338 1.1 christos /*
339 1.1 christos * Wrapper of the main packet handler to pass the kernel NPF context.
340 1.1 christos */
341 1.1 christos static int
342 1.1 christos npfkern_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
343 1.1 christos {
344 1.1 christos npf_t *npf = npf_getkernctx();
345 1.1 christos return npf_packet_handler(npf, mp, ifp, di);
346 1.1 christos }
347 1.1 christos
348 1.1 christos /*
349 1.1 christos * npf_ifhook: hook handling interface changes.
350 1.1 christos */
351 1.2 rmind static void
352 1.2 rmind npf_ifhook(void *arg, unsigned long cmd, void *arg2)
353 1.1 christos {
354 1.1 christos npf_t *npf = npf_getkernctx();
355 1.2 rmind ifnet_t *ifp = arg2;
356 1.1 christos
357 1.2 rmind switch (cmd) {
358 1.2 rmind case PFIL_IFNET_ATTACH:
359 1.2 rmind npf_ifmap_attach(npf, ifp);
360 1.3 rmind npf_ifaddr_sync(npf, ifp);
361 1.2 rmind break;
362 1.2 rmind case PFIL_IFNET_DETACH:
363 1.2 rmind npf_ifmap_detach(npf, ifp);
364 1.3 rmind npf_ifaddr_flush(npf, ifp);
365 1.2 rmind break;
366 1.1 christos }
367 1.1 christos }
368 1.1 christos
369 1.3 rmind static void
370 1.3 rmind npf_ifaddrhook(void *arg, u_long cmd, void *arg2)
371 1.3 rmind {
372 1.3 rmind npf_t *npf = npf_getkernctx();
373 1.3 rmind struct ifaddr *ifa = arg2;
374 1.3 rmind
375 1.3 rmind switch (cmd) {
376 1.3 rmind case SIOCSIFADDR:
377 1.3 rmind case SIOCAIFADDR:
378 1.3 rmind case SIOCDIFADDR:
379 1.3 rmind #ifdef INET6
380 1.3 rmind case SIOCSIFADDR_IN6:
381 1.3 rmind case SIOCAIFADDR_IN6:
382 1.3 rmind case SIOCDIFADDR_IN6:
383 1.3 rmind #endif
384 1.3 rmind break;
385 1.3 rmind default:
386 1.3 rmind return;
387 1.3 rmind }
388 1.3 rmind npf_ifaddr_sync(npf, ifa->ifa_ifp);
389 1.3 rmind }
390 1.3 rmind
391 1.1 christos /*
392 1.1 christos * npf_pfil_register: register pfil(9) hooks.
393 1.1 christos */
394 1.1 christos int
395 1.1 christos npf_pfil_register(bool init)
396 1.1 christos {
397 1.1 christos npf_t *npf = npf_getkernctx();
398 1.1 christos int error = 0;
399 1.1 christos
400 1.6 ryo #ifndef NET_MPSAFE
401 1.1 christos mutex_enter(softnet_lock);
402 1.1 christos KERNEL_LOCK(1, NULL);
403 1.6 ryo #endif
404 1.1 christos
405 1.1 christos /* Init: interface re-config and attach/detach hook. */
406 1.1 christos if (!npf_ph_if) {
407 1.1 christos npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
408 1.1 christos if (!npf_ph_if) {
409 1.1 christos error = ENOENT;
410 1.1 christos goto out;
411 1.1 christos }
412 1.3 rmind
413 1.3 rmind error = pfil_add_ihook(npf_ifhook, NULL,
414 1.3 rmind PFIL_IFNET, npf_ph_if);
415 1.3 rmind KASSERT(error == 0);
416 1.3 rmind
417 1.3 rmind error = pfil_add_ihook(npf_ifaddrhook, NULL,
418 1.3 rmind PFIL_IFADDR, npf_ph_if);
419 1.1 christos KASSERT(error == 0);
420 1.1 christos }
421 1.1 christos if (init) {
422 1.1 christos goto out;
423 1.1 christos }
424 1.1 christos
425 1.1 christos /* Check if pfil hooks are not already registered. */
426 1.1 christos if (pfil_registered) {
427 1.1 christos error = EEXIST;
428 1.1 christos goto out;
429 1.1 christos }
430 1.1 christos
431 1.1 christos /* Capture points of the activity in the IP layer. */
432 1.1 christos npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
433 1.1 christos npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
434 1.1 christos if (!npf_ph_inet && !npf_ph_inet6) {
435 1.1 christos error = ENOENT;
436 1.1 christos goto out;
437 1.1 christos }
438 1.1 christos
439 1.1 christos /* Packet IN/OUT handlers for IP layer. */
440 1.1 christos if (npf_ph_inet) {
441 1.1 christos error = pfil_add_hook(npfkern_packet_handler, npf,
442 1.1 christos PFIL_ALL, npf_ph_inet);
443 1.1 christos KASSERT(error == 0);
444 1.1 christos }
445 1.1 christos if (npf_ph_inet6) {
446 1.1 christos error = pfil_add_hook(npfkern_packet_handler, npf,
447 1.1 christos PFIL_ALL, npf_ph_inet6);
448 1.1 christos KASSERT(error == 0);
449 1.1 christos }
450 1.5 rmind
451 1.5 rmind /*
452 1.5 rmind * It is necessary to re-sync all/any interface address tables,
453 1.5 rmind * since we did not listen for any changes.
454 1.5 rmind */
455 1.5 rmind npf_ifaddr_syncall(npf);
456 1.1 christos pfil_registered = true;
457 1.1 christos out:
458 1.6 ryo #ifndef NET_MPSAFE
459 1.1 christos KERNEL_UNLOCK_ONE(NULL);
460 1.1 christos mutex_exit(softnet_lock);
461 1.6 ryo #endif
462 1.1 christos
463 1.1 christos return error;
464 1.1 christos }
465 1.1 christos
466 1.1 christos /*
467 1.1 christos * npf_pfil_unregister: unregister pfil(9) hooks.
468 1.1 christos */
469 1.1 christos void
470 1.1 christos npf_pfil_unregister(bool fini)
471 1.1 christos {
472 1.1 christos npf_t *npf = npf_getkernctx();
473 1.1 christos
474 1.6 ryo #ifndef NET_MPSAFE
475 1.1 christos mutex_enter(softnet_lock);
476 1.1 christos KERNEL_LOCK(1, NULL);
477 1.6 ryo #endif
478 1.1 christos
479 1.1 christos if (fini && npf_ph_if) {
480 1.3 rmind (void)pfil_remove_ihook(npf_ifhook, NULL,
481 1.3 rmind PFIL_IFNET, npf_ph_if);
482 1.3 rmind (void)pfil_remove_ihook(npf_ifaddrhook, NULL,
483 1.3 rmind PFIL_IFADDR, npf_ph_if);
484 1.1 christos }
485 1.1 christos if (npf_ph_inet) {
486 1.1 christos (void)pfil_remove_hook(npfkern_packet_handler, npf,
487 1.1 christos PFIL_ALL, npf_ph_inet);
488 1.1 christos }
489 1.1 christos if (npf_ph_inet6) {
490 1.1 christos (void)pfil_remove_hook(npfkern_packet_handler, npf,
491 1.1 christos PFIL_ALL, npf_ph_inet6);
492 1.1 christos }
493 1.1 christos pfil_registered = false;
494 1.1 christos
495 1.6 ryo #ifndef NET_MPSAFE
496 1.1 christos KERNEL_UNLOCK_ONE(NULL);
497 1.1 christos mutex_exit(softnet_lock);
498 1.6 ryo #endif
499 1.1 christos }
500 1.1 christos
501 1.1 christos bool
502 1.1 christos npf_pfil_registered_p(void)
503 1.1 christos {
504 1.1 christos return pfil_registered;
505 1.1 christos }
506 1.1 christos #endif
507