Home | History | Annotate | Line # | Download | only in npf
npf_os.c revision 1.22 
      1 /*-
      2  * Copyright (c) 2009-2016 The NetBSD Foundation, Inc.
      3  * All rights reserved.
      4  *
      5  * This material is based upon work partially supported by The
      6  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  *
     17  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     19  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     20  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     21  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     22  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     25  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     27  * POSSIBILITY OF SUCH DAMAGE.
     28  */
     29 
     30 /*
     31  * NPF main: dynamic load/initialisation and unload routines.
     32  */
     33 
     34 #ifdef _KERNEL
     35 #include <sys/cdefs.h>
     36 __KERNEL_RCSID(0, "$NetBSD: npf_os.c,v 1.22 2025/03/20 09:49:01 pgoyette Exp $");
     37 
     38 #ifdef _KERNEL_OPT
     39 #include "pf.h"
     40 #if NPF > 0
     41 #error "NPF and PF are mutually exclusive; please select one"
     42 #endif
     43 #endif
     44 
     45 #include <sys/param.h>
     46 #include <sys/types.h>
     47 
     48 #include <sys/conf.h>
     49 #include <sys/kauth.h>
     50 #include <sys/kmem.h>
     51 #include <sys/lwp.h>
     52 #include <sys/module.h>
     53 #include <sys/pserialize.h>
     54 #include <sys/socketvar.h>
     55 #include <sys/uio.h>
     56 
     57 #include <netinet/in.h>
     58 #include <netinet6/in6_var.h>
     59 #endif
     60 
     61 #include "npf_impl.h"
     62 #include "npfkern.h"
     63 
     64 #ifdef _KERNEL
     65 #ifndef _MODULE
     66 #include "opt_modular.h"
     67 #include "opt_net_mpsafe.h"
     68 #endif
     69 #include "ioconf.h"
     70 #endif
     71 
     72 /*
     73  * Module and device structures.
     74  */
     75 #ifndef _MODULE
     76 /*
     77  * Modular kernels load drivers too early, and we need percpu to be inited
     78  * So we make this misc; a better way would be to have early boot and late
     79  * boot drivers.
     80  */
     81 MODULE(MODULE_CLASS_MISC, npf, "bpf");
     82 #else
     83 /* This module autoloads via /dev/npf so it needs to be a driver */
     84 MODULE(MODULE_CLASS_DRIVER, npf, "bpf");
     85 #endif
     86 
     87 #define	NPF_IOCTL_DATA_LIMIT	(4 * 1024 * 1024)
     88 
     89 static int	npf_pfil_register(bool);
     90 static void	npf_pfil_unregister(bool);
     91 
     92 static int	npf_dev_open(dev_t, int, int, lwp_t *);
     93 static int	npf_dev_close(dev_t, int, int, lwp_t *);
     94 static int	npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
     95 static int	npf_dev_poll(dev_t, int, lwp_t *);
     96 static int	npf_dev_read(dev_t, struct uio *, int);
     97 
     98 const struct cdevsw npf_cdevsw = {
     99 	.d_open = npf_dev_open,
    100 	.d_close = npf_dev_close,
    101 	.d_read = npf_dev_read,
    102 	.d_write = nowrite,
    103 	.d_ioctl = npf_dev_ioctl,
    104 	.d_stop = nostop,
    105 	.d_tty = notty,
    106 	.d_poll = npf_dev_poll,
    107 	.d_mmap = nommap,
    108 	.d_kqfilter = nokqfilter,
    109 	.d_discard = nodiscard,
    110 	.d_flag = D_OTHER | D_MPSAFE
    111 };
    112 
    113 static const char *	npf_ifop_getname(npf_t *, ifnet_t *);
    114 static ifnet_t *	npf_ifop_lookup(npf_t *, const char *);
    115 static void		npf_ifop_flush(npf_t *, void *);
    116 static void *		npf_ifop_getmeta(npf_t *, const ifnet_t *);
    117 static void		npf_ifop_setmeta(npf_t *, ifnet_t *, void *);
    118 
    119 static const unsigned	nworkers = 1;
    120 
    121 static bool		pfil_registered = false;
    122 static pfil_head_t *	npf_ph_if = NULL;
    123 static pfil_head_t *	npf_ph_inet = NULL;
    124 static pfil_head_t *	npf_ph_inet6 = NULL;
    125 
    126 static const npf_ifops_t kern_ifops = {
    127 	.getname	= npf_ifop_getname,
    128 	.lookup		= npf_ifop_lookup,
    129 	.flush		= npf_ifop_flush,
    130 	.getmeta	= npf_ifop_getmeta,
    131 	.setmeta	= npf_ifop_setmeta,
    132 };
    133 
    134 static int
    135 npf_fini(void)
    136 {
    137 	npf_t *npf = npf_getkernctx();
    138 
    139 	/* At first, detach device and remove pfil hooks. */
    140 #ifdef _MODULE
    141 	devsw_detach(NULL, &npf_cdevsw);
    142 #endif
    143 	npf_pfil_unregister(true);
    144 	npfk_destroy(npf);
    145 	npfk_sysfini();
    146 	return 0;
    147 }
    148 
    149 static int
    150 npf_init(void)
    151 {
    152 	npf_t *npf;
    153 	int error = 0;
    154 
    155 	error = npfk_sysinit(nworkers);
    156 	if (error)
    157 		return error;
    158 	npf = npfk_create(0, NULL, &kern_ifops, NULL);
    159 	npf_setkernctx(npf);
    160 	npf_pfil_register(true);
    161 
    162 #ifdef _MODULE
    163 	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
    164 
    165 	/* Attach /dev/npf device. */
    166 	error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
    167 	if (error) {
    168 		/* It will call devsw_detach(), which is safe. */
    169 		(void)npf_fini();
    170 	}
    171 #endif
    172 	return error;
    173 }
    174 
    175 
    176 /*
    177  * Module interface.
    178  */
    179 static int
    180 npf_modcmd(modcmd_t cmd, void *arg)
    181 {
    182 	switch (cmd) {
    183 	case MODULE_CMD_INIT:
    184 		return npf_init();
    185 	case MODULE_CMD_FINI:
    186 		return npf_fini();
    187 	case MODULE_CMD_AUTOUNLOAD:
    188 /*
    189  * XXX npf_autounload_p() is insufficient here.  At least one other
    190  * XXX path leads to unloading while something tries later on to
    191  * XXX continue (perhaps closing of an open fd).  For now, just
    192  * XXX disabble autounload.
    193  */
    194 		return EBUSY;
    195 	default:
    196 		return ENOTTY;
    197 	}
    198 	return 0;
    199 }
    200 
    201 void
    202 npfattach(int nunits)
    203 {
    204 	/* Nothing */
    205 }
    206 
    207 static int
    208 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
    209 {
    210 	/* Available only for super-user. */
    211 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    212 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    213 		return EPERM;
    214 	}
    215 	return 0;
    216 }
    217 
    218 static int
    219 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
    220 {
    221 	return 0;
    222 }
    223 
    224 static int
    225 npf_stats_export(npf_t *npf, void *data)
    226 {
    227 	uint64_t *fullst, *uptr = *(uint64_t **)data;
    228 	int error;
    229 
    230 	fullst = kmem_alloc(NPF_STATS_SIZE, KM_SLEEP);
    231 	npfk_stats(npf, fullst); /* will zero the buffer */
    232 	error = copyout(fullst, uptr, NPF_STATS_SIZE);
    233 	kmem_free(fullst, NPF_STATS_SIZE);
    234 	return error;
    235 }
    236 
    237 /*
    238  * npfctl_switch: enable or disable packet inspection.
    239  */
    240 static int
    241 npfctl_switch(void *data)
    242 {
    243 	const bool onoff = *(int *)data ? true : false;
    244 	int error;
    245 
    246 	if (onoff) {
    247 		/* Enable: add pfil hooks. */
    248 		error = npf_pfil_register(false);
    249 	} else {
    250 		/* Disable: remove pfil hooks. */
    251 		npf_pfil_unregister(false);
    252 		error = 0;
    253 	}
    254 	return error;
    255 }
    256 
    257 static int
    258 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
    259 {
    260 	npf_t *npf = npf_getkernctx();
    261 	nvlist_t *req, *resp;
    262 	int error;
    263 
    264 	/* Available only for super-user. */
    265 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    266 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    267 		return EPERM;
    268 	}
    269 
    270 	switch (cmd) {
    271 	case IOC_NPF_VERSION:
    272 		*(int *)data = NPF_VERSION;
    273 		return 0;
    274 	case IOC_NPF_SWITCH:
    275 		return npfctl_switch(data);
    276 	case IOC_NPF_TABLE:
    277 		return npfctl_table(npf, data);
    278 	case IOC_NPF_STATS:
    279 		return npf_stats_export(npf, data);
    280 	case IOC_NPF_LOAD:
    281 	case IOC_NPF_SAVE:
    282 	case IOC_NPF_RULE:
    283 	case IOC_NPF_CONN_LOOKUP:
    284 	case IOC_NPF_TABLE_REPLACE:
    285 		/* nvlist_ref_t argument, handled below */
    286 		break;
    287 	default:
    288 		return EINVAL;
    289 	}
    290 
    291 	error = nvlist_copyin(data, &req, NPF_IOCTL_DATA_LIMIT);
    292 	if (__predict_false(error)) {
    293 #ifdef __NetBSD__
    294 		/* Until the version bump. */
    295 		if (cmd != IOC_NPF_SAVE) {
    296 			return error;
    297 		}
    298 		req = nvlist_create(0);
    299 #else
    300 		return error;
    301 #endif
    302 	}
    303 	resp = nvlist_create(0);
    304 
    305 	if ((error = npfctl_run_op(npf, cmd, req, resp)) == 0) {
    306 		error = nvlist_copyout(data, resp);
    307 	}
    308 
    309 	nvlist_destroy(resp);
    310 	nvlist_destroy(req);
    311 
    312 	return error;
    313 }
    314 
    315 static int
    316 npf_dev_poll(dev_t dev, int events, lwp_t *l)
    317 {
    318 	return ENOTSUP;
    319 }
    320 
    321 static int
    322 npf_dev_read(dev_t dev, struct uio *uio, int flag)
    323 {
    324 	return ENOTSUP;
    325 }
    326 
    327 bool
    328 npf_autounload_p(void)
    329 {
    330 	if (npf_active_p())
    331 		return false;
    332 
    333 	npf_t *npf = npf_getkernctx();
    334 
    335 	npf_config_enter(npf);
    336 	bool pass = npf_default_pass(npf);
    337 	npf_config_exit(npf);
    338 
    339 	return pass;
    340 }
    341 
    342 /*
    343  * Interface operations.
    344  */
    345 
    346 static const char *
    347 npf_ifop_getname(npf_t *npf __unused, ifnet_t *ifp)
    348 {
    349 	return ifp->if_xname;
    350 }
    351 
    352 static ifnet_t *
    353 npf_ifop_lookup(npf_t *npf __unused, const char *name)
    354 {
    355 	return ifunit(name);
    356 }
    357 
    358 static void
    359 npf_ifop_flush(npf_t *npf __unused, void *arg)
    360 {
    361 	ifnet_t *ifp;
    362 
    363 	KERNEL_LOCK(1, NULL);
    364 	IFNET_GLOBAL_LOCK();
    365 	IFNET_WRITER_FOREACH(ifp) {
    366 		ifp->if_npf_private = arg;
    367 	}
    368 	IFNET_GLOBAL_UNLOCK();
    369 	KERNEL_UNLOCK_ONE(NULL);
    370 }
    371 
    372 static void *
    373 npf_ifop_getmeta(npf_t *npf __unused, const ifnet_t *ifp)
    374 {
    375 	return ifp->if_npf_private;
    376 }
    377 
    378 static void
    379 npf_ifop_setmeta(npf_t *npf __unused, ifnet_t *ifp, void *arg)
    380 {
    381 	ifp->if_npf_private = arg;
    382 }
    383 
    384 #ifdef _KERNEL
    385 
    386 /*
    387  * Wrapper of the main packet handler to pass the kernel NPF context.
    388  */
    389 static int
    390 npfos_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
    391 {
    392 	npf_t *npf = npf_getkernctx();
    393 	return npfk_packet_handler(npf, mp, ifp, di);
    394 }
    395 
    396 /*
    397  * npf_ifhook: hook handling interface changes.
    398  */
    399 static void
    400 npf_ifhook(void *arg, unsigned long cmd, void *arg2)
    401 {
    402 	npf_t *npf = npf_getkernctx();
    403 	ifnet_t *ifp = arg2;
    404 
    405 	switch (cmd) {
    406 	case PFIL_IFNET_ATTACH:
    407 		npfk_ifmap_attach(npf, ifp);
    408 		npf_ifaddr_sync(npf, ifp);
    409 		break;
    410 	case PFIL_IFNET_DETACH:
    411 		npfk_ifmap_detach(npf, ifp);
    412 		npf_ifaddr_flush(npf, ifp);
    413 		break;
    414 	}
    415 }
    416 
    417 static void
    418 npf_ifaddrhook(void *arg, u_long cmd, void *arg2)
    419 {
    420 	npf_t *npf = npf_getkernctx();
    421 	struct ifaddr *ifa = arg2;
    422 
    423 	switch (cmd) {
    424 	case SIOCSIFADDR:
    425 	case SIOCAIFADDR:
    426 	case SIOCDIFADDR:
    427 #ifdef INET6
    428 	case SIOCSIFADDR_IN6:
    429 	case SIOCAIFADDR_IN6:
    430 	case SIOCDIFADDR_IN6:
    431 #endif
    432 		KASSERT(ifa != NULL);
    433 		break;
    434 	default:
    435 		return;
    436 	}
    437 	npf_ifaddr_sync(npf, ifa->ifa_ifp);
    438 }
    439 
    440 /*
    441  * npf_pfil_register: register pfil(9) hooks.
    442  */
    443 static int
    444 npf_pfil_register(bool init)
    445 {
    446 	npf_t *npf = npf_getkernctx();
    447 	int error = 0;
    448 
    449 	SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
    450 
    451 	/* Init: interface re-config and attach/detach hook. */
    452 	if (!npf_ph_if) {
    453 		npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
    454 		if (!npf_ph_if) {
    455 			error = ENOENT;
    456 			goto out;
    457 		}
    458 
    459 		error = pfil_add_ihook(npf_ifhook, NULL,
    460 		    PFIL_IFNET, npf_ph_if);
    461 		KASSERT(error == 0);
    462 
    463 		error = pfil_add_ihook(npf_ifaddrhook, NULL,
    464 		    PFIL_IFADDR, npf_ph_if);
    465 		KASSERT(error == 0);
    466 	}
    467 	if (init) {
    468 		goto out;
    469 	}
    470 
    471 	/* Check if pfil hooks are not already registered. */
    472 	if (pfil_registered) {
    473 		error = EEXIST;
    474 		goto out;
    475 	}
    476 
    477 	/* Capture points of the activity in the IP layer. */
    478 	npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
    479 	npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
    480 	if (!npf_ph_inet && !npf_ph_inet6) {
    481 		error = ENOENT;
    482 		goto out;
    483 	}
    484 
    485 	/* Packet IN/OUT handlers for IP layer. */
    486 	if (npf_ph_inet) {
    487 		error = pfil_add_hook(npfos_packet_handler, npf,
    488 		    PFIL_ALL, npf_ph_inet);
    489 		KASSERT(error == 0);
    490 	}
    491 	if (npf_ph_inet6) {
    492 		error = pfil_add_hook(npfos_packet_handler, npf,
    493 		    PFIL_ALL, npf_ph_inet6);
    494 		KASSERT(error == 0);
    495 	}
    496 
    497 	/*
    498 	 * It is necessary to re-sync all/any interface address tables,
    499 	 * since we did not listen for any changes.
    500 	 */
    501 	npf_ifaddr_syncall(npf);
    502 	pfil_registered = true;
    503 out:
    504 	SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
    505 
    506 	return error;
    507 }
    508 
    509 /*
    510  * npf_pfil_unregister: unregister pfil(9) hooks.
    511  */
    512 static void
    513 npf_pfil_unregister(bool fini)
    514 {
    515 	npf_t *npf = npf_getkernctx();
    516 
    517 	SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
    518 
    519 	if (fini && npf_ph_if) {
    520 		(void)pfil_remove_ihook(npf_ifhook, NULL,
    521 		    PFIL_IFNET, npf_ph_if);
    522 		(void)pfil_remove_ihook(npf_ifaddrhook, NULL,
    523 		    PFIL_IFADDR, npf_ph_if);
    524 	}
    525 	if (npf_ph_inet) {
    526 		(void)pfil_remove_hook(npfos_packet_handler, npf,
    527 		    PFIL_ALL, npf_ph_inet);
    528 	}
    529 	if (npf_ph_inet6) {
    530 		(void)pfil_remove_hook(npfos_packet_handler, npf,
    531 		    PFIL_ALL, npf_ph_inet6);
    532 	}
    533 	pfil_registered = false;
    534 
    535 	SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
    536 }
    537 
    538 bool
    539 npf_active_p(void)
    540 {
    541 	return pfil_registered;
    542 }
    543 
    544 #endif
    545 
    546 #ifdef __NetBSD__
    547 
    548 /*
    549  * Epoch-Based Reclamation (EBR) wrappers: in NetBSD, we rely on the
    550  * passive serialization mechanism (see pserialize(9) manual page),
    551  * which provides sufficient guarantees for NPF.
    552  */
    553 
    554 ebr_t *
    555 npf_ebr_create(void)
    556 {
    557 	return pserialize_create();
    558 }
    559 
    560 void
    561 npf_ebr_destroy(ebr_t *ebr)
    562 {
    563 	pserialize_destroy(ebr);
    564 }
    565 
    566 void
    567 npf_ebr_register(ebr_t *ebr)
    568 {
    569 	KASSERT(ebr != NULL); (void)ebr;
    570 }
    571 
    572 void
    573 npf_ebr_unregister(ebr_t *ebr)
    574 {
    575 	KASSERT(ebr != NULL); (void)ebr;
    576 }
    577 
    578 int
    579 npf_ebr_enter(ebr_t *ebr)
    580 {
    581 	KASSERT(ebr != NULL); (void)ebr;
    582 	return pserialize_read_enter();
    583 }
    584 
    585 void
    586 npf_ebr_exit(ebr_t *ebr, int s)
    587 {
    588 	KASSERT(ebr != NULL); (void)ebr;
    589 	pserialize_read_exit(s);
    590 }
    591 
    592 void
    593 npf_ebr_full_sync(ebr_t *ebr)
    594 {
    595 	pserialize_perform(ebr);
    596 }
    597 
    598 bool
    599 npf_ebr_incrit_p(ebr_t *ebr)
    600 {
    601 	KASSERT(ebr != NULL); (void)ebr;
    602 	return pserialize_in_read_section();
    603 }
    604 
    605 #endif
    606