Home | History | Annotate | Line # | Download | only in npf
npf_os.c revision 1.6.6.1 
      1 /*	$NetBSD: npf_os.c,v 1.6.6.1 2017/04/28 02:13:19 pgoyette Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2009-2016 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * NPF main: dynamic load/initialisation and unload routines.
     34  */
     35 
     36 #ifdef _KERNEL
     37 #include <sys/cdefs.h>
     38 __KERNEL_RCSID(0, "$NetBSD: npf_os.c,v 1.6.6.1 2017/04/28 02:13:19 pgoyette Exp $");
     39 
     40 #ifdef _KERNEL_OPT
     41 #include "pf.h"
     42 #if NPF > 0
     43 #error "NPF and PF are mutually exclusive; please select one"
     44 #endif
     45 #endif
     46 
     47 #include <sys/param.h>
     48 #include <sys/types.h>
     49 
     50 #include <sys/conf.h>
     51 #include <sys/kauth.h>
     52 #include <sys/kmem.h>
     53 #include <sys/localcount.h>
     54 #include <sys/lwp.h>
     55 #include <sys/module.h>
     56 #include <sys/socketvar.h>
     57 #include <sys/uio.h>
     58 
     59 #include <netinet/in.h>
     60 #include <netinet6/in6_var.h>
     61 #endif
     62 
     63 #include "npf_impl.h"
     64 #include "npfkern.h"
     65 
     66 #ifdef _KERNEL
     67 #ifndef _MODULE
     68 #include "opt_modular.h"
     69 #include "opt_net_mpsafe.h"
     70 #endif
     71 #include "ioconf.h"
     72 #endif
     73 
     74 /*
     75  * Module and device structures.
     76  */
     77 #ifndef _MODULE
     78 /*
     79  * Modular kernels load drivers too early, and we need percpu to be inited
     80  * So we make this misc; a better way would be to have early boot and late
     81  * boot drivers.
     82  */
     83 MODULE(MODULE_CLASS_MISC, npf, NULL);
     84 #else
     85 /* This module autoloads via /dev/npf so it needs to be a driver */
     86 MODULE(MODULE_CLASS_DRIVER, npf, NULL);
     87 #endif
     88 
     89 static int	npf_dev_open(dev_t, int, int, lwp_t *);
     90 static int	npf_dev_close(dev_t, int, int, lwp_t *);
     91 static int	npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
     92 static int	npf_dev_poll(dev_t, int, lwp_t *);
     93 static int	npf_dev_read(dev_t, struct uio *, int);
     94 
     95 const struct cdevsw npf_cdevsw = {
     96 	DEVSW_MODULE_INIT
     97 	.d_open = npf_dev_open,
     98 	.d_close = npf_dev_close,
     99 	.d_read = npf_dev_read,
    100 	.d_write = nowrite,
    101 	.d_ioctl = npf_dev_ioctl,
    102 	.d_stop = nostop,
    103 	.d_tty = notty,
    104 	.d_poll = npf_dev_poll,
    105 	.d_mmap = nommap,
    106 	.d_kqfilter = nokqfilter,
    107 	.d_discard = nodiscard,
    108 	.d_flag = D_OTHER | D_MPSAFE
    109 };
    110 
    111 static const char *	npf_ifop_getname(ifnet_t *);
    112 static ifnet_t *	npf_ifop_lookup(const char *);
    113 static void		npf_ifop_flush(void *);
    114 static void *		npf_ifop_getmeta(const ifnet_t *);
    115 static void		npf_ifop_setmeta(ifnet_t *, void *);
    116 
    117 static const unsigned	nworkers = 1;
    118 
    119 static bool		pfil_registered = false;
    120 static pfil_head_t *	npf_ph_if = NULL;
    121 static pfil_head_t *	npf_ph_inet = NULL;
    122 static pfil_head_t *	npf_ph_inet6 = NULL;
    123 
    124 static const npf_ifops_t kern_ifops = {
    125 	.getname	= npf_ifop_getname,
    126 	.lookup		= npf_ifop_lookup,
    127 	.flush		= npf_ifop_flush,
    128 	.getmeta	= npf_ifop_getmeta,
    129 	.setmeta	= npf_ifop_setmeta,
    130 };
    131 
    132 static int
    133 npf_fini(void)
    134 {
    135 	npf_t *npf = npf_getkernctx();
    136 
    137 	/* At first, detach device and remove pfil hooks. */
    138 #ifdef _MODULE
    139 	devsw_detach(NULL, &npf_cdevsw);
    140 #endif
    141 	npf_pfil_unregister(true);
    142 	npf_destroy(npf);
    143 	npf_sysfini();
    144 	return 0;
    145 }
    146 
    147 static int
    148 npf_init(void)
    149 {
    150 	npf_t *npf;
    151 	int error = 0;
    152 
    153 	error = npf_sysinit(nworkers);
    154 	if (error)
    155 		return error;
    156 	npf = npf_create(0, NULL, &kern_ifops);
    157 	npf_setkernctx(npf);
    158 	npf_pfil_register(true);
    159 
    160 #ifdef _MODULE
    161 	devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
    162 
    163 	/* Attach /dev/npf device. */
    164 	error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
    165 	if (error) {
    166 		/* It will call devsw_detach(), which is safe. */
    167 		(void)npf_fini();
    168 	}
    169 #endif
    170 	return error;
    171 }
    172 
    173 
    174 /*
    175  * Module interface.
    176  */
    177 static int
    178 npf_modcmd(modcmd_t cmd, void *arg)
    179 {
    180 	switch (cmd) {
    181 	case MODULE_CMD_INIT:
    182 		return npf_init();
    183 	case MODULE_CMD_FINI:
    184 		return npf_fini();
    185 	case MODULE_CMD_AUTOUNLOAD:
    186 		if (npf_autounload_p()) {
    187 			return EBUSY;
    188 		}
    189 		break;
    190 	default:
    191 		return ENOTTY;
    192 	}
    193 	return 0;
    194 }
    195 
    196 void
    197 npfattach(int nunits)
    198 {
    199 	/* Nothing */
    200 }
    201 
    202 static int
    203 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
    204 {
    205 	/* Available only for super-user. */
    206 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    207 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    208 		return EPERM;
    209 	}
    210 	return 0;
    211 }
    212 
    213 static int
    214 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
    215 {
    216 	return 0;
    217 }
    218 
    219 static int
    220 npf_stats_export(npf_t *npf, void *data)
    221 {
    222 	uint64_t *fullst, *uptr = *(uint64_t **)data;
    223 	int error;
    224 
    225 	fullst = kmem_alloc(NPF_STATS_SIZE, KM_SLEEP);
    226 	npf_stats(npf, fullst); /* will zero the buffer */
    227 	error = copyout(fullst, uptr, NPF_STATS_SIZE);
    228 	kmem_free(fullst, NPF_STATS_SIZE);
    229 	return error;
    230 }
    231 
    232 static int
    233 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
    234 {
    235 	npf_t *npf = npf_getkernctx();
    236 	int error;
    237 
    238 	/* Available only for super-user. */
    239 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
    240 	    KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
    241 		return EPERM;
    242 	}
    243 
    244 	switch (cmd) {
    245 	case IOC_NPF_TABLE:
    246 		error = npfctl_table(npf, data);
    247 		break;
    248 	case IOC_NPF_RULE:
    249 		error = npfctl_rule(npf, cmd, data);
    250 		break;
    251 	case IOC_NPF_STATS:
    252 		error = npf_stats_export(npf, data);
    253 		break;
    254 	case IOC_NPF_SAVE:
    255 		error = npfctl_save(npf, cmd, data);
    256 		break;
    257 	case IOC_NPF_SWITCH:
    258 		error = npfctl_switch(data);
    259 		break;
    260 	case IOC_NPF_LOAD:
    261 		error = npfctl_load(npf, cmd, data);
    262 		break;
    263 	case IOC_NPF_CONN_LOOKUP:
    264 		error = npfctl_conn_lookup(npf, cmd, data);
    265 		break;
    266 	case IOC_NPF_VERSION:
    267 		*(int *)data = NPF_VERSION;
    268 		error = 0;
    269 		break;
    270 	default:
    271 		error = ENOTTY;
    272 		break;
    273 	}
    274 	return error;
    275 }
    276 
    277 static int
    278 npf_dev_poll(dev_t dev, int events, lwp_t *l)
    279 {
    280 	return ENOTSUP;
    281 }
    282 
    283 static int
    284 npf_dev_read(dev_t dev, struct uio *uio, int flag)
    285 {
    286 	return ENOTSUP;
    287 }
    288 
    289 bool
    290 npf_autounload_p(void)
    291 {
    292 	npf_t *npf = npf_getkernctx();
    293 	return !npf_pfil_registered_p() && npf_default_pass(npf);
    294 }
    295 
    296 /*
    297  * Interface operations.
    298  */
    299 
    300 static const char *
    301 npf_ifop_getname(ifnet_t *ifp)
    302 {
    303 	return ifp->if_xname;
    304 }
    305 
    306 static ifnet_t *
    307 npf_ifop_lookup(const char *name)
    308 {
    309 	return ifunit(name);
    310 }
    311 
    312 static void
    313 npf_ifop_flush(void *arg)
    314 {
    315 	ifnet_t *ifp;
    316 
    317 	KERNEL_LOCK(1, NULL);
    318 	IFNET_LOCK();
    319 	IFNET_WRITER_FOREACH(ifp) {
    320 		ifp->if_pf_kif = arg;
    321 	}
    322 	IFNET_UNLOCK();
    323 	KERNEL_UNLOCK_ONE(NULL);
    324 }
    325 
    326 static void *
    327 npf_ifop_getmeta(const ifnet_t *ifp)
    328 {
    329 	return ifp->if_pf_kif;
    330 }
    331 
    332 static void
    333 npf_ifop_setmeta(ifnet_t *ifp, void *arg)
    334 {
    335 	ifp->if_pf_kif = arg;
    336 }
    337 
    338 #ifdef _KERNEL
    339 
    340 /*
    341  * Wrapper of the main packet handler to pass the kernel NPF context.
    342  */
    343 static int
    344 npfkern_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
    345 {
    346 	npf_t *npf = npf_getkernctx();
    347 	return npf_packet_handler(npf, mp, ifp, di);
    348 }
    349 
    350 /*
    351  * npf_ifhook: hook handling interface changes.
    352  */
    353 static void
    354 npf_ifhook(void *arg, unsigned long cmd, void *arg2)
    355 {
    356 	npf_t *npf = npf_getkernctx();
    357 	ifnet_t *ifp = arg2;
    358 
    359 	switch (cmd) {
    360 	case PFIL_IFNET_ATTACH:
    361 		npf_ifmap_attach(npf, ifp);
    362 		npf_ifaddr_sync(npf, ifp);
    363 		break;
    364 	case PFIL_IFNET_DETACH:
    365 		npf_ifmap_detach(npf, ifp);
    366 		npf_ifaddr_flush(npf, ifp);
    367 		break;
    368 	}
    369 }
    370 
    371 static void
    372 npf_ifaddrhook(void *arg, u_long cmd, void *arg2)
    373 {
    374 	npf_t *npf = npf_getkernctx();
    375 	struct ifaddr *ifa = arg2;
    376 
    377 	switch (cmd) {
    378 	case SIOCSIFADDR:
    379 	case SIOCAIFADDR:
    380 	case SIOCDIFADDR:
    381 #ifdef INET6
    382 	case SIOCSIFADDR_IN6:
    383 	case SIOCAIFADDR_IN6:
    384 	case SIOCDIFADDR_IN6:
    385 #endif
    386 		break;
    387 	default:
    388 		return;
    389 	}
    390 	npf_ifaddr_sync(npf, ifa->ifa_ifp);
    391 }
    392 
    393 /*
    394  * npf_pfil_register: register pfil(9) hooks.
    395  */
    396 int
    397 npf_pfil_register(bool init)
    398 {
    399 	npf_t *npf = npf_getkernctx();
    400 	int error = 0;
    401 
    402 #ifndef NET_MPSAFE
    403 	mutex_enter(softnet_lock);
    404 	KERNEL_LOCK(1, NULL);
    405 #endif
    406 
    407 	/* Init: interface re-config and attach/detach hook. */
    408 	if (!npf_ph_if) {
    409 		npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
    410 		if (!npf_ph_if) {
    411 			error = ENOENT;
    412 			goto out;
    413 		}
    414 
    415 		error = pfil_add_ihook(npf_ifhook, NULL,
    416 		    PFIL_IFNET, npf_ph_if);
    417 		KASSERT(error == 0);
    418 
    419 		error = pfil_add_ihook(npf_ifaddrhook, NULL,
    420 		    PFIL_IFADDR, npf_ph_if);
    421 		KASSERT(error == 0);
    422 	}
    423 	if (init) {
    424 		goto out;
    425 	}
    426 
    427 	/* Check if pfil hooks are not already registered. */
    428 	if (pfil_registered) {
    429 		error = EEXIST;
    430 		goto out;
    431 	}
    432 
    433 	/* Capture points of the activity in the IP layer. */
    434 	npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
    435 	npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
    436 	if (!npf_ph_inet && !npf_ph_inet6) {
    437 		error = ENOENT;
    438 		goto out;
    439 	}
    440 
    441 	/* Packet IN/OUT handlers for IP layer. */
    442 	if (npf_ph_inet) {
    443 		error = pfil_add_hook(npfkern_packet_handler, npf,
    444 		    PFIL_ALL, npf_ph_inet);
    445 		KASSERT(error == 0);
    446 	}
    447 	if (npf_ph_inet6) {
    448 		error = pfil_add_hook(npfkern_packet_handler, npf,
    449 		    PFIL_ALL, npf_ph_inet6);
    450 		KASSERT(error == 0);
    451 	}
    452 
    453 	/*
    454 	 * It is necessary to re-sync all/any interface address tables,
    455 	 * since we did not listen for any changes.
    456 	 */
    457 	npf_ifaddr_syncall(npf);
    458 	pfil_registered = true;
    459 out:
    460 #ifndef NET_MPSAFE
    461 	KERNEL_UNLOCK_ONE(NULL);
    462 	mutex_exit(softnet_lock);
    463 #endif
    464 
    465 	return error;
    466 }
    467 
    468 /*
    469  * npf_pfil_unregister: unregister pfil(9) hooks.
    470  */
    471 void
    472 npf_pfil_unregister(bool fini)
    473 {
    474 	npf_t *npf = npf_getkernctx();
    475 
    476 #ifndef NET_MPSAFE
    477 	mutex_enter(softnet_lock);
    478 	KERNEL_LOCK(1, NULL);
    479 #endif
    480 
    481 	if (fini && npf_ph_if) {
    482 		(void)pfil_remove_ihook(npf_ifhook, NULL,
    483 		    PFIL_IFNET, npf_ph_if);
    484 		(void)pfil_remove_ihook(npf_ifaddrhook, NULL,
    485 		    PFIL_IFADDR, npf_ph_if);
    486 	}
    487 	if (npf_ph_inet) {
    488 		(void)pfil_remove_hook(npfkern_packet_handler, npf,
    489 		    PFIL_ALL, npf_ph_inet);
    490 	}
    491 	if (npf_ph_inet6) {
    492 		(void)pfil_remove_hook(npfkern_packet_handler, npf,
    493 		    PFIL_ALL, npf_ph_inet6);
    494 	}
    495 	pfil_registered = false;
    496 
    497 #ifndef NET_MPSAFE
    498 	KERNEL_UNLOCK_ONE(NULL);
    499 	mutex_exit(softnet_lock);
    500 #endif
    501 }
    502 
    503 bool
    504 npf_pfil_registered_p(void)
    505 {
    506 	return pfil_registered;
    507 }
    508 #endif
    509