1 /* $NetBSD: npf.c,v 1.16 2013/06/02 02:20:04 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF main: dynamic load/initialisation and unload routines. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf.c,v 1.16 2013/06/02 02:20:04 rmind Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/atomic.h> 43 #include <sys/conf.h> 44 #include <sys/kauth.h> 45 #include <sys/kmem.h> 46 #include <sys/lwp.h> 47 #include <sys/module.h> 48 #include <sys/percpu.h> 49 #include <sys/rwlock.h> 50 #include <sys/socketvar.h> 51 #include <sys/sysctl.h> 52 #include <sys/uio.h> 53 54 #include "npf_impl.h" 55 56 /* 57 * Module and device structures. 58 */ 59 MODULE(MODULE_CLASS_DRIVER, npf, NULL); 60 61 void npfattach(int); 62 63 static int npf_fini(void); 64 static int npf_dev_open(dev_t, int, int, lwp_t *); 65 static int npf_dev_close(dev_t, int, int, lwp_t *); 66 static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *); 67 static int npf_dev_poll(dev_t, int, lwp_t *); 68 static int npf_dev_read(dev_t, struct uio *, int); 69 70 static int npfctl_stats(void *); 71 72 static percpu_t * npf_stats_percpu __read_mostly; 73 static struct sysctllog * npf_sysctl __read_mostly; 74 75 const struct cdevsw npf_cdevsw = { 76 npf_dev_open, npf_dev_close, npf_dev_read, nowrite, npf_dev_ioctl, 77 nostop, notty, npf_dev_poll, nommap, nokqfilter, D_OTHER | D_MPSAFE 78 }; 79 80 static int 81 npf_init(void) 82 { 83 #ifdef _MODULE 84 devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR; 85 #endif 86 int error = 0; 87 88 npf_stats_percpu = percpu_alloc(NPF_STATS_SIZE); 89 npf_sysctl = NULL; 90 91 npf_worker_sysinit(); 92 npf_tableset_sysinit(); 93 npf_session_sysinit(); 94 npf_nat_sysinit(); 95 npf_alg_sysinit(); 96 npf_ext_sysinit(); 97 98 /* Load empty configuration. */ 99 npf_config_init(); 100 101 #ifdef _MODULE 102 /* Attach /dev/npf device. */ 103 error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor); 104 if (error) { 105 /* It will call devsw_detach(), which is safe. */ 106 (void)npf_fini(); 107 } 108 #endif 109 return error; 110 } 111 112 static int 113 npf_fini(void) 114 { 115 116 /* At first, detach device and remove pfil hooks. */ 117 #ifdef _MODULE 118 devsw_detach(NULL, &npf_cdevsw); 119 #endif 120 npf_pfil_unregister(); 121 122 /* Flush all sessions, destroy configuration (ruleset, etc). */ 123 npf_session_tracking(false); 124 npf_config_fini(); 125 126 /* Finally, safe to destroy the subsystems. */ 127 npf_ext_sysfini(); 128 npf_alg_sysfini(); 129 npf_nat_sysfini(); 130 npf_session_sysfini(); 131 npf_tableset_sysfini(); 132 133 /* Note: worker is the last. */ 134 npf_worker_sysfini(); 135 136 if (npf_sysctl) { 137 sysctl_teardown(&npf_sysctl); 138 } 139 percpu_free(npf_stats_percpu, NPF_STATS_SIZE); 140 141 return 0; 142 } 143 144 /* 145 * Module interface. 146 */ 147 static int 148 npf_modcmd(modcmd_t cmd, void *arg) 149 { 150 151 switch (cmd) { 152 case MODULE_CMD_INIT: 153 return npf_init(); 154 case MODULE_CMD_FINI: 155 return npf_fini(); 156 case MODULE_CMD_AUTOUNLOAD: 157 if (npf_autounload_p()) { 158 return EBUSY; 159 } 160 break; 161 default: 162 return ENOTTY; 163 } 164 return 0; 165 } 166 167 void 168 npfattach(int nunits) 169 { 170 171 /* Void. */ 172 } 173 174 static int 175 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l) 176 { 177 178 /* Available only for super-user. */ 179 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 180 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 181 return EPERM; 182 } 183 return 0; 184 } 185 186 static int 187 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l) 188 { 189 190 return 0; 191 } 192 193 static int 194 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l) 195 { 196 int error; 197 198 /* Available only for super-user. */ 199 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 200 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) { 201 return EPERM; 202 } 203 204 switch (cmd) { 205 case IOC_NPF_TABLE: 206 error = npfctl_table(data); 207 break; 208 case IOC_NPF_RULE: 209 error = npfctl_rule(cmd, data); 210 break; 211 case IOC_NPF_GETCONF: 212 error = npfctl_getconf(cmd, data); 213 break; 214 case IOC_NPF_STATS: 215 error = npfctl_stats(data); 216 break; 217 case IOC_NPF_SESSIONS_SAVE: 218 error = npfctl_sessions_save(cmd, data); 219 break; 220 case IOC_NPF_SESSIONS_LOAD: 221 error = npfctl_sessions_load(cmd, data); 222 break; 223 case IOC_NPF_SWITCH: 224 error = npfctl_switch(data); 225 break; 226 case IOC_NPF_RELOAD: 227 error = npfctl_reload(cmd, data); 228 break; 229 case IOC_NPF_VERSION: 230 *(int *)data = NPF_VERSION; 231 error = 0; 232 break; 233 default: 234 error = ENOTTY; 235 break; 236 } 237 return error; 238 } 239 240 static int 241 npf_dev_poll(dev_t dev, int events, lwp_t *l) 242 { 243 244 return ENOTSUP; 245 } 246 247 static int 248 npf_dev_read(dev_t dev, struct uio *uio, int flag) 249 { 250 251 return ENOTSUP; 252 } 253 254 bool 255 npf_autounload_p(void) 256 { 257 return !npf_pfil_registered_p() && npf_default_pass(); 258 } 259 260 /* 261 * NPF statistics interface. 262 */ 263 264 void 265 npf_stats_inc(npf_stats_t st) 266 { 267 uint64_t *stats = percpu_getref(npf_stats_percpu); 268 stats[st]++; 269 percpu_putref(npf_stats_percpu); 270 } 271 272 void 273 npf_stats_dec(npf_stats_t st) 274 { 275 uint64_t *stats = percpu_getref(npf_stats_percpu); 276 stats[st]--; 277 percpu_putref(npf_stats_percpu); 278 } 279 280 static void 281 npf_stats_collect(void *mem, void *arg, struct cpu_info *ci) 282 { 283 uint64_t *percpu_stats = mem, *full_stats = arg; 284 int i; 285 286 for (i = 0; i < NPF_STATS_COUNT; i++) { 287 full_stats[i] += percpu_stats[i]; 288 } 289 } 290 291 /* 292 * npfctl_stats: export collected statistics. 293 */ 294 static int 295 npfctl_stats(void *data) 296 { 297 uint64_t *fullst, *uptr = *(uint64_t **)data; 298 int error; 299 300 fullst = kmem_zalloc(NPF_STATS_SIZE, KM_SLEEP); 301 percpu_foreach(npf_stats_percpu, npf_stats_collect, fullst); 302 error = copyout(fullst, uptr, NPF_STATS_SIZE); 303 kmem_free(fullst, NPF_STATS_SIZE); 304 return error; 305 } 306