1 /* $NetBSD: npf_alg.c,v 1.5 2012/07/15 00:23:00 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2010 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF interface for application level gateways (ALGs). 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_alg.c,v 1.5 2012/07/15 00:23:00 rmind Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/kmem.h> 43 #include <sys/pserialize.h> 44 #include <sys/mutex.h> 45 #include <net/pfil.h> 46 47 #include "npf_impl.h" 48 49 /* NAT ALG structure for registration. */ 50 struct npf_alg { 51 LIST_ENTRY(npf_alg) na_entry; 52 npf_alg_t * na_bptr; 53 npf_algfunc_t na_match_func; 54 npf_algfunc_t na_out_func; 55 npf_algfunc_t na_in_func; 56 npf_algfunc_t na_seid_func; 57 }; 58 59 static LIST_HEAD(, npf_alg) nat_alg_list __cacheline_aligned; 60 static kmutex_t nat_alg_lock __cacheline_aligned; 61 static pserialize_t nat_alg_psz __cacheline_aligned; 62 63 void 64 npf_alg_sysinit(void) 65 { 66 67 mutex_init(&nat_alg_lock, MUTEX_DEFAULT, IPL_NONE); 68 nat_alg_psz = pserialize_create(); 69 LIST_INIT(&nat_alg_list); 70 } 71 72 void 73 npf_alg_sysfini(void) 74 { 75 76 KASSERT(LIST_EMPTY(&nat_alg_list)); 77 pserialize_destroy(nat_alg_psz); 78 mutex_destroy(&nat_alg_lock); 79 } 80 81 /* 82 * npf_alg_register: register application-level gateway. 83 * 84 * XXX: Protected by module lock, but unify serialisation later. 85 */ 86 npf_alg_t * 87 npf_alg_register(npf_algfunc_t match, npf_algfunc_t out, npf_algfunc_t in, 88 npf_algfunc_t seid) 89 { 90 npf_alg_t *alg; 91 92 alg = kmem_zalloc(sizeof(npf_alg_t), KM_SLEEP); 93 alg->na_bptr = alg; 94 alg->na_match_func = match; 95 alg->na_out_func = out; 96 alg->na_in_func = in; 97 alg->na_seid_func = seid; 98 99 mutex_enter(&nat_alg_lock); 100 LIST_INSERT_HEAD(&nat_alg_list, alg, na_entry); 101 mutex_exit(&nat_alg_lock); 102 103 return alg; 104 } 105 106 /* 107 * npf_alg_unregister: unregister application-level gateway. 108 */ 109 int 110 npf_alg_unregister(npf_alg_t *alg) 111 { 112 113 mutex_enter(&nat_alg_lock); 114 LIST_REMOVE(alg, na_entry); 115 pserialize_perform(nat_alg_psz); 116 mutex_exit(&nat_alg_lock); 117 118 npf_core_enter(); 119 npf_ruleset_freealg(npf_core_natset(), alg); 120 npf_core_exit(); 121 122 kmem_free(alg, sizeof(npf_alg_t)); 123 return 0; 124 } 125 126 /* 127 * npf_alg_match: call ALG matching inspectors, determine if any ALG matches. 128 */ 129 bool 130 npf_alg_match(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt) 131 { 132 npf_alg_t *alg; 133 bool match = false; 134 int s; 135 136 s = pserialize_read_enter(); 137 LIST_FOREACH(alg, &nat_alg_list, na_entry) { 138 npf_algfunc_t func = alg->na_match_func; 139 140 if (func && func(npc, nbuf, nt)) { 141 match = true; 142 break; 143 } 144 } 145 pserialize_read_exit(s); 146 return match; 147 } 148 149 /* 150 * npf_alg_exec: execute ALG hooks for translation. 151 */ 152 void 153 npf_alg_exec(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, const int di) 154 { 155 npf_alg_t *alg; 156 int s; 157 158 s = pserialize_read_enter(); 159 LIST_FOREACH(alg, &nat_alg_list, na_entry) { 160 if ((di & PFIL_OUT) != 0 && alg->na_out_func != NULL) { 161 (alg->na_out_func)(npc, nbuf, nt); 162 continue; 163 } 164 if ((di & PFIL_IN) != 0 && alg->na_in_func != NULL) { 165 (alg->na_in_func)(npc, nbuf, nt); 166 continue; 167 } 168 } 169 pserialize_read_exit(s); 170 } 171 172 bool 173 npf_alg_sessionid(npf_cache_t *npc, nbuf_t *nbuf, npf_cache_t *key) 174 { 175 npf_alg_t *alg; 176 bool nkey = false; 177 int s; 178 179 s = pserialize_read_enter(); 180 LIST_FOREACH(alg, &nat_alg_list, na_entry) { 181 npf_algfunc_t func = alg->na_seid_func; 182 183 if (func && func(npc, nbuf, (npf_nat_t *)key)) { 184 nkey = true; 185 break; 186 } 187 } 188 pserialize_read_exit(s); 189 return nkey; 190 } 191