1 /* $NetBSD: npf_alg.c,v 1.8 2013/03/20 00:29:47 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 2010 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF interface for application level gateways (ALGs). 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_alg.c,v 1.8 2013/03/20 00:29:47 christos Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/types.h> 41 42 #include <sys/kmem.h> 43 #include <sys/pserialize.h> 44 #include <sys/mutex.h> 45 #include <net/pfil.h> 46 #include <sys/module.h> 47 48 #include "npf_impl.h" 49 50 /* NAT ALG structure for registration. */ 51 struct npf_alg { 52 LIST_ENTRY(npf_alg) na_entry; 53 const char * na_name; 54 npf_alg_t * na_bptr; 55 npf_alg_func_t na_match_func; 56 npf_alg_func_t na_tr_func; 57 npf_alg_sfunc_t na_se_func; 58 }; 59 60 static LIST_HEAD(, npf_alg) nat_alg_list __cacheline_aligned; 61 static kmutex_t nat_alg_lock __cacheline_aligned; 62 static pserialize_t nat_alg_psz __cacheline_aligned; 63 64 void 65 npf_alg_sysinit(void) 66 { 67 68 mutex_init(&nat_alg_lock, MUTEX_DEFAULT, IPL_NONE); 69 nat_alg_psz = pserialize_create(); 70 LIST_INIT(&nat_alg_list); 71 } 72 73 void 74 npf_alg_sysfini(void) 75 { 76 77 KASSERT(LIST_EMPTY(&nat_alg_list)); 78 pserialize_destroy(nat_alg_psz); 79 mutex_destroy(&nat_alg_lock); 80 } 81 82 static const char npf_alg_prefix[] = "npf_alg_"; 83 #define NPF_EXT_PREFLEN (sizeof(npf_alg_prefix) - 1) 84 85 static npf_alg_t * 86 npf_alg_lookup(const char *name, bool autoload) 87 { 88 npf_alg_t *alg; 89 char modname[64 + NPF_EXT_PREFLEN]; 90 int error; 91 92 KASSERT(mutex_owned(&nat_alg_lock)); 93 94 again: 95 LIST_FOREACH(alg, &nat_alg_list, na_entry) 96 if (strcmp(alg->na_name, name) == 0) 97 break; 98 99 if (alg != NULL || !autoload) 100 return alg; 101 102 mutex_exit(&nat_alg_lock); 103 autoload = false; 104 snprintf(modname, sizeof(modname), "%s%s", npf_alg_prefix, name); 105 error = module_autoload(modname, MODULE_CLASS_MISC); 106 mutex_enter(&nat_alg_lock); 107 108 if (error) 109 return NULL; 110 goto again; 111 } 112 113 npf_alg_t * 114 npf_alg_construct(const char *name) 115 { 116 npf_alg_t *alg; 117 118 mutex_enter(&nat_alg_lock); 119 alg = npf_alg_lookup(name, true); 120 mutex_exit(&nat_alg_lock); 121 return alg; 122 } 123 124 /* 125 * npf_alg_register: register application-level gateway. 126 */ 127 npf_alg_t * 128 npf_alg_register(const char *name, npf_alg_func_t mfunc, npf_alg_func_t tfunc, 129 npf_alg_sfunc_t sfunc) 130 { 131 npf_alg_t *alg; 132 133 alg = kmem_zalloc(sizeof(npf_alg_t), KM_SLEEP); 134 alg->na_name = name; 135 alg->na_bptr = alg; 136 alg->na_match_func = mfunc; 137 alg->na_tr_func = tfunc; 138 alg->na_se_func = sfunc; 139 140 mutex_enter(&nat_alg_lock); 141 if (npf_alg_lookup(name, false) != NULL) { 142 mutex_exit(&nat_alg_lock); 143 kmem_free(alg, sizeof(npf_alg_t)); 144 return NULL; 145 } 146 LIST_INSERT_HEAD(&nat_alg_list, alg, na_entry); 147 mutex_exit(&nat_alg_lock); 148 149 return alg; 150 } 151 152 /* 153 * npf_alg_unregister: unregister application-level gateway. 154 */ 155 int 156 npf_alg_unregister(npf_alg_t *alg) 157 { 158 mutex_enter(&nat_alg_lock); 159 LIST_REMOVE(alg, na_entry); 160 pserialize_perform(nat_alg_psz); 161 mutex_exit(&nat_alg_lock); 162 163 npf_config_enter(); 164 npf_ruleset_freealg(npf_config_natset(), alg); 165 npf_config_exit(); 166 167 kmem_free(alg, sizeof(npf_alg_t)); 168 return 0; 169 } 170 171 /* 172 * npf_alg_match: call ALG matching inspectors, determine if any ALG matches. 173 */ 174 bool 175 npf_alg_match(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, int di) 176 { 177 npf_alg_t *alg; 178 bool match = false; 179 int s; 180 181 s = pserialize_read_enter(); 182 LIST_FOREACH(alg, &nat_alg_list, na_entry) { 183 npf_alg_func_t func = alg->na_match_func; 184 185 if (func && func(npc, nbuf, nt, di)) { 186 match = true; 187 break; 188 } 189 } 190 pserialize_read_exit(s); 191 return match; 192 } 193 194 /* 195 * npf_alg_exec: execute ALG hooks for translation. 196 */ 197 void 198 npf_alg_exec(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, int di) 199 { 200 npf_alg_t *alg; 201 int s; 202 203 s = pserialize_read_enter(); 204 LIST_FOREACH(alg, &nat_alg_list, na_entry) { 205 npf_alg_func_t func; 206 207 if ((func = alg->na_tr_func) != NULL) { 208 (func)(npc, nbuf, nt, di); 209 } 210 } 211 pserialize_read_exit(s); 212 } 213 214 npf_session_t * 215 npf_alg_session(npf_cache_t *npc, nbuf_t *nbuf, int di) 216 { 217 npf_session_t *se = NULL; 218 npf_alg_t *alg; 219 int s; 220 221 s = pserialize_read_enter(); 222 LIST_FOREACH(alg, &nat_alg_list, na_entry) { 223 npf_alg_sfunc_t func = alg->na_se_func; 224 225 if (func && (se = func(npc, nbuf, di)) != NULL) { 226 break; 227 } 228 } 229 pserialize_read_exit(s); 230 return se; 231 } 232