1 /* $NetBSD: npf_ctl.c,v 1.9 2011/11/06 02:49:03 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF device control. 34 * 35 * Implementation of (re)loading, construction of tables and rules. 36 * NPF proplib(9) dictionary consumer. 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.9 2011/11/06 02:49:03 rmind Exp $"); 41 42 #include <sys/param.h> 43 #include <sys/conf.h> 44 #include <sys/kernel.h> 45 46 #include <prop/proplib.h> 47 48 #include "npf_ncode.h" 49 #include "npf_impl.h" 50 51 /* 52 * npfctl_switch: enable or disable packet inspection. 53 */ 54 int 55 npfctl_switch(void *data) 56 { 57 const bool onoff = *(int *)data ? true : false; 58 int error; 59 60 if (onoff) { 61 /* Enable: add pfil hooks. */ 62 error = npf_register_pfil(); 63 } else { 64 /* Disable: remove pfil hooks. */ 65 npf_unregister_pfil(); 66 error = 0; 67 } 68 return error; 69 } 70 71 static int __noinline 72 npf_mk_tables(npf_tableset_t *tblset, prop_array_t tables) 73 { 74 prop_object_iterator_t it; 75 prop_dictionary_t tbldict; 76 int error = 0; 77 78 /* Tables - array. */ 79 if (prop_object_type(tables) != PROP_TYPE_ARRAY) 80 return EINVAL; 81 82 it = prop_array_iterator(tables); 83 while ((tbldict = prop_object_iterator_next(it)) != NULL) { 84 prop_dictionary_t ent; 85 prop_object_iterator_t eit; 86 prop_array_t entries; 87 npf_table_t *t; 88 u_int tid; 89 int type; 90 91 /* Table - dictionary. */ 92 if (prop_object_type(tbldict) != PROP_TYPE_DICTIONARY) { 93 error = EINVAL; 94 break; 95 } 96 97 /* Table ID and type. */ 98 prop_dictionary_get_uint32(tbldict, "id", &tid); 99 prop_dictionary_get_int32(tbldict, "type", &type); 100 101 /* Validate them. */ 102 error = npf_table_check(tblset, tid, type); 103 if (error) 104 break; 105 106 /* Create and insert the table. */ 107 t = npf_table_create(tid, type, 1024); /* XXX */ 108 if (t == NULL) { 109 error = ENOMEM; 110 break; 111 } 112 error = npf_tableset_insert(tblset, t); 113 KASSERT(error == 0); 114 115 /* Entries. */ 116 entries = prop_dictionary_get(tbldict, "entries"); 117 if (prop_object_type(entries) != PROP_TYPE_ARRAY) { 118 error = EINVAL; 119 break; 120 } 121 eit = prop_array_iterator(entries); 122 while ((ent = prop_object_iterator_next(eit)) != NULL) { 123 const npf_addr_t *addr; 124 npf_netmask_t mask; 125 126 /* Get address and mask. Add a table entry. */ 127 addr = (const npf_addr_t *)prop_data_data_nocopy( 128 prop_dictionary_get(ent, "addr")); 129 prop_dictionary_get_uint8(ent, "mask", &mask); 130 error = npf_table_add_cidr(tblset, tid, addr, mask); 131 if (error) 132 break; 133 } 134 prop_object_iterator_release(eit); 135 if (error) 136 break; 137 } 138 prop_object_iterator_release(it); 139 /* 140 * Note: in a case of error, caller will free the tableset. 141 */ 142 return error; 143 } 144 145 static npf_rproc_t * 146 npf_mk_rproc(prop_array_t rprocs, const char *rpname) 147 { 148 prop_object_iterator_t it; 149 prop_dictionary_t rpdict; 150 npf_rproc_t *rp; 151 152 it = prop_array_iterator(rprocs); 153 while ((rpdict = prop_object_iterator_next(it)) != NULL) { 154 const char *iname; 155 prop_dictionary_get_cstring_nocopy(rpdict, "name", &iname); 156 if (strcmp(rpname, iname) == 0) 157 break; 158 } 159 prop_object_iterator_release(it); 160 if (rpdict == NULL) { 161 return NULL; 162 } 163 CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t)); 164 if (!prop_dictionary_get_uint64(rpdict, "rproc-ptr", (uint64_t *)&rp)) { 165 rp = npf_rproc_create(rpdict); 166 prop_dictionary_set_uint64(rpdict, "rproc-ptr", 167 (uint64_t)(uintptr_t)rp); 168 } 169 return rp; 170 } 171 172 static int __noinline 173 npf_mk_singlerule(prop_dictionary_t rldict, prop_array_t rps, npf_rule_t **rl) 174 { 175 const char *rnm; 176 npf_rproc_t *rp; 177 prop_object_t obj; 178 size_t nc_size; 179 void *nc; 180 181 /* Rule - dictionary. */ 182 if (prop_object_type(rldict) != PROP_TYPE_DICTIONARY) 183 return EINVAL; 184 185 /* N-code (binary data). */ 186 obj = prop_dictionary_get(rldict, "ncode"); 187 if (obj) { 188 const void *ncptr; 189 int npf_err, errat; 190 191 /* 192 * Allocate, copy and validate n-code. XXX: Inefficient. 193 */ 194 ncptr = prop_data_data_nocopy(obj); 195 nc_size = prop_data_size(obj); 196 if (ncptr == NULL || nc_size > NPF_NCODE_LIMIT) { 197 return EINVAL; 198 } 199 nc = npf_ncode_alloc(nc_size); 200 if (nc == NULL) { 201 return EINVAL; 202 } 203 memcpy(nc, ncptr, nc_size); 204 npf_err = npf_ncode_validate(nc, nc_size, &errat); 205 if (npf_err) { 206 npf_ncode_free(nc, nc_size); 207 /* TODO: return error details via proplib */ 208 return EINVAL; 209 } 210 } else { 211 /* No n-code. */ 212 nc = NULL; 213 nc_size = 0; 214 } 215 216 /* Check for rule procedure. */ 217 if (rps && prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rnm)) { 218 rp = npf_mk_rproc(rps, rnm); 219 if (rp == NULL) { 220 if (nc) { 221 npf_ncode_free(nc, nc_size); /* XXX */ 222 } 223 return EINVAL; 224 } 225 } else { 226 rp = NULL; 227 } 228 229 /* Finally, allocate and return the rule. */ 230 *rl = npf_rule_alloc(rldict, rp, nc, nc_size); 231 return 0; 232 } 233 234 static int __noinline 235 npf_mk_subrules(npf_ruleset_t *rlset, prop_array_t rules, prop_array_t rprocs) 236 { 237 prop_object_iterator_t it; 238 prop_dictionary_t rldict; 239 int error = 0; 240 241 if (prop_object_type(rules) != PROP_TYPE_ARRAY) { 242 return EINVAL; 243 } 244 it = prop_array_iterator(rules); 245 while ((rldict = prop_object_iterator_next(it)) != NULL) { 246 npf_rule_t *rl; 247 error = npf_mk_singlerule(rldict, rprocs, &rl); 248 if (error) { 249 break; 250 } 251 npf_ruleset_insert(rlset, rl); 252 } 253 prop_object_iterator_release(it); 254 return error; 255 } 256 257 static int __noinline 258 npf_mk_rules(npf_ruleset_t *rlset, prop_array_t rules, prop_array_t rprocs) 259 { 260 prop_object_iterator_t it; 261 prop_dictionary_t rldict, rpdict; 262 int error; 263 264 /* Rule procedures and the ruleset - arrays. */ 265 if (prop_object_type(rprocs) != PROP_TYPE_ARRAY || 266 prop_object_type(rules) != PROP_TYPE_ARRAY) 267 return EINVAL; 268 269 it = prop_array_iterator(rprocs); 270 while ((rpdict = prop_object_iterator_next(it)) != NULL) { 271 if (prop_dictionary_get(rpdict, "rproc-ptr")) { 272 prop_object_iterator_release(it); 273 return EINVAL; 274 } 275 } 276 prop_object_iterator_release(it); 277 278 error = 0; 279 it = prop_array_iterator(rules); 280 while ((rldict = prop_object_iterator_next(it)) != NULL) { 281 prop_array_t subrules; 282 npf_ruleset_t *rlsetsub; 283 npf_rule_t *rl; 284 285 /* Generate a single rule. */ 286 error = npf_mk_singlerule(rldict, rprocs, &rl); 287 if (error) { 288 break; 289 } 290 npf_ruleset_insert(rlset, rl); 291 292 /* Check for sub-rules and generate, if any. */ 293 subrules = prop_dictionary_get(rldict, "subrules"); 294 if (subrules == NULL) { 295 /* No subrules, next.. */ 296 continue; 297 } 298 rlsetsub = npf_rule_subset(rl); 299 error = npf_mk_subrules(rlsetsub, subrules, rprocs); 300 if (error) 301 break; 302 } 303 prop_object_iterator_release(it); 304 /* 305 * Note: in a case of error, caller will free the ruleset. 306 */ 307 return error; 308 } 309 310 static int __noinline 311 npf_mk_natlist(npf_ruleset_t *nset, prop_array_t natlist) 312 { 313 prop_object_iterator_t it; 314 prop_dictionary_t natdict; 315 int error; 316 317 /* NAT policies - array. */ 318 if (prop_object_type(natlist) != PROP_TYPE_ARRAY) 319 return EINVAL; 320 321 error = 0; 322 it = prop_array_iterator(natlist); 323 while ((natdict = prop_object_iterator_next(it)) != NULL) { 324 npf_natpolicy_t *np; 325 npf_rule_t *rl; 326 327 /* NAT policy - dictionary. */ 328 if (prop_object_type(natdict) != PROP_TYPE_DICTIONARY) { 329 error = EINVAL; 330 break; 331 } 332 333 /* 334 * NAT policies are standard rules, plus additional 335 * information for translation. Make a rule. 336 */ 337 error = npf_mk_singlerule(natdict, NULL, &rl); 338 if (error) { 339 break; 340 } 341 npf_ruleset_insert(nset, rl); 342 343 /* If rule is named, it is a group with NAT policies. */ 344 if (prop_dictionary_get(natdict, "name") && 345 prop_dictionary_get(natdict, "subrules")) { 346 continue; 347 } 348 349 /* Allocate a new NAT policy and assign to the rule. */ 350 np = npf_nat_newpolicy(natdict, nset); 351 if (np == NULL) { 352 npf_rule_free(rl); 353 error = ENOMEM; 354 break; 355 } 356 npf_rule_setnat(rl, np); 357 } 358 prop_object_iterator_release(it); 359 /* 360 * Note: in a case of error, caller will free entire NAT ruleset 361 * with assigned NAT policies. 362 */ 363 return error; 364 } 365 366 /* 367 * npfctl_reload: store passed data i.e. update settings, create passed 368 * tables, rules and atomically activate all them. 369 */ 370 int 371 npfctl_reload(u_long cmd, void *data) 372 { 373 const struct plistref *pref = data; 374 prop_array_t natlist, tables, rprocs, rules; 375 npf_tableset_t *tblset = NULL; 376 npf_ruleset_t *rlset = NULL; 377 npf_ruleset_t *nset = NULL; 378 prop_dictionary_t dict; 379 int error; 380 381 /* Retrieve the dictionary. */ 382 #ifdef _KERNEL 383 error = prop_dictionary_copyin_ioctl(pref, cmd, &dict); 384 if (error) 385 return error; 386 #else 387 dict = prop_dictionary_internalize_from_file(data); 388 if (dict == NULL) 389 return EINVAL; 390 #endif 391 /* NAT policies. */ 392 nset = npf_ruleset_create(); 393 natlist = prop_dictionary_get(dict, "translation"); 394 error = npf_mk_natlist(nset, natlist); 395 if (error) 396 goto fail; 397 398 /* Tables. */ 399 tblset = npf_tableset_create(); 400 tables = prop_dictionary_get(dict, "tables"); 401 error = npf_mk_tables(tblset, tables); 402 if (error) 403 goto fail; 404 405 /* Rules and rule procedures. */ 406 rlset = npf_ruleset_create(); 407 rprocs = prop_dictionary_get(dict, "rprocs"); 408 rules = prop_dictionary_get(dict, "rules"); 409 error = npf_mk_rules(rlset, rules, rprocs); 410 if (error) 411 goto fail; 412 413 /* 414 * Finally - reload ruleset, tableset and NAT policies. 415 * Operation will be performed as a single transaction. 416 */ 417 npf_reload(rlset, tblset, nset); 418 419 /* Done. Since data is consumed now, we shall not destroy it. */ 420 tblset = NULL; 421 rlset = NULL; 422 nset = NULL; 423 fail: 424 /* 425 * Note: destroy rulesets first, to drop references to the tableset. 426 */ 427 KASSERT(error == 0 || (nset || rlset || tblset)); 428 if (nset) { 429 npf_ruleset_destroy(nset); 430 } 431 if (rlset) { 432 npf_ruleset_destroy(rlset); 433 } 434 if (tblset) { 435 npf_tableset_destroy(tblset); 436 } 437 prop_object_release(dict); 438 return error; 439 } 440 441 /* 442 * npfctl_update_rule: reload a specific rule identified by the name. 443 */ 444 int 445 npfctl_update_rule(u_long cmd, void *data) 446 { 447 const struct plistref *pref = data; 448 prop_dictionary_t dict; 449 prop_array_t subrules; 450 prop_object_t obj; 451 npf_ruleset_t *rlset; 452 const char *name; 453 int error; 454 455 #ifdef _KERNEL 456 /* Retrieve and construct the rule. */ 457 error = prop_dictionary_copyin_ioctl(pref, cmd, &dict); 458 if (error) { 459 return error; 460 } 461 #else 462 dict = prop_dictionary_internalize_from_file(data); 463 if (dict == NULL) 464 return EINVAL; 465 #endif 466 /* Create the ruleset and construct sub-rules. */ 467 rlset = npf_ruleset_create(); 468 subrules = prop_dictionary_get(dict, "subrules"); 469 error = npf_mk_subrules(rlset, subrules, NULL); 470 if (error) { 471 goto out; 472 } 473 474 /* Lookup the rule by name, and replace its subset (sub-rules). */ 475 obj = prop_dictionary_get(dict, "name"); 476 name = prop_string_cstring_nocopy(obj); 477 if (npf_ruleset_replace(name, rlset) == NULL) { 478 /* Not found. */ 479 error = ENOENT; 480 out: /* Error path. */ 481 npf_ruleset_destroy(rlset); 482 } 483 prop_object_release(dict); 484 return error; 485 } 486 487 /* 488 * npfctl_sessions_save: construct a list of sessions and export for saving. 489 */ 490 int 491 npfctl_sessions_save(u_long cmd, void *data) 492 { 493 struct plistref *pref = data; 494 prop_dictionary_t sesdict; 495 prop_array_t selist, nplist; 496 int error; 497 498 /* Create a dictionary and two lists. */ 499 sesdict = prop_dictionary_create(); 500 selist = prop_array_create(); 501 nplist = prop_array_create(); 502 503 /* Save the sessions. */ 504 error = npf_session_save(selist, nplist); 505 if (error) { 506 goto fail; 507 } 508 509 /* Set the session list, NAT policy list and export the dictionary. */ 510 prop_dictionary_set(sesdict, "session-list", selist); 511 prop_dictionary_set(sesdict, "nat-policy-list", nplist); 512 #ifdef _KERNEL 513 error = prop_dictionary_copyout_ioctl(pref, cmd, sesdict); 514 #else 515 error = prop_dictionary_externalize_to_file(sesdict, data) ? 0 : errno; 516 #endif 517 fail: 518 prop_object_release(sesdict); 519 return error; 520 } 521 522 /* 523 * npfctl_sessions_load: import a list of sessions, reconstruct them and load. 524 */ 525 int 526 npfctl_sessions_load(u_long cmd, void *data) 527 { 528 const struct plistref *pref = data; 529 npf_sehash_t *sehasht = NULL; 530 prop_dictionary_t sesdict, sedict; 531 prop_object_iterator_t it; 532 prop_array_t selist; 533 int error; 534 535 /* Retrieve the dictionary containing session and NAT policy lists. */ 536 #ifdef _KERNEL 537 error = prop_dictionary_copyin_ioctl(pref, cmd, &sesdict); 538 if (error) 539 return error; 540 #else 541 sesdict = prop_dictionary_internalize_from_file(data); 542 if (sesdict == NULL) 543 return EINVAL; 544 #endif 545 /* 546 * Note: session objects contain the references to the NAT policy 547 * entries. Therefore, no need to directly access it. 548 */ 549 selist = prop_dictionary_get(sesdict, "session-list"); 550 if (prop_object_type(selist) != PROP_TYPE_ARRAY) { 551 error = EINVAL; 552 goto fail; 553 } 554 555 /* Create a session hash table. */ 556 sehasht = sess_htable_create(); 557 if (sehasht == NULL) { 558 error = ENOMEM; 559 goto fail; 560 } 561 562 /* 563 * Iterate through and construct each session. 564 */ 565 error = 0; 566 it = prop_array_iterator(selist); 567 npf_core_enter(); 568 while ((sedict = prop_object_iterator_next(it)) != NULL) { 569 /* Session - dictionary. */ 570 if (prop_object_type(sedict) != PROP_TYPE_DICTIONARY) { 571 error = EINVAL; 572 goto fail; 573 } 574 /* Construct and insert real session structure. */ 575 error = npf_session_restore(sehasht, sedict); 576 if (error) { 577 goto fail; 578 } 579 } 580 npf_core_exit(); 581 sess_htable_reload(sehasht); 582 fail: 583 prop_object_release(selist); 584 if (error && sehasht) { 585 /* Destroy session table. */ 586 sess_htable_destroy(sehasht); 587 } 588 return error; 589 } 590 591 /* 592 * npfctl_table: add, remove or query entries in the specified table. 593 * 594 * For maximum performance, interface is avoiding proplib(3)'s overhead. 595 */ 596 int 597 npfctl_table(void *data) 598 { 599 npf_ioctl_table_t *nct = data; 600 int error; 601 602 npf_core_enter(); /* XXXSMP */ 603 switch (nct->nct_action) { 604 case NPF_IOCTL_TBLENT_ADD: 605 error = npf_table_add_cidr(NULL, nct->nct_tid, 606 &nct->nct_addr, nct->nct_mask); 607 break; 608 case NPF_IOCTL_TBLENT_REM: 609 error = npf_table_rem_cidr(NULL, nct->nct_tid, 610 &nct->nct_addr, nct->nct_mask); 611 break; 612 default: 613 /* XXX */ 614 error = npf_table_match_addr(nct->nct_tid, &nct->nct_addr); 615 if (error) { 616 error = EINVAL; 617 } 618 } 619 npf_core_exit(); /* XXXSMP */ 620 return error; 621 } 622