1 /* $NetBSD: npf_ctl.c,v 1.11 2012/01/15 00:49:48 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2011 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF device control. 34 * 35 * Implementation of (re)loading, construction of tables and rules. 36 * NPF proplib(9) dictionary consumer. 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: npf_ctl.c,v 1.11 2012/01/15 00:49:48 rmind Exp $"); 41 42 #include <sys/param.h> 43 #include <sys/conf.h> 44 #include <sys/kernel.h> 45 46 #include <prop/proplib.h> 47 48 #include "npf_ncode.h" 49 #include "npf_impl.h" 50 51 /* 52 * npfctl_switch: enable or disable packet inspection. 53 */ 54 int 55 npfctl_switch(void *data) 56 { 57 const bool onoff = *(int *)data ? true : false; 58 int error; 59 60 if (onoff) { 61 /* Enable: add pfil hooks. */ 62 error = npf_register_pfil(); 63 } else { 64 /* Disable: remove pfil hooks. */ 65 npf_unregister_pfil(); 66 error = 0; 67 } 68 return error; 69 } 70 71 static int __noinline 72 npf_mk_tables(npf_tableset_t *tblset, prop_array_t tables) 73 { 74 prop_object_iterator_t it; 75 prop_dictionary_t tbldict; 76 int error = 0; 77 78 /* Tables - array. */ 79 if (prop_object_type(tables) != PROP_TYPE_ARRAY) 80 return EINVAL; 81 82 it = prop_array_iterator(tables); 83 while ((tbldict = prop_object_iterator_next(it)) != NULL) { 84 prop_dictionary_t ent; 85 prop_object_iterator_t eit; 86 prop_array_t entries; 87 npf_table_t *t; 88 u_int tid; 89 int type; 90 91 /* Table - dictionary. */ 92 if (prop_object_type(tbldict) != PROP_TYPE_DICTIONARY) { 93 error = EINVAL; 94 break; 95 } 96 97 /* Table ID and type. */ 98 prop_dictionary_get_uint32(tbldict, "id", &tid); 99 prop_dictionary_get_int32(tbldict, "type", &type); 100 101 /* Validate them. */ 102 error = npf_table_check(tblset, tid, type); 103 if (error) 104 break; 105 106 /* Create and insert the table. */ 107 t = npf_table_create(tid, type, 1024); /* XXX */ 108 if (t == NULL) { 109 error = ENOMEM; 110 break; 111 } 112 error = npf_tableset_insert(tblset, t); 113 KASSERT(error == 0); 114 115 /* Entries. */ 116 entries = prop_dictionary_get(tbldict, "entries"); 117 if (prop_object_type(entries) != PROP_TYPE_ARRAY) { 118 error = EINVAL; 119 break; 120 } 121 eit = prop_array_iterator(entries); 122 while ((ent = prop_object_iterator_next(eit)) != NULL) { 123 const npf_addr_t *addr; 124 npf_netmask_t mask; 125 126 /* Get address and mask. Add a table entry. */ 127 addr = (const npf_addr_t *)prop_data_data_nocopy( 128 prop_dictionary_get(ent, "addr")); 129 prop_dictionary_get_uint8(ent, "mask", &mask); 130 error = npf_table_add_cidr(tblset, tid, addr, mask); 131 if (error) 132 break; 133 } 134 prop_object_iterator_release(eit); 135 if (error) 136 break; 137 } 138 prop_object_iterator_release(it); 139 /* 140 * Note: in a case of error, caller will free the tableset. 141 */ 142 return error; 143 } 144 145 static npf_rproc_t * 146 npf_mk_rproc(prop_array_t rprocs, const char *rpname) 147 { 148 prop_object_iterator_t it; 149 prop_dictionary_t rpdict; 150 npf_rproc_t *rp; 151 152 it = prop_array_iterator(rprocs); 153 while ((rpdict = prop_object_iterator_next(it)) != NULL) { 154 const char *iname; 155 prop_dictionary_get_cstring_nocopy(rpdict, "name", &iname); 156 if (strcmp(rpname, iname) == 0) 157 break; 158 } 159 prop_object_iterator_release(it); 160 if (rpdict == NULL) { 161 return NULL; 162 } 163 CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t)); 164 if (!prop_dictionary_get_uint64(rpdict, "rproc-ptr", (uint64_t *)&rp)) { 165 rp = npf_rproc_create(rpdict); 166 prop_dictionary_set_uint64(rpdict, "rproc-ptr", 167 (uint64_t)(uintptr_t)rp); 168 } 169 return rp; 170 } 171 172 static int __noinline 173 npf_mk_singlerule(prop_dictionary_t rldict, prop_array_t rps, npf_rule_t **rl) 174 { 175 const char *rnm; 176 npf_rproc_t *rp; 177 prop_object_t obj; 178 size_t nc_size; 179 void *nc; 180 181 /* Rule - dictionary. */ 182 if (prop_object_type(rldict) != PROP_TYPE_DICTIONARY) 183 return EINVAL; 184 185 /* N-code (binary data). */ 186 obj = prop_dictionary_get(rldict, "ncode"); 187 if (obj) { 188 const void *ncptr; 189 int npf_err, errat; 190 191 /* 192 * Allocate, copy and validate n-code. XXX: Inefficient. 193 */ 194 ncptr = prop_data_data_nocopy(obj); 195 nc_size = prop_data_size(obj); 196 if (ncptr == NULL || nc_size > NPF_NCODE_LIMIT) { 197 return EINVAL; 198 } 199 nc = npf_ncode_alloc(nc_size); 200 if (nc == NULL) { 201 return EINVAL; 202 } 203 memcpy(nc, ncptr, nc_size); 204 npf_err = npf_ncode_validate(nc, nc_size, &errat); 205 if (npf_err) { 206 npf_ncode_free(nc, nc_size); 207 /* TODO: return error details via proplib */ 208 return EINVAL; 209 } 210 } else { 211 /* No n-code. */ 212 nc = NULL; 213 nc_size = 0; 214 } 215 216 /* Check for rule procedure. */ 217 if (rps && prop_dictionary_get_cstring_nocopy(rldict, "rproc", &rnm)) { 218 rp = npf_mk_rproc(rps, rnm); 219 if (rp == NULL) { 220 if (nc) { 221 npf_ncode_free(nc, nc_size); /* XXX */ 222 } 223 return EINVAL; 224 } 225 } else { 226 rp = NULL; 227 } 228 229 /* Finally, allocate and return the rule. */ 230 *rl = npf_rule_alloc(rldict, rp, nc, nc_size); 231 return 0; 232 } 233 234 static int __noinline 235 npf_mk_subrules(npf_ruleset_t *rlset, prop_array_t rules, prop_array_t rprocs) 236 { 237 prop_object_iterator_t it; 238 prop_dictionary_t rldict; 239 int error = 0; 240 241 if (prop_object_type(rules) != PROP_TYPE_ARRAY) { 242 return EINVAL; 243 } 244 it = prop_array_iterator(rules); 245 while ((rldict = prop_object_iterator_next(it)) != NULL) { 246 npf_rule_t *rl; 247 error = npf_mk_singlerule(rldict, rprocs, &rl); 248 if (error) { 249 break; 250 } 251 npf_ruleset_insert(rlset, rl); 252 } 253 prop_object_iterator_release(it); 254 return error; 255 } 256 257 static int __noinline 258 npf_mk_rules(npf_ruleset_t *rlset, prop_array_t rules, prop_array_t rprocs) 259 { 260 prop_object_iterator_t it; 261 prop_dictionary_t rldict, rpdict; 262 int error; 263 264 /* Rule procedures and the ruleset - arrays. */ 265 if (prop_object_type(rprocs) != PROP_TYPE_ARRAY || 266 prop_object_type(rules) != PROP_TYPE_ARRAY) 267 return EINVAL; 268 269 it = prop_array_iterator(rprocs); 270 while ((rpdict = prop_object_iterator_next(it)) != NULL) { 271 if (prop_dictionary_get(rpdict, "rproc-ptr")) { 272 prop_object_iterator_release(it); 273 return EINVAL; 274 } 275 } 276 prop_object_iterator_release(it); 277 278 error = 0; 279 it = prop_array_iterator(rules); 280 while ((rldict = prop_object_iterator_next(it)) != NULL) { 281 prop_array_t subrules; 282 npf_ruleset_t *rlsetsub; 283 npf_rule_t *rl; 284 285 /* Generate a single rule. */ 286 error = npf_mk_singlerule(rldict, rprocs, &rl); 287 if (error) { 288 break; 289 } 290 npf_ruleset_insert(rlset, rl); 291 292 /* Check for sub-rules and generate, if any. */ 293 subrules = prop_dictionary_get(rldict, "subrules"); 294 if (subrules == NULL) { 295 /* No subrules, next.. */ 296 continue; 297 } 298 rlsetsub = npf_rule_subset(rl); 299 error = npf_mk_subrules(rlsetsub, subrules, rprocs); 300 if (error) 301 break; 302 } 303 prop_object_iterator_release(it); 304 /* 305 * Note: in a case of error, caller will free the ruleset. 306 */ 307 return error; 308 } 309 310 static int __noinline 311 npf_mk_natlist(npf_ruleset_t *nset, prop_array_t natlist) 312 { 313 prop_object_iterator_t it; 314 prop_dictionary_t natdict; 315 int error; 316 317 /* NAT policies - array. */ 318 if (prop_object_type(natlist) != PROP_TYPE_ARRAY) 319 return EINVAL; 320 321 error = 0; 322 it = prop_array_iterator(natlist); 323 while ((natdict = prop_object_iterator_next(it)) != NULL) { 324 npf_natpolicy_t *np; 325 npf_rule_t *rl; 326 327 /* NAT policy - dictionary. */ 328 if (prop_object_type(natdict) != PROP_TYPE_DICTIONARY) { 329 error = EINVAL; 330 break; 331 } 332 333 /* 334 * NAT policies are standard rules, plus additional 335 * information for translation. Make a rule. 336 */ 337 error = npf_mk_singlerule(natdict, NULL, &rl); 338 if (error) { 339 break; 340 } 341 npf_ruleset_insert(nset, rl); 342 343 /* If rule is named, it is a group with NAT policies. */ 344 if (prop_dictionary_get(natdict, "name") && 345 prop_dictionary_get(natdict, "subrules")) { 346 continue; 347 } 348 349 /* Allocate a new NAT policy and assign to the rule. */ 350 np = npf_nat_newpolicy(natdict, nset); 351 if (np == NULL) { 352 npf_rule_free(rl); 353 error = ENOMEM; 354 break; 355 } 356 npf_rule_setnat(rl, np); 357 } 358 prop_object_iterator_release(it); 359 /* 360 * Note: in a case of error, caller will free entire NAT ruleset 361 * with assigned NAT policies. 362 */ 363 return error; 364 } 365 366 /* 367 * npfctl_reload: store passed data i.e. update settings, create passed 368 * tables, rules and atomically activate all them. 369 */ 370 int 371 npfctl_reload(u_long cmd, void *data) 372 { 373 const struct plistref *pref = data; 374 prop_array_t natlist, tables, rprocs, rules; 375 npf_tableset_t *tblset = NULL; 376 npf_ruleset_t *rlset = NULL; 377 npf_ruleset_t *nset = NULL; 378 prop_dictionary_t dict; 379 bool flush; 380 int error; 381 382 /* Retrieve the dictionary. */ 383 #ifdef _KERNEL 384 error = prop_dictionary_copyin_ioctl(pref, cmd, &dict); 385 if (error) 386 return error; 387 #else 388 dict = prop_dictionary_internalize_from_file(data); 389 if (dict == NULL) 390 return EINVAL; 391 #endif 392 /* NAT policies. */ 393 nset = npf_ruleset_create(); 394 natlist = prop_dictionary_get(dict, "translation"); 395 error = npf_mk_natlist(nset, natlist); 396 if (error) { 397 goto fail; 398 } 399 400 /* Tables. */ 401 tblset = npf_tableset_create(); 402 tables = prop_dictionary_get(dict, "tables"); 403 error = npf_mk_tables(tblset, tables); 404 if (error) { 405 goto fail; 406 } 407 408 /* Rules and rule procedures. */ 409 rlset = npf_ruleset_create(); 410 rprocs = prop_dictionary_get(dict, "rprocs"); 411 rules = prop_dictionary_get(dict, "rules"); 412 error = npf_mk_rules(rlset, rules, rprocs); 413 if (error) { 414 goto fail; 415 } 416 417 flush = false; 418 prop_dictionary_get_bool(dict, "flush", &flush); 419 420 /* 421 * Finally - reload ruleset, tableset and NAT policies. 422 * Operation will be performed as a single transaction. 423 */ 424 npf_reload(rlset, tblset, nset); 425 426 /* Turn on/off session tracking accordingly. */ 427 npf_session_tracking(!flush); 428 429 /* Done. Since data is consumed now, we shall not destroy it. */ 430 tblset = NULL; 431 rlset = NULL; 432 nset = NULL; 433 fail: 434 /* 435 * Note: destroy rulesets first, to drop references to the tableset. 436 */ 437 KASSERT(error == 0 || (nset || rlset || tblset)); 438 if (nset) { 439 npf_ruleset_destroy(nset); 440 } 441 if (rlset) { 442 npf_ruleset_destroy(rlset); 443 } 444 if (tblset) { 445 npf_tableset_destroy(tblset); 446 } 447 prop_object_release(dict); 448 return error; 449 } 450 451 /* 452 * npfctl_update_rule: reload a specific rule identified by the name. 453 */ 454 int 455 npfctl_update_rule(u_long cmd, void *data) 456 { 457 const struct plistref *pref = data; 458 prop_dictionary_t dict; 459 prop_array_t subrules; 460 prop_object_t obj; 461 npf_ruleset_t *rlset; 462 const char *name; 463 int error; 464 465 #ifdef _KERNEL 466 /* Retrieve and construct the rule. */ 467 error = prop_dictionary_copyin_ioctl(pref, cmd, &dict); 468 if (error) { 469 return error; 470 } 471 #else 472 dict = prop_dictionary_internalize_from_file(data); 473 if (dict == NULL) 474 return EINVAL; 475 #endif 476 /* Create the ruleset and construct sub-rules. */ 477 rlset = npf_ruleset_create(); 478 subrules = prop_dictionary_get(dict, "subrules"); 479 error = npf_mk_subrules(rlset, subrules, NULL); 480 if (error) { 481 goto out; 482 } 483 484 /* Lookup the rule by name, and replace its subset (sub-rules). */ 485 obj = prop_dictionary_get(dict, "name"); 486 name = prop_string_cstring_nocopy(obj); 487 if (npf_ruleset_replace(name, rlset) == NULL) { 488 /* Not found. */ 489 error = ENOENT; 490 out: /* Error path. */ 491 npf_ruleset_destroy(rlset); 492 } 493 prop_object_release(dict); 494 return error; 495 } 496 497 /* 498 * npfctl_sessions_save: construct a list of sessions and export for saving. 499 */ 500 int 501 npfctl_sessions_save(u_long cmd, void *data) 502 { 503 struct plistref *pref = data; 504 prop_dictionary_t sesdict; 505 prop_array_t selist, nplist; 506 int error; 507 508 /* Create a dictionary and two lists. */ 509 sesdict = prop_dictionary_create(); 510 selist = prop_array_create(); 511 nplist = prop_array_create(); 512 513 /* Save the sessions. */ 514 error = npf_session_save(selist, nplist); 515 if (error) { 516 goto fail; 517 } 518 519 /* Set the session list, NAT policy list and export the dictionary. */ 520 prop_dictionary_set(sesdict, "session-list", selist); 521 prop_dictionary_set(sesdict, "nat-policy-list", nplist); 522 #ifdef _KERNEL 523 error = prop_dictionary_copyout_ioctl(pref, cmd, sesdict); 524 #else 525 error = prop_dictionary_externalize_to_file(sesdict, data) ? 0 : errno; 526 #endif 527 fail: 528 prop_object_release(sesdict); 529 return error; 530 } 531 532 /* 533 * npfctl_sessions_load: import a list of sessions, reconstruct them and load. 534 */ 535 int 536 npfctl_sessions_load(u_long cmd, void *data) 537 { 538 const struct plistref *pref = data; 539 npf_sehash_t *sehasht = NULL; 540 prop_dictionary_t sesdict, sedict; 541 prop_object_iterator_t it; 542 prop_array_t selist; 543 int error; 544 545 /* Retrieve the dictionary containing session and NAT policy lists. */ 546 #ifdef _KERNEL 547 error = prop_dictionary_copyin_ioctl(pref, cmd, &sesdict); 548 if (error) 549 return error; 550 #else 551 sesdict = prop_dictionary_internalize_from_file(data); 552 if (sesdict == NULL) 553 return EINVAL; 554 #endif 555 /* 556 * Note: session objects contain the references to the NAT policy 557 * entries. Therefore, no need to directly access it. 558 */ 559 selist = prop_dictionary_get(sesdict, "session-list"); 560 if (prop_object_type(selist) != PROP_TYPE_ARRAY) { 561 error = EINVAL; 562 goto fail; 563 } 564 565 /* Create a session hash table. */ 566 sehasht = sess_htable_create(); 567 if (sehasht == NULL) { 568 error = ENOMEM; 569 goto fail; 570 } 571 572 /* 573 * Iterate through and construct each session. 574 */ 575 error = 0; 576 it = prop_array_iterator(selist); 577 npf_core_enter(); 578 while ((sedict = prop_object_iterator_next(it)) != NULL) { 579 /* Session - dictionary. */ 580 if (prop_object_type(sedict) != PROP_TYPE_DICTIONARY) { 581 error = EINVAL; 582 goto fail; 583 } 584 /* Construct and insert real session structure. */ 585 error = npf_session_restore(sehasht, sedict); 586 if (error) { 587 goto fail; 588 } 589 } 590 npf_core_exit(); 591 sess_htable_reload(sehasht); 592 fail: 593 prop_object_release(selist); 594 if (error && sehasht) { 595 /* Destroy session table. */ 596 sess_htable_destroy(sehasht); 597 } 598 return error; 599 } 600 601 /* 602 * npfctl_table: add, remove or query entries in the specified table. 603 * 604 * For maximum performance, interface is avoiding proplib(3)'s overhead. 605 */ 606 int 607 npfctl_table(void *data) 608 { 609 npf_ioctl_table_t *nct = data; 610 npf_tableset_t *tblset; 611 int error; 612 613 npf_core_enter(); /* XXXSMP */ 614 tblset = npf_core_tableset(); 615 switch (nct->nct_action) { 616 case NPF_IOCTL_TBLENT_ADD: 617 error = npf_table_add_cidr(tblset, nct->nct_tid, 618 &nct->nct_addr, nct->nct_mask); 619 break; 620 case NPF_IOCTL_TBLENT_REM: 621 error = npf_table_rem_cidr(tblset, nct->nct_tid, 622 &nct->nct_addr, nct->nct_mask); 623 break; 624 default: 625 error = npf_table_match_addr(tblset, nct->nct_tid, 626 &nct->nct_addr); 627 } 628 npf_core_exit(); /* XXXSMP */ 629 return error; 630 } 631