1 /*-
2 * Copyright (c) 2009-2016 The NetBSD Foundation, Inc.
3 * All rights reserved.
4 *
5 * This material is based upon work partially supported by The
6 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 /*
31 * NPF main: dynamic load/initialisation and unload routines.
32 */
33
34 #ifdef _KERNEL
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: npf_os.c,v 1.22 2025/03/20 09:49:01 pgoyette Exp $");
37
38 #ifdef _KERNEL_OPT
39 #include "pf.h"
40 #if NPF > 0
41 #error "NPF and PF are mutually exclusive; please select one"
42 #endif
43 #endif
44
45 #include <sys/param.h>
46 #include <sys/types.h>
47
48 #include <sys/conf.h>
49 #include <sys/kauth.h>
50 #include <sys/kmem.h>
51 #include <sys/lwp.h>
52 #include <sys/module.h>
53 #include <sys/pserialize.h>
54 #include <sys/socketvar.h>
55 #include <sys/uio.h>
56
57 #include <netinet/in.h>
58 #include <netinet6/in6_var.h>
59 #endif
60
61 #include "npf_impl.h"
62 #include "npfkern.h"
63
64 #ifdef _KERNEL
65 #ifndef _MODULE
66 #include "opt_modular.h"
67 #include "opt_net_mpsafe.h"
68 #endif
69 #include "ioconf.h"
70 #endif
71
72 /*
73 * Module and device structures.
74 */
75 #ifndef _MODULE
76 /*
77 * Modular kernels load drivers too early, and we need percpu to be inited
78 * So we make this misc; a better way would be to have early boot and late
79 * boot drivers.
80 */
81 MODULE(MODULE_CLASS_MISC, npf, "bpf");
82 #else
83 /* This module autoloads via /dev/npf so it needs to be a driver */
84 MODULE(MODULE_CLASS_DRIVER, npf, "bpf");
85 #endif
86
87 #define NPF_IOCTL_DATA_LIMIT (4 * 1024 * 1024)
88
89 static int npf_pfil_register(bool);
90 static void npf_pfil_unregister(bool);
91
92 static int npf_dev_open(dev_t, int, int, lwp_t *);
93 static int npf_dev_close(dev_t, int, int, lwp_t *);
94 static int npf_dev_ioctl(dev_t, u_long, void *, int, lwp_t *);
95 static int npf_dev_poll(dev_t, int, lwp_t *);
96 static int npf_dev_read(dev_t, struct uio *, int);
97
98 const struct cdevsw npf_cdevsw = {
99 .d_open = npf_dev_open,
100 .d_close = npf_dev_close,
101 .d_read = npf_dev_read,
102 .d_write = nowrite,
103 .d_ioctl = npf_dev_ioctl,
104 .d_stop = nostop,
105 .d_tty = notty,
106 .d_poll = npf_dev_poll,
107 .d_mmap = nommap,
108 .d_kqfilter = nokqfilter,
109 .d_discard = nodiscard,
110 .d_flag = D_OTHER | D_MPSAFE
111 };
112
113 static const char * npf_ifop_getname(npf_t *, ifnet_t *);
114 static ifnet_t * npf_ifop_lookup(npf_t *, const char *);
115 static void npf_ifop_flush(npf_t *, void *);
116 static void * npf_ifop_getmeta(npf_t *, const ifnet_t *);
117 static void npf_ifop_setmeta(npf_t *, ifnet_t *, void *);
118
119 static const unsigned nworkers = 1;
120
121 static bool pfil_registered = false;
122 static pfil_head_t * npf_ph_if = NULL;
123 static pfil_head_t * npf_ph_inet = NULL;
124 static pfil_head_t * npf_ph_inet6 = NULL;
125
126 static const npf_ifops_t kern_ifops = {
127 .getname = npf_ifop_getname,
128 .lookup = npf_ifop_lookup,
129 .flush = npf_ifop_flush,
130 .getmeta = npf_ifop_getmeta,
131 .setmeta = npf_ifop_setmeta,
132 };
133
134 static int
npf_fini(void)135 npf_fini(void)
136 {
137 npf_t *npf = npf_getkernctx();
138
139 /* At first, detach device and remove pfil hooks. */
140 #ifdef _MODULE
141 devsw_detach(NULL, &npf_cdevsw);
142 #endif
143 npf_pfil_unregister(true);
144 npfk_destroy(npf);
145 npfk_sysfini();
146 return 0;
147 }
148
149 static int
npf_init(void)150 npf_init(void)
151 {
152 npf_t *npf;
153 int error = 0;
154
155 error = npfk_sysinit(nworkers);
156 if (error)
157 return error;
158 npf = npfk_create(0, NULL, &kern_ifops, NULL);
159 npf_setkernctx(npf);
160 npf_pfil_register(true);
161
162 #ifdef _MODULE
163 devmajor_t bmajor = NODEVMAJOR, cmajor = NODEVMAJOR;
164
165 /* Attach /dev/npf device. */
166 error = devsw_attach("npf", NULL, &bmajor, &npf_cdevsw, &cmajor);
167 if (error) {
168 /* It will call devsw_detach(), which is safe. */
169 (void)npf_fini();
170 }
171 #endif
172 return error;
173 }
174
175
176 /*
177 * Module interface.
178 */
179 static int
npf_modcmd(modcmd_t cmd,void * arg)180 npf_modcmd(modcmd_t cmd, void *arg)
181 {
182 switch (cmd) {
183 case MODULE_CMD_INIT:
184 return npf_init();
185 case MODULE_CMD_FINI:
186 return npf_fini();
187 case MODULE_CMD_AUTOUNLOAD:
188 /*
189 * XXX npf_autounload_p() is insufficient here. At least one other
190 * XXX path leads to unloading while something tries later on to
191 * XXX continue (perhaps closing of an open fd). For now, just
192 * XXX disabble autounload.
193 */
194 return EBUSY;
195 default:
196 return ENOTTY;
197 }
198 return 0;
199 }
200
201 void
npfattach(int nunits)202 npfattach(int nunits)
203 {
204 /* Nothing */
205 }
206
207 static int
npf_dev_open(dev_t dev,int flag,int mode,lwp_t * l)208 npf_dev_open(dev_t dev, int flag, int mode, lwp_t *l)
209 {
210 /* Available only for super-user. */
211 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
212 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
213 return EPERM;
214 }
215 return 0;
216 }
217
218 static int
npf_dev_close(dev_t dev,int flag,int mode,lwp_t * l)219 npf_dev_close(dev_t dev, int flag, int mode, lwp_t *l)
220 {
221 return 0;
222 }
223
224 static int
npf_stats_export(npf_t * npf,void * data)225 npf_stats_export(npf_t *npf, void *data)
226 {
227 uint64_t *fullst, *uptr = *(uint64_t **)data;
228 int error;
229
230 fullst = kmem_alloc(NPF_STATS_SIZE, KM_SLEEP);
231 npfk_stats(npf, fullst); /* will zero the buffer */
232 error = copyout(fullst, uptr, NPF_STATS_SIZE);
233 kmem_free(fullst, NPF_STATS_SIZE);
234 return error;
235 }
236
237 /*
238 * npfctl_switch: enable or disable packet inspection.
239 */
240 static int
npfctl_switch(void * data)241 npfctl_switch(void *data)
242 {
243 const bool onoff = *(int *)data ? true : false;
244 int error;
245
246 if (onoff) {
247 /* Enable: add pfil hooks. */
248 error = npf_pfil_register(false);
249 } else {
250 /* Disable: remove pfil hooks. */
251 npf_pfil_unregister(false);
252 error = 0;
253 }
254 return error;
255 }
256
257 static int
npf_dev_ioctl(dev_t dev,u_long cmd,void * data,int flag,lwp_t * l)258 npf_dev_ioctl(dev_t dev, u_long cmd, void *data, int flag, lwp_t *l)
259 {
260 npf_t *npf = npf_getkernctx();
261 nvlist_t *req, *resp;
262 int error;
263
264 /* Available only for super-user. */
265 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL,
266 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) {
267 return EPERM;
268 }
269
270 switch (cmd) {
271 case IOC_NPF_VERSION:
272 *(int *)data = NPF_VERSION;
273 return 0;
274 case IOC_NPF_SWITCH:
275 return npfctl_switch(data);
276 case IOC_NPF_TABLE:
277 return npfctl_table(npf, data);
278 case IOC_NPF_STATS:
279 return npf_stats_export(npf, data);
280 case IOC_NPF_LOAD:
281 case IOC_NPF_SAVE:
282 case IOC_NPF_RULE:
283 case IOC_NPF_CONN_LOOKUP:
284 case IOC_NPF_TABLE_REPLACE:
285 /* nvlist_ref_t argument, handled below */
286 break;
287 default:
288 return EINVAL;
289 }
290
291 error = nvlist_copyin(data, &req, NPF_IOCTL_DATA_LIMIT);
292 if (__predict_false(error)) {
293 #ifdef __NetBSD__
294 /* Until the version bump. */
295 if (cmd != IOC_NPF_SAVE) {
296 return error;
297 }
298 req = nvlist_create(0);
299 #else
300 return error;
301 #endif
302 }
303 resp = nvlist_create(0);
304
305 if ((error = npfctl_run_op(npf, cmd, req, resp)) == 0) {
306 error = nvlist_copyout(data, resp);
307 }
308
309 nvlist_destroy(resp);
310 nvlist_destroy(req);
311
312 return error;
313 }
314
315 static int
npf_dev_poll(dev_t dev,int events,lwp_t * l)316 npf_dev_poll(dev_t dev, int events, lwp_t *l)
317 {
318 return ENOTSUP;
319 }
320
321 static int
npf_dev_read(dev_t dev,struct uio * uio,int flag)322 npf_dev_read(dev_t dev, struct uio *uio, int flag)
323 {
324 return ENOTSUP;
325 }
326
327 bool
npf_autounload_p(void)328 npf_autounload_p(void)
329 {
330 if (npf_active_p())
331 return false;
332
333 npf_t *npf = npf_getkernctx();
334
335 npf_config_enter(npf);
336 bool pass = npf_default_pass(npf);
337 npf_config_exit(npf);
338
339 return pass;
340 }
341
342 /*
343 * Interface operations.
344 */
345
346 static const char *
npf_ifop_getname(npf_t * npf __unused,ifnet_t * ifp)347 npf_ifop_getname(npf_t *npf __unused, ifnet_t *ifp)
348 {
349 return ifp->if_xname;
350 }
351
352 static ifnet_t *
npf_ifop_lookup(npf_t * npf __unused,const char * name)353 npf_ifop_lookup(npf_t *npf __unused, const char *name)
354 {
355 return ifunit(name);
356 }
357
358 static void
npf_ifop_flush(npf_t * npf __unused,void * arg)359 npf_ifop_flush(npf_t *npf __unused, void *arg)
360 {
361 ifnet_t *ifp;
362
363 KERNEL_LOCK(1, NULL);
364 IFNET_GLOBAL_LOCK();
365 IFNET_WRITER_FOREACH(ifp) {
366 ifp->if_npf_private = arg;
367 }
368 IFNET_GLOBAL_UNLOCK();
369 KERNEL_UNLOCK_ONE(NULL);
370 }
371
372 static void *
npf_ifop_getmeta(npf_t * npf __unused,const ifnet_t * ifp)373 npf_ifop_getmeta(npf_t *npf __unused, const ifnet_t *ifp)
374 {
375 return ifp->if_npf_private;
376 }
377
378 static void
npf_ifop_setmeta(npf_t * npf __unused,ifnet_t * ifp,void * arg)379 npf_ifop_setmeta(npf_t *npf __unused, ifnet_t *ifp, void *arg)
380 {
381 ifp->if_npf_private = arg;
382 }
383
384 #ifdef _KERNEL
385
386 /*
387 * Wrapper of the main packet handler to pass the kernel NPF context.
388 */
389 static int
npfos_packet_handler(void * arg,struct mbuf ** mp,ifnet_t * ifp,int di)390 npfos_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
391 {
392 npf_t *npf = npf_getkernctx();
393 return npfk_packet_handler(npf, mp, ifp, di);
394 }
395
396 /*
397 * npf_ifhook: hook handling interface changes.
398 */
399 static void
npf_ifhook(void * arg,unsigned long cmd,void * arg2)400 npf_ifhook(void *arg, unsigned long cmd, void *arg2)
401 {
402 npf_t *npf = npf_getkernctx();
403 ifnet_t *ifp = arg2;
404
405 switch (cmd) {
406 case PFIL_IFNET_ATTACH:
407 npfk_ifmap_attach(npf, ifp);
408 npf_ifaddr_sync(npf, ifp);
409 break;
410 case PFIL_IFNET_DETACH:
411 npfk_ifmap_detach(npf, ifp);
412 npf_ifaddr_flush(npf, ifp);
413 break;
414 }
415 }
416
417 static void
npf_ifaddrhook(void * arg,u_long cmd,void * arg2)418 npf_ifaddrhook(void *arg, u_long cmd, void *arg2)
419 {
420 npf_t *npf = npf_getkernctx();
421 struct ifaddr *ifa = arg2;
422
423 switch (cmd) {
424 case SIOCSIFADDR:
425 case SIOCAIFADDR:
426 case SIOCDIFADDR:
427 #ifdef INET6
428 case SIOCSIFADDR_IN6:
429 case SIOCAIFADDR_IN6:
430 case SIOCDIFADDR_IN6:
431 #endif
432 KASSERT(ifa != NULL);
433 break;
434 default:
435 return;
436 }
437 npf_ifaddr_sync(npf, ifa->ifa_ifp);
438 }
439
440 /*
441 * npf_pfil_register: register pfil(9) hooks.
442 */
443 static int
npf_pfil_register(bool init)444 npf_pfil_register(bool init)
445 {
446 npf_t *npf = npf_getkernctx();
447 int error = 0;
448
449 SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
450
451 /* Init: interface re-config and attach/detach hook. */
452 if (!npf_ph_if) {
453 npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
454 if (!npf_ph_if) {
455 error = ENOENT;
456 goto out;
457 }
458
459 error = pfil_add_ihook(npf_ifhook, NULL,
460 PFIL_IFNET, npf_ph_if);
461 KASSERT(error == 0);
462
463 error = pfil_add_ihook(npf_ifaddrhook, NULL,
464 PFIL_IFADDR, npf_ph_if);
465 KASSERT(error == 0);
466 }
467 if (init) {
468 goto out;
469 }
470
471 /* Check if pfil hooks are not already registered. */
472 if (pfil_registered) {
473 error = EEXIST;
474 goto out;
475 }
476
477 /* Capture points of the activity in the IP layer. */
478 npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET);
479 npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6);
480 if (!npf_ph_inet && !npf_ph_inet6) {
481 error = ENOENT;
482 goto out;
483 }
484
485 /* Packet IN/OUT handlers for IP layer. */
486 if (npf_ph_inet) {
487 error = pfil_add_hook(npfos_packet_handler, npf,
488 PFIL_ALL, npf_ph_inet);
489 KASSERT(error == 0);
490 }
491 if (npf_ph_inet6) {
492 error = pfil_add_hook(npfos_packet_handler, npf,
493 PFIL_ALL, npf_ph_inet6);
494 KASSERT(error == 0);
495 }
496
497 /*
498 * It is necessary to re-sync all/any interface address tables,
499 * since we did not listen for any changes.
500 */
501 npf_ifaddr_syncall(npf);
502 pfil_registered = true;
503 out:
504 SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
505
506 return error;
507 }
508
509 /*
510 * npf_pfil_unregister: unregister pfil(9) hooks.
511 */
512 static void
npf_pfil_unregister(bool fini)513 npf_pfil_unregister(bool fini)
514 {
515 npf_t *npf = npf_getkernctx();
516
517 SOFTNET_KERNEL_LOCK_UNLESS_NET_MPSAFE();
518
519 if (fini && npf_ph_if) {
520 (void)pfil_remove_ihook(npf_ifhook, NULL,
521 PFIL_IFNET, npf_ph_if);
522 (void)pfil_remove_ihook(npf_ifaddrhook, NULL,
523 PFIL_IFADDR, npf_ph_if);
524 }
525 if (npf_ph_inet) {
526 (void)pfil_remove_hook(npfos_packet_handler, npf,
527 PFIL_ALL, npf_ph_inet);
528 }
529 if (npf_ph_inet6) {
530 (void)pfil_remove_hook(npfos_packet_handler, npf,
531 PFIL_ALL, npf_ph_inet6);
532 }
533 pfil_registered = false;
534
535 SOFTNET_KERNEL_UNLOCK_UNLESS_NET_MPSAFE();
536 }
537
538 bool
npf_active_p(void)539 npf_active_p(void)
540 {
541 return pfil_registered;
542 }
543
544 #endif
545
546 #ifdef __NetBSD__
547
548 /*
549 * Epoch-Based Reclamation (EBR) wrappers: in NetBSD, we rely on the
550 * passive serialization mechanism (see pserialize(9) manual page),
551 * which provides sufficient guarantees for NPF.
552 */
553
554 ebr_t *
npf_ebr_create(void)555 npf_ebr_create(void)
556 {
557 return pserialize_create();
558 }
559
560 void
npf_ebr_destroy(ebr_t * ebr)561 npf_ebr_destroy(ebr_t *ebr)
562 {
563 pserialize_destroy(ebr);
564 }
565
566 void
npf_ebr_register(ebr_t * ebr)567 npf_ebr_register(ebr_t *ebr)
568 {
569 KASSERT(ebr != NULL); (void)ebr;
570 }
571
572 void
npf_ebr_unregister(ebr_t * ebr)573 npf_ebr_unregister(ebr_t *ebr)
574 {
575 KASSERT(ebr != NULL); (void)ebr;
576 }
577
578 int
npf_ebr_enter(ebr_t * ebr)579 npf_ebr_enter(ebr_t *ebr)
580 {
581 KASSERT(ebr != NULL); (void)ebr;
582 return pserialize_read_enter();
583 }
584
585 void
npf_ebr_exit(ebr_t * ebr,int s)586 npf_ebr_exit(ebr_t *ebr, int s)
587 {
588 KASSERT(ebr != NULL); (void)ebr;
589 pserialize_read_exit(s);
590 }
591
592 void
npf_ebr_full_sync(ebr_t * ebr)593 npf_ebr_full_sync(ebr_t *ebr)
594 {
595 pserialize_perform(ebr);
596 }
597
598 bool
npf_ebr_incrit_p(ebr_t * ebr)599 npf_ebr_incrit_p(ebr_t *ebr)
600 {
601 KASSERT(ebr != NULL); (void)ebr;
602 return pserialize_in_read_section();
603 }
604
605 #endif
606