1 /*-
2 * Copyright (c) 2012 The NetBSD Foundation, Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
15 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
16 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
17 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
18 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
19 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
20 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
22 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
23 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
24 * POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 /*
28 * NPF random blocking extension - kernel module.
29 * This is also a demo extension.
30 */
31
32 #ifdef _KERNEL
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: npf_ext_rndblock.c,v 1.9 2020/05/30 14:16:56 rmind Exp $");
35
36 #include <sys/types.h>
37 #include <sys/cprng.h>
38 #include <sys/atomic.h>
39 #include <sys/module.h>
40 #include <sys/kmem.h>
41 #endif
42
43 #include "npf_impl.h"
44
45 /*
46 * NPF extension module definition and the identifier.
47 */
48 NPF_EXT_MODULE(npf_ext_rndblock, "");
49
50 #define NPFEXT_RNDBLOCK_VER 1
51
52 static void * npf_ext_rndblock_id;
53
54 #define PERCENTAGE_BASE 10000
55
56 /*
57 * Meta-data structure, containing parameters.
58 */
59 typedef struct {
60 unsigned int mod;
61 unsigned long counter;
62 unsigned int percentage;
63 } npf_ext_rndblock_t;
64
65 /*
66 * npf_ext_rndblock_ctor: a constructor to parse and store any parameters
67 * associated with a rule procedure, which is being newly created.
68 */
69 static int
npf_ext_rndblock_ctor(npf_rproc_t * rp,const nvlist_t * params)70 npf_ext_rndblock_ctor(npf_rproc_t *rp, const nvlist_t *params)
71 {
72 npf_ext_rndblock_t *meta;
73
74 /*
75 * Allocate and a associate a structure for the parameter
76 * and our meta-data.
77 */
78 meta = kmem_zalloc(sizeof(npf_ext_rndblock_t), KM_SLEEP);
79 meta->mod = dnvlist_get_number(params, "mod", 0);
80 meta->percentage = dnvlist_get_number(params, "percentage", 0);
81 npf_rproc_assign(rp, meta);
82
83 return 0;
84 }
85
86 /*
87 * npf_ext_rndblock_dtor: a destructor for our rule procedure.
88 */
89 static void
npf_ext_rndblock_dtor(npf_rproc_t * rp,void * meta)90 npf_ext_rndblock_dtor(npf_rproc_t *rp, void *meta)
91 {
92 /* Free our meta-data, associated with the procedure. */
93 kmem_free(meta, sizeof(npf_ext_rndblock_t));
94 }
95
96 /*
97 * npf_ext_rndblock: main routine implementing the extension functionality.
98 */
99 static bool
npf_ext_rndblock(npf_cache_t * npc,void * meta,const npf_match_info_t * mi,int * decision)100 npf_ext_rndblock(npf_cache_t *npc, void *meta, const npf_match_info_t *mi,
101 int *decision)
102 {
103 npf_ext_rndblock_t *rndblock = meta;
104 unsigned long c;
105
106 /* Skip, if already blocking. */
107 if (*decision == NPF_DECISION_BLOCK) {
108 return true;
109 }
110
111 /*
112 * Sample demo:
113 *
114 * Drop the packets according to the given module or percentage.
115 *
116 * Rule procedures may be executed concurrently in an SMP system.
117 * Use atomic operation to increment the counter.
118 */
119 c = atomic_inc_ulong_nv(&rndblock->counter);
120
121 if (rndblock->mod) {
122 if ((c % rndblock->mod) == 0) {
123 *decision = NPF_DECISION_BLOCK;
124 }
125 }
126
127 if (rndblock->percentage) {
128 uint32_t w = cprng_fast32() % PERCENTAGE_BASE;
129 if (w <= rndblock->percentage) {
130 *decision = NPF_DECISION_BLOCK;
131 }
132 }
133
134 return true;
135 }
136
137 __dso_public int
npf_ext_rndblock_init(npf_t * npf)138 npf_ext_rndblock_init(npf_t *npf)
139 {
140 static const npf_ext_ops_t npf_rndblock_ops = {
141 .version = NPFEXT_RNDBLOCK_VER,
142 .ctx = NULL,
143 .ctor = npf_ext_rndblock_ctor,
144 .dtor = npf_ext_rndblock_dtor,
145 .proc = npf_ext_rndblock
146 };
147
148 /*
149 * Initialize the NPF extension. Register the "rndblock" extension
150 * calls (constructor, destructor, the processing routine, etc).
151 */
152 npf_ext_rndblock_id = npf_ext_register(npf, "rndblock",
153 &npf_rndblock_ops);
154 return npf_ext_rndblock_id ? 0 : EEXIST;
155 }
156
157 __dso_public int
npf_ext_rndblock_fini(npf_t * npf)158 npf_ext_rndblock_fini(npf_t *npf)
159 {
160 /*
161 * Remove the rndblock extension. NPF may return an if there
162 * are active references and it cannot drain them.
163 */
164 return npf_ext_unregister(npf, npf_ext_rndblock_id);
165 }
166
167 #ifdef _KERNEL
168 /*
169 * Kernel module interface.
170 */
171 static int
npf_ext_rndblock_modcmd(modcmd_t cmd,void * arg)172 npf_ext_rndblock_modcmd(modcmd_t cmd, void *arg)
173 {
174 npf_t *npf = npf_getkernctx();
175
176 switch (cmd) {
177 case MODULE_CMD_INIT:
178 return npf_ext_rndblock_init(npf);
179 case MODULE_CMD_FINI:
180 return npf_ext_rndblock_fini(npf);
181 case MODULE_CMD_AUTOUNLOAD:
182 /* Allow auto-unload only if NPF permits it. */
183 return npf_autounload_p() ? 0 : EBUSY;
184 default:
185 return ENOTTY;
186 }
187 return 0;
188 }
189 #endif
190