1 /*-
2 * Copyright (c) 2019 Mindaugas Rasiukevicius <rmind at noxt eu>
3 * Copyright (c) 2013 The NetBSD Foundation, Inc.
4 * All rights reserved.
5 *
6 * This code is derived from software contributed to The NetBSD Foundation
7 * by Mindaugas Rasiukevicius.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 * POSSIBILITY OF SUCH DAMAGE.
29 */
30
31 /*
32 * NPF network interface handling.
33 *
34 * NPF uses its own interface IDs (npf-if-id). These IDs start from 1.
35 * Zero is reserved to indicate "no interface" case or an interface of
36 * no interest (i.e. not registered).
37 *
38 * This module provides an interface to primarily handle the following:
39 *
40 * - Bind a symbolic interface name to NPF interface ID.
41 * - Associate NPF interface ID when the network interface is attached.
42 *
43 * When NPF configuration is (re)loaded, each referenced network interface
44 * name is registered with a unique ID. If the network interface is already
45 * attached, then the ID is associated with it immediately; otherwise, IDs
46 * are associated/disassociated on interface events which are monitored
47 * using pfil(9) hooks.
48 *
49 * To avoid race conditions when an active NPF configuration is updated or
50 * interfaces are detached/attached, the interface names are never removed
51 * and therefore IDs are never re-assigned. The only point when interface
52 * names and IDs are cleared is when the configuration is flushed.
53 *
54 * A linear counter is used for IDs.
55 */
56
57 #ifdef _KERNEL
58 #include <sys/cdefs.h>
59 __KERNEL_RCSID(0, "$NetBSD: npf_if.c,v 1.13 2020/05/30 14:16:56 rmind Exp $");
60
61 #include <sys/param.h>
62 #include <sys/types.h>
63 #include <sys/kmem.h>
64 #include <net/if.h>
65 #endif
66
67 #include "npf_impl.h"
68
69 typedef struct npf_ifmap {
70 char ifname[IFNAMSIZ + 1];
71 } npf_ifmap_t;
72
73 #define NPF_IFMAP_NOID (0U)
74 #define NPF_IFMAP_SLOT2ID(npf, slot) ((npf)->ifmap_off + (slot) + 1)
75 #define NPF_IFMAP_ID2SLOT(npf, id) \
76 ((id) - atomic_load_relaxed(&(npf)->ifmap_off) - 1)
77
78 void
npf_ifmap_init(npf_t * npf,const npf_ifops_t * ifops)79 npf_ifmap_init(npf_t *npf, const npf_ifops_t *ifops)
80 {
81 const size_t nbytes = sizeof(npf_ifmap_t) * NPF_MAX_IFMAP;
82
83 KASSERT(ifops != NULL);
84 ifops->flush(npf, (void *)(uintptr_t)0);
85
86 mutex_init(&npf->ifmap_lock, MUTEX_DEFAULT, IPL_SOFTNET);
87 npf->ifmap = kmem_zalloc(nbytes, KM_SLEEP);
88 npf->ifmap_cnt = 0;
89 npf->ifmap_off = 0;
90 npf->ifops = ifops;
91 }
92
93 void
npf_ifmap_fini(npf_t * npf)94 npf_ifmap_fini(npf_t *npf)
95 {
96 const size_t nbytes = sizeof(npf_ifmap_t) * NPF_MAX_IFMAP;
97 mutex_destroy(&npf->ifmap_lock);
98 kmem_free(npf->ifmap, nbytes);
99 }
100
101 static unsigned
npf_ifmap_lookup(npf_t * npf,const char * ifname)102 npf_ifmap_lookup(npf_t *npf, const char *ifname)
103 {
104 KASSERT(mutex_owned(&npf->ifmap_lock));
105
106 for (unsigned i = 0; i < npf->ifmap_cnt; i++) {
107 npf_ifmap_t *ifmap = &npf->ifmap[i];
108
109 if (strcmp(ifmap->ifname, ifname) == 0) {
110 return NPF_IFMAP_SLOT2ID(npf, i);
111 }
112 }
113 return NPF_IFMAP_NOID;
114 }
115
116 /*
117 * npf_ifmap_register: register an interface name; return an assigned
118 * NPF network ID on success (non-zero).
119 *
120 * This routine is mostly called on NPF configuration (re)load for the
121 * interfaces names referenced by the rules.
122 */
123 unsigned
npf_ifmap_register(npf_t * npf,const char * ifname)124 npf_ifmap_register(npf_t *npf, const char *ifname)
125 {
126 npf_ifmap_t *ifmap;
127 unsigned id, i;
128 ifnet_t *ifp;
129
130 mutex_enter(&npf->ifmap_lock);
131 if ((id = npf_ifmap_lookup(npf, ifname)) != NPF_IFMAP_NOID) {
132 goto out;
133 }
134 if (npf->ifmap_cnt == NPF_MAX_IFMAP) {
135 printf("npf_ifmap_new: out of slots; bump NPF_MAX_IFMAP\n");
136 id = NPF_IFMAP_NOID;
137 goto out;
138 }
139 KASSERT(npf->ifmap_cnt < NPF_MAX_IFMAP);
140
141 /* Allocate a new slot and convert and assign an ID. */
142 i = npf->ifmap_cnt++;
143 ifmap = &npf->ifmap[i];
144 strlcpy(ifmap->ifname, ifname, IFNAMSIZ);
145 id = NPF_IFMAP_SLOT2ID(npf, i);
146
147 if ((ifp = npf->ifops->lookup(npf, ifname)) != NULL) {
148 npf->ifops->setmeta(npf, ifp, (void *)(uintptr_t)id);
149 }
150 out:
151 mutex_exit(&npf->ifmap_lock);
152 return id;
153 }
154
155 void
npf_ifmap_flush(npf_t * npf)156 npf_ifmap_flush(npf_t *npf)
157 {
158 mutex_enter(&npf->ifmap_lock);
159 npf->ifops->flush(npf, (void *)(uintptr_t)NPF_IFMAP_NOID);
160 for (unsigned i = 0; i < npf->ifmap_cnt; i++) {
161 npf->ifmap[i].ifname[0] = '\0';
162 }
163 npf->ifmap_cnt = 0;
164
165 /*
166 * Reset the ID counter if reaching the overflow; this is not
167 * realistic, but we maintain correctness.
168 */
169 if (npf->ifmap_off < (UINT_MAX - NPF_MAX_IFMAP)) {
170 npf->ifmap_off += NPF_MAX_IFMAP;
171 } else {
172 npf->ifmap_off = 0;
173 }
174 mutex_exit(&npf->ifmap_lock);
175 }
176
177 /*
178 * npf_ifmap_getid: get the ID for the given network interface.
179 *
180 * => This routine is typically called from the packet handler when
181 * matching whether the packet is on particular network interface.
182 *
183 * => This routine is lock-free; if the NPF configuration is flushed
184 * while the packet is in-flight, the ID will not match because we
185 * keep the IDs linear.
186 */
187 unsigned
npf_ifmap_getid(npf_t * npf,const ifnet_t * ifp)188 npf_ifmap_getid(npf_t *npf, const ifnet_t *ifp)
189 {
190 const unsigned id = (uintptr_t)npf->ifops->getmeta(npf, ifp);
191 return id;
192 }
193
194 /*
195 * npf_ifmap_copylogname: this function is toxic; it can return garbage
196 * as we don't lock, but it is only used temporarily and only for logging.
197 */
198 void
npf_ifmap_copylogname(npf_t * npf,unsigned id,char * buf,size_t len)199 npf_ifmap_copylogname(npf_t *npf, unsigned id, char *buf, size_t len)
200 {
201 const unsigned i = NPF_IFMAP_ID2SLOT(npf, id);
202
203 membar_consumer();
204
205 if (id != NPF_IFMAP_NOID && i < NPF_MAX_IFMAP) {
206 /*
207 * Lock-free access is safe as there is an extra byte
208 * with a permanent NUL terminator at the end.
209 */
210 const npf_ifmap_t *ifmap = &npf->ifmap[i];
211 strlcpy(buf, ifmap->ifname, MIN(len, IFNAMSIZ));
212 } else {
213 strlcpy(buf, "???", len);
214 }
215 }
216
217 void
npf_ifmap_copyname(npf_t * npf,unsigned id,char * buf,size_t len)218 npf_ifmap_copyname(npf_t *npf, unsigned id, char *buf, size_t len)
219 {
220 mutex_enter(&npf->ifmap_lock);
221 npf_ifmap_copylogname(npf, id, buf, len);
222 mutex_exit(&npf->ifmap_lock);
223 }
224
225 __dso_public void
npfk_ifmap_attach(npf_t * npf,ifnet_t * ifp)226 npfk_ifmap_attach(npf_t *npf, ifnet_t *ifp)
227 {
228 const npf_ifops_t *ifops = npf->ifops;
229 unsigned id;
230
231 mutex_enter(&npf->ifmap_lock);
232 id = npf_ifmap_lookup(npf, ifops->getname(npf, ifp));
233 ifops->setmeta(npf, ifp, (void *)(uintptr_t)id);
234 mutex_exit(&npf->ifmap_lock);
235 }
236
237 __dso_public void
npfk_ifmap_detach(npf_t * npf,ifnet_t * ifp)238 npfk_ifmap_detach(npf_t *npf, ifnet_t *ifp)
239 {
240 /* Diagnostic. */
241 mutex_enter(&npf->ifmap_lock);
242 npf->ifops->setmeta(npf, ifp, (void *)(uintptr_t)NPF_IFMAP_NOID);
243 mutex_exit(&npf->ifmap_lock);
244 }
245