1/*	$NetBSD: npf_conf.c,v 1.1 2013/02/09 03:35:31 rmind Exp $	*/
2
3/*-
4 * Copyright (c) 2013 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This material is based upon work partially supported by The
8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32/*
33 * NPF config loading mechanism.
34 *
35 * There are few main operations on the config:
36 * 1) Read access which is primarily from the npf_packet_handler() et al.
37 * 2) Write access on particular set, mainly rule or table updates.
38 * 3) Deletion of the config, which is done during the reload operation.
39 *
40 * Synchronisation
41 *
42 *	For (1) case, passive serialisation is used to allow concurrent
43 *	access to the configuration set (ruleset, etc).  It guarantees
44 *	that the config will not be destroyed while accessing it.
45 *
46 *	Writers, i.e. cases (2) and (3) use mutual exclusion and when
47 *	necessary writer-side barrier of the passive serialisation.
48 */
49
50#include <sys/cdefs.h>
51__KERNEL_RCSID(0, "$NetBSD: npf_conf.c,v 1.1 2013/02/09 03:35:31 rmind Exp $");
52
53#include <sys/param.h>
54#include <sys/types.h>
55
56#include <sys/atomic.h>
57#include <sys/kmem.h>
58#include <sys/pserialize.h>
59#include <sys/mutex.h>
60
61#include "npf_impl.h"
62
63typedef struct {
64	npf_ruleset_t *		n_rules;
65	npf_tableset_t *	n_tables;
66	npf_ruleset_t *		n_nat_rules;
67	npf_rprocset_t *	n_rprocs;
68	prop_dictionary_t	n_dict;
69	bool			n_default_pass;
70} npf_config_t;
71
72static npf_config_t *		npf_config		__cacheline_aligned;
73static kmutex_t			npf_config_lock		__cacheline_aligned;
74static pserialize_t		npf_config_psz		__cacheline_aligned;
75
76void
77npf_config_init(void)
78{
79	prop_dictionary_t dict;
80	npf_ruleset_t *rlset, *nset;
81	npf_rprocset_t *rpset;
82	npf_tableset_t *tset;
83
84	mutex_init(&npf_config_lock, MUTEX_DEFAULT, IPL_SOFTNET);
85	npf_config_psz = pserialize_create();
86
87	/* Load the empty configuration. */
88	dict = prop_dictionary_create();
89	tset = npf_tableset_create();
90	rpset = npf_rprocset_create();
91	rlset = npf_ruleset_create(0);
92	nset = npf_ruleset_create(0);
93	npf_config_reload(dict, rlset, tset, nset, rpset, true);
94	KASSERT(npf_config != NULL);
95}
96
97static void
98npf_config_destroy(npf_config_t *nc)
99{
100	prop_object_release(nc->n_dict);
101	npf_ruleset_destroy(nc->n_rules);
102	npf_ruleset_destroy(nc->n_nat_rules);
103	npf_rprocset_destroy(nc->n_rprocs);
104	npf_tableset_destroy(nc->n_tables);
105	kmem_free(nc, sizeof(npf_config_t));
106}
107
108void
109npf_config_fini(void)
110{
111	npf_config_destroy(npf_config);
112	pserialize_destroy(npf_config_psz);
113	mutex_destroy(&npf_config_lock);
114}
115
116/*
117 * npf_config_reload: the main routine performing configuration reload.
118 * Performs the necessary synchronisation and destroys the old config.
119 */
120void
121npf_config_reload(prop_dictionary_t dict, npf_ruleset_t *rset,
122    npf_tableset_t *tset, npf_ruleset_t *nset, npf_rprocset_t *rpset,
123    bool flush)
124{
125	npf_config_t *nc, *onc;
126
127	nc = kmem_zalloc(sizeof(npf_config_t), KM_SLEEP);
128	nc->n_rules = rset;
129	nc->n_tables = tset;
130	nc->n_nat_rules = nset;
131	nc->n_rprocs = rpset;
132	nc->n_dict = dict;
133	nc->n_default_pass = flush;
134
135	/*
136	 * Acquire the lock and perform the first phase:
137	 * - Scan and use existing dynamic tables, reload only static.
138	 * - Scan and use matching NAT policies to preserve the connections.
139	 */
140	mutex_enter(&npf_config_lock);
141	if ((onc = npf_config) != NULL) {
142		npf_ruleset_reload(rset, onc->n_rules);
143		npf_tableset_reload(tset, onc->n_tables);
144		npf_ruleset_natreload(nset, onc->n_nat_rules);
145	}
146
147	/*
148	 * Set the new config and release the lock.
149	 */
150	membar_sync();
151	npf_config = nc;
152	if (onc == NULL) {
153		/* Initial load, done. */
154		mutex_exit(&npf_config_lock);
155		return;
156	}
157
158	/* Synchronise: drain all references. */
159	pserialize_perform(npf_config_psz);
160	mutex_exit(&npf_config_lock);
161
162	/* Finally, it is safe to destroy the old config. */
163	npf_config_destroy(onc);
164}
165
166/*
167 * Writer-side exclusive locking.
168 */
169
170void
171npf_config_enter(void)
172{
173	mutex_enter(&npf_config_lock);
174}
175
176void
177npf_config_exit(void)
178{
179	mutex_exit(&npf_config_lock);
180}
181
182bool
183npf_config_locked_p(void)
184{
185	return mutex_owned(&npf_config_lock);
186}
187
188void
189npf_config_sync(void)
190{
191	KASSERT(npf_config_locked_p());
192	pserialize_perform(npf_config_psz);
193}
194
195/*
196 * Reader-side synchronisation routines.
197 */
198
199int
200npf_config_read_enter(void)
201{
202	return pserialize_read_enter();
203}
204
205void
206npf_config_read_exit(int s)
207{
208	pserialize_read_exit(s);
209}
210
211/*
212 * Accessors.
213 */
214
215npf_ruleset_t *
216npf_config_ruleset(void)
217{
218	return npf_config->n_rules;
219}
220
221npf_ruleset_t *
222npf_config_natset(void)
223{
224	return npf_config->n_nat_rules;
225}
226
227npf_tableset_t *
228npf_config_tableset(void)
229{
230	return npf_config->n_tables;
231}
232
233prop_dictionary_t
234npf_config_dict(void)
235{
236	return npf_config->n_dict;
237}
238
239bool
240npf_default_pass(void)
241{
242	return npf_config->n_default_pass;
243}
244