npf_alg.c revision 1.5 
1/*	$NetBSD: npf_alg.c,v 1.5 2012/07/15 00:23:00 rmind Exp $	*/
2
3/*-
4 * Copyright (c) 2010 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This material is based upon work partially supported by The
8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32/*
33 * NPF interface for application level gateways (ALGs).
34 */
35
36#include <sys/cdefs.h>
37__KERNEL_RCSID(0, "$NetBSD: npf_alg.c,v 1.5 2012/07/15 00:23:00 rmind Exp $");
38
39#include <sys/param.h>
40#include <sys/types.h>
41
42#include <sys/kmem.h>
43#include <sys/pserialize.h>
44#include <sys/mutex.h>
45#include <net/pfil.h>
46
47#include "npf_impl.h"
48
49/* NAT ALG structure for registration. */
50struct npf_alg {
51	LIST_ENTRY(npf_alg)		na_entry;
52	npf_alg_t *			na_bptr;
53	npf_algfunc_t			na_match_func;
54	npf_algfunc_t			na_out_func;
55	npf_algfunc_t			na_in_func;
56	npf_algfunc_t			na_seid_func;
57};
58
59static LIST_HEAD(, npf_alg)		nat_alg_list	__cacheline_aligned;
60static kmutex_t				nat_alg_lock	__cacheline_aligned;
61static pserialize_t			nat_alg_psz	__cacheline_aligned;
62
63void
64npf_alg_sysinit(void)
65{
66
67	mutex_init(&nat_alg_lock, MUTEX_DEFAULT, IPL_NONE);
68	nat_alg_psz = pserialize_create();
69	LIST_INIT(&nat_alg_list);
70}
71
72void
73npf_alg_sysfini(void)
74{
75
76	KASSERT(LIST_EMPTY(&nat_alg_list));
77	pserialize_destroy(nat_alg_psz);
78	mutex_destroy(&nat_alg_lock);
79}
80
81/*
82 * npf_alg_register: register application-level gateway.
83 *
84 * XXX: Protected by module lock, but unify serialisation later.
85 */
86npf_alg_t *
87npf_alg_register(npf_algfunc_t match, npf_algfunc_t out, npf_algfunc_t in,
88    npf_algfunc_t seid)
89{
90	npf_alg_t *alg;
91
92	alg = kmem_zalloc(sizeof(npf_alg_t), KM_SLEEP);
93	alg->na_bptr = alg;
94	alg->na_match_func = match;
95	alg->na_out_func = out;
96	alg->na_in_func = in;
97	alg->na_seid_func = seid;
98
99	mutex_enter(&nat_alg_lock);
100	LIST_INSERT_HEAD(&nat_alg_list, alg, na_entry);
101	mutex_exit(&nat_alg_lock);
102
103	return alg;
104}
105
106/*
107 * npf_alg_unregister: unregister application-level gateway.
108 */
109int
110npf_alg_unregister(npf_alg_t *alg)
111{
112
113	mutex_enter(&nat_alg_lock);
114	LIST_REMOVE(alg, na_entry);
115	pserialize_perform(nat_alg_psz);
116	mutex_exit(&nat_alg_lock);
117
118	npf_core_enter();
119	npf_ruleset_freealg(npf_core_natset(), alg);
120	npf_core_exit();
121
122	kmem_free(alg, sizeof(npf_alg_t));
123	return 0;
124}
125
126/*
127 * npf_alg_match: call ALG matching inspectors, determine if any ALG matches.
128 */
129bool
130npf_alg_match(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt)
131{
132	npf_alg_t *alg;
133	bool match = false;
134	int s;
135
136	s = pserialize_read_enter();
137	LIST_FOREACH(alg, &nat_alg_list, na_entry) {
138		npf_algfunc_t func = alg->na_match_func;
139
140		if (func && func(npc, nbuf, nt)) {
141			match = true;
142			break;
143		}
144	}
145	pserialize_read_exit(s);
146	return match;
147}
148
149/*
150 * npf_alg_exec: execute ALG hooks for translation.
151 */
152void
153npf_alg_exec(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, const int di)
154{
155	npf_alg_t *alg;
156	int s;
157
158	s = pserialize_read_enter();
159	LIST_FOREACH(alg, &nat_alg_list, na_entry) {
160		if ((di & PFIL_OUT) != 0 && alg->na_out_func != NULL) {
161			(alg->na_out_func)(npc, nbuf, nt);
162			continue;
163		}
164		if ((di & PFIL_IN) != 0 && alg->na_in_func != NULL) {
165			(alg->na_in_func)(npc, nbuf, nt);
166			continue;
167		}
168	}
169	pserialize_read_exit(s);
170}
171
172bool
173npf_alg_sessionid(npf_cache_t *npc, nbuf_t *nbuf, npf_cache_t *key)
174{
175	npf_alg_t *alg;
176	bool nkey = false;
177	int s;
178
179	s = pserialize_read_enter();
180	LIST_FOREACH(alg, &nat_alg_list, na_entry) {
181		npf_algfunc_t func = alg->na_seid_func;
182
183		if (func && func(npc, nbuf, (npf_nat_t *)key)) {
184			nkey = true;
185			break;
186		}
187	}
188	pserialize_read_exit(s);
189	return nkey;
190}
191