npf_alg.c revision 1.8 
1/*	$NetBSD: npf_alg.c,v 1.8 2013/03/20 00:29:47 christos Exp $	*/
2
3/*-
4 * Copyright (c) 2010 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This material is based upon work partially supported by The
8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32/*
33 * NPF interface for application level gateways (ALGs).
34 */
35
36#include <sys/cdefs.h>
37__KERNEL_RCSID(0, "$NetBSD: npf_alg.c,v 1.8 2013/03/20 00:29:47 christos Exp $");
38
39#include <sys/param.h>
40#include <sys/types.h>
41
42#include <sys/kmem.h>
43#include <sys/pserialize.h>
44#include <sys/mutex.h>
45#include <net/pfil.h>
46#include <sys/module.h>
47
48#include "npf_impl.h"
49
50/* NAT ALG structure for registration. */
51struct npf_alg {
52	LIST_ENTRY(npf_alg)	na_entry;
53	const char *		na_name;
54	npf_alg_t *		na_bptr;
55	npf_alg_func_t		na_match_func;
56	npf_alg_func_t		na_tr_func;
57	npf_alg_sfunc_t		na_se_func;
58};
59
60static LIST_HEAD(, npf_alg)	nat_alg_list	__cacheline_aligned;
61static kmutex_t			nat_alg_lock	__cacheline_aligned;
62static pserialize_t		nat_alg_psz	__cacheline_aligned;
63
64void
65npf_alg_sysinit(void)
66{
67
68	mutex_init(&nat_alg_lock, MUTEX_DEFAULT, IPL_NONE);
69	nat_alg_psz = pserialize_create();
70	LIST_INIT(&nat_alg_list);
71}
72
73void
74npf_alg_sysfini(void)
75{
76
77	KASSERT(LIST_EMPTY(&nat_alg_list));
78	pserialize_destroy(nat_alg_psz);
79	mutex_destroy(&nat_alg_lock);
80}
81
82static const char npf_alg_prefix[] = "npf_alg_";
83#define NPF_EXT_PREFLEN (sizeof(npf_alg_prefix) - 1)
84
85static npf_alg_t *
86npf_alg_lookup(const char *name, bool autoload)
87{
88	npf_alg_t *alg;
89	char modname[64 + NPF_EXT_PREFLEN];
90	int error;
91
92	KASSERT(mutex_owned(&nat_alg_lock));
93
94again:
95	LIST_FOREACH(alg, &nat_alg_list, na_entry)
96		if (strcmp(alg->na_name, name) == 0)
97			break;
98
99	if (alg != NULL || !autoload)
100		return alg;
101
102	mutex_exit(&nat_alg_lock);
103	autoload = false;
104	snprintf(modname, sizeof(modname), "%s%s", npf_alg_prefix, name);
105	error = module_autoload(modname, MODULE_CLASS_MISC);
106	mutex_enter(&nat_alg_lock);
107
108	if (error)
109		return NULL;
110	goto again;
111}
112
113npf_alg_t *
114npf_alg_construct(const char *name)
115{
116	npf_alg_t *alg;
117
118	mutex_enter(&nat_alg_lock);
119	alg = npf_alg_lookup(name, true);
120	mutex_exit(&nat_alg_lock);
121	return alg;
122}
123
124/*
125 * npf_alg_register: register application-level gateway.
126 */
127npf_alg_t *
128npf_alg_register(const char *name, npf_alg_func_t mfunc, npf_alg_func_t tfunc,
129    npf_alg_sfunc_t sfunc)
130{
131	npf_alg_t *alg;
132
133	alg = kmem_zalloc(sizeof(npf_alg_t), KM_SLEEP);
134	alg->na_name = name;
135	alg->na_bptr = alg;
136	alg->na_match_func = mfunc;
137	alg->na_tr_func = tfunc;
138	alg->na_se_func = sfunc;
139
140	mutex_enter(&nat_alg_lock);
141	if (npf_alg_lookup(name, false) != NULL) {
142		mutex_exit(&nat_alg_lock);
143		kmem_free(alg, sizeof(npf_alg_t));
144		return NULL;
145	}
146	LIST_INSERT_HEAD(&nat_alg_list, alg, na_entry);
147	mutex_exit(&nat_alg_lock);
148
149	return alg;
150}
151
152/*
153 * npf_alg_unregister: unregister application-level gateway.
154 */
155int
156npf_alg_unregister(npf_alg_t *alg)
157{
158	mutex_enter(&nat_alg_lock);
159	LIST_REMOVE(alg, na_entry);
160	pserialize_perform(nat_alg_psz);
161	mutex_exit(&nat_alg_lock);
162
163	npf_config_enter();
164	npf_ruleset_freealg(npf_config_natset(), alg);
165	npf_config_exit();
166
167	kmem_free(alg, sizeof(npf_alg_t));
168	return 0;
169}
170
171/*
172 * npf_alg_match: call ALG matching inspectors, determine if any ALG matches.
173 */
174bool
175npf_alg_match(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, int di)
176{
177	npf_alg_t *alg;
178	bool match = false;
179	int s;
180
181	s = pserialize_read_enter();
182	LIST_FOREACH(alg, &nat_alg_list, na_entry) {
183		npf_alg_func_t func = alg->na_match_func;
184
185		if (func && func(npc, nbuf, nt, di)) {
186			match = true;
187			break;
188		}
189	}
190	pserialize_read_exit(s);
191	return match;
192}
193
194/*
195 * npf_alg_exec: execute ALG hooks for translation.
196 */
197void
198npf_alg_exec(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, int di)
199{
200	npf_alg_t *alg;
201	int s;
202
203	s = pserialize_read_enter();
204	LIST_FOREACH(alg, &nat_alg_list, na_entry) {
205		npf_alg_func_t func;
206
207		if ((func = alg->na_tr_func) != NULL) {
208			(func)(npc, nbuf, nt, di);
209		}
210	}
211	pserialize_read_exit(s);
212}
213
214npf_session_t *
215npf_alg_session(npf_cache_t *npc, nbuf_t *nbuf, int di)
216{
217	npf_session_t *se = NULL;
218	npf_alg_t *alg;
219	int s;
220
221	s = pserialize_read_enter();
222	LIST_FOREACH(alg, &nat_alg_list, na_entry) {
223		npf_alg_sfunc_t func = alg->na_se_func;
224
225		if (func && (se = func(npc, nbuf, di)) != NULL) {
226			break;
227		}
228	}
229	pserialize_read_exit(s);
230	return se;
231}
232