sys/net/ipfw3/ip_fw3_sync.c

   1 /*
   2  * Copyright (c) 2016 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Bill Yuan <bycn82@dragonflybsd.org>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  */
  35
  36 #include <sys/types.h>
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/malloc.h>
  40 #include <sys/mbuf.h>
  41 #include <sys/kernel.h>
  42 #include <sys/proc.h>
  43 #include <sys/socket.h>
  44 #include <sys/socketvar.h>
  45 #include <sys/socketvar2.h>
  46 #include <sys/socketops.h>
  47 #include <sys/sysctl.h>
  48 #include <sys/syslog.h>
  49 #include <sys/ucred.h>
  50 #include <sys/in_cksum.h>
  51 #include <sys/lock.h>
  52 #include <sys/kthread.h>
  53 #include <sys/thread2.h>
  54 #include <sys/mplock2.h>
  55
  56 #include <netinet/in.h>
  57 #include <netinet/in_systm.h>
  58 #include <netinet/in_var.h>
  59 #include <netinet/in_pcb.h>
  60 #include <netinet/ip.h>
  61 #include <netinet/ip_var.h>
  62 #include <netinet/ip_icmp.h>
  63 #include <netinet/tcp.h>
  64 #include <netinet/tcp_timer.h>
  65 #include <netinet/tcp_var.h>
  66 #include <netinet/tcpip.h>
  67 #include <netinet/udp.h>
  68 #include <netinet/udp_var.h>
  69 #include <netinet/ip_divert.h>
  70 #include <netinet/if_ether.h>
  71
  72 #include <net/if.h>
  73 #include <net/route.h>
  74 #include <net/pfil.h>
  75 #include <net/netmsg2.h>
  76 #include <net/ethernet.h>
  77
  78 #include <net/ipfw3/ip_fw.h>
  79 #include <net/ipfw3/ip_fw3_sync.h>
  80
  81 MALLOC_DEFINE(M_IPFW3_SYNC, "IPFW3_SYNC", "mem for ipfw3sync");
  82
  83 extern struct ipfw_context *ipfw_ctx[MAXCPU];
  84 extern struct ipfw_sync_context sync_ctx;
  85 ipfw_sync_send_state_t *ipfw_sync_send_state_prt = NULL;
  86 ipfw_sync_install_state_t *ipfw_sync_install_state_prt = NULL;
  87
  88 /*
  89  * ipfw3sync show config
  90  */
  91 int
  92 ipfw_ctl_sync_show_conf(struct sockopt *sopt)
  93 {
  94         struct ipfw_ioc_sync_context *tmp_sync_ctx;
  95         int size;
  96
  97         size = 3 * sizeof(int) + sync_ctx.count * sizeof(struct ipfw_sync_edge);
  98         if (sopt->sopt_valsize < size) {
  99                 /* sopt_val is not big enough */
 100                 bzero(sopt->sopt_val, sopt->sopt_valsize);
 101                 return 0;
 102         }
 103         tmp_sync_ctx = (struct ipfw_ioc_sync_context *)sopt->sopt_val;
 104         tmp_sync_ctx->edge_port = sync_ctx.edge_port;
 105         tmp_sync_ctx->hw_same = sync_ctx.hw_same;
 106         tmp_sync_ctx->count = sync_ctx.count;
 107         bcopy(sync_ctx.edges, tmp_sync_ctx->edges,
 108                         sync_ctx.count * sizeof(struct ipfw_sync_edge));
 109         sopt->sopt_valsize = size;
 110         return 0;
 111 }
 112
 113 /*
 114  * ipfw3sync show status
 115  */
 116 int
 117 ipfw_ctl_sync_show_status(struct sockopt *sopt)
 118 {
 119         int *running;
 120         running = (int *)sopt->sopt_val;
 121         *running = sync_ctx.running;
 122         sopt->sopt_valsize = sizeof(int);
 123         return 0;
 124 }
 125 /*
 126  * ipfw3sync config centre
 127  */
 128 int
 129 ipfw_ctl_sync_centre_conf(struct sockopt *sopt)
 130 {
 131         struct ipfw_ioc_sync_centre *ioc_centre;
 132         int size;
 133
 134         ioc_centre = sopt->sopt_val;
 135         size = ioc_centre->count * sizeof(struct ipfw_sync_edge);
 136         if (sync_ctx.count == 0) {
 137                 sync_ctx.edges = kmalloc(size, M_IPFW3_SYNC, M_NOWAIT | M_ZERO);
 138         } else {
 139                 sync_ctx.edges = krealloc(sync_ctx.edges,
 140                                 size, M_TEMP, M_WAITOK);
 141         }
 142         sync_ctx.count = ioc_centre->count;
 143         bcopy(ioc_centre->edges, sync_ctx.edges,
 144                         ioc_centre->count * sizeof(struct ipfw_sync_edge));
 145         return 0;
 146 }
 147
 148 /*
 149  * ipfw3sync config edge
 150  */
 151 int
 152 ipfw_ctl_sync_edge_conf(struct sockopt *sopt)
 153 {
 154         struct ipfw_ioc_sync_edge *ioc_edge;
 155         size_t size;
 156
 157         size = sopt->sopt_valsize;
 158         ioc_edge = sopt->sopt_val;
 159         if (size != sizeof(struct ipfw_ioc_sync_edge)) {
 160                 return EINVAL;
 161         }
 162         sync_ctx.edge_port = ioc_edge->port;
 163         sync_ctx.hw_same = ioc_edge->hw_same;
 164         return 0;
 165 }
 166
 167 void
 168 sync_edge_socket_handler(void *dummy)
 169 {
 170         struct socket *so;
 171         struct sockbuf sio;
 172         struct sockaddr_in sin;
 173         struct mbuf *m;
 174         struct sockaddr *sa;
 175         int error, flags, *type;
 176
 177         so = sync_ctx.edge_sock;
 178         flags = MSG_FBLOCKING;
 179
 180         bzero(&sin, sizeof(struct sockaddr_in));
 181         sin.sin_family = AF_INET;
 182         sin.sin_port = htons(sync_ctx.edge_port);
 183         sin.sin_len = sizeof(struct sockaddr_in);
 184         sa = (struct sockaddr *)&sin;
 185         while (sync_ctx.running & 1) {
 186                 sbinit(&sio, 1000000000);
 187                 error = so_pru_soreceive(so, NULL, NULL, &sio, NULL, &flags);
 188                 if (error)
 189                         break;
 190                 m = sio.sb_mb;
 191                 type = (int *)m->m_data;
 192                 if (*type == SYNC_TYPE_SEND_TEST) {
 193                         struct cmd_send_test *cmd;
 194                         cmd = (struct cmd_send_test *)m->m_data;
 195                         kprintf("test received %d\n", cmd->num);
 196                 } else if (*type == SYNC_TYPE_SEND_STATE) {
 197                         struct cmd_send_state *cmd;
 198                         cmd = (struct cmd_send_state *)m->m_data;
 199                         if (ipfw_sync_install_state_prt != NULL) {
 200                                 (*ipfw_sync_install_state_prt)(cmd);
 201                         }
 202                 } else if (*type == SYNC_TYPE_SEND_NAT) {
 203                         /* TODO sync NAT records */
 204                         kprintf("nat received\n");
 205                 } else {
 206                         kprintf("Error ignore\n");
 207                 }
 208         }
 209         soshutdown(sync_ctx.edge_sock, SHUT_RD);
 210         sofree(sync_ctx.edge_sock);
 211         kthread_exit();
 212 }
 213
 214 int
 215 ipfw_ctl_sync_edge_start(struct sockopt *sopt)
 216 {
 217         struct sockaddr_in sin;
 218         struct thread *td;
 219         int error;
 220
 221         if (sync_ctx.running & 1) {
 222                 return 0;
 223         }
 224         td = curthread->td_proc ? curthread : &thread0;
 225         error = socreate(AF_INET, &sync_ctx.edge_sock,
 226                         SOCK_DGRAM, IPPROTO_UDP, td);
 227         if (error) {
 228                 kprintf("ipfw3sync edge socreate failed: %d\n", error);
 229                 return (error);
 230         }
 231
 232         bzero(&sin, sizeof(struct sockaddr_in));
 233         sin.sin_family = AF_INET;
 234         sin.sin_len = sizeof(struct sockaddr_in);
 235         sin.sin_port = htons(sync_ctx.edge_port);
 236         sin.sin_addr.s_addr = INADDR_ANY;
 237         error = sobind(sync_ctx.edge_sock, (struct sockaddr *)&sin, td);
 238         if (error) {
 239                 if (error != EADDRINUSE) {
 240                         kprintf("ipfw3sync edge sobind failed: %d\n", error);
 241                 } else {
 242                         kprintf("ipfw3sync edge address in use: %d\n", error);
 243                 }
 244                 return (error);
 245         }
 246
 247         sync_ctx.running |= 1;
 248         soreference(sync_ctx.edge_sock);
 249         error = kthread_create(sync_edge_socket_handler, NULL,
 250                         &sync_ctx.edge_td, "sync_edge_thread");
 251         if (error) {
 252                 panic("sync_edge_socket_handler:error %d",error);
 253         }
 254         return 0;
 255 }
 256
 257 int
 258 ipfw_ctl_sync_centre_start(struct sockopt *sopt)
 259 {
 260         struct sockaddr_in sin;
 261         struct thread *td;
 262         struct ipfw_sync_edge *edge;
 263         int error, i;
 264
 265         sync_ctx.running |= 2;
 266         td = curthread->td_proc ? curthread : &thread0;
 267
 268         for (i = 0; i < sync_ctx.count; i++) {
 269                 error = socreate(AF_INET, &sync_ctx.centre_socks[i],
 270                                 SOCK_DGRAM, IPPROTO_UDP, td);
 271                 if (error) {
 272                         kprintf("ipfw3sync centre socreate failed: %d\n",
 273                                         error);
 274                         return error;
 275                 }
 276                 edge = sync_ctx.edges;
 277
 278                 bzero(&sin, sizeof(struct sockaddr_in));
 279                 sin.sin_family = AF_INET;
 280                 sin.sin_port = htons(edge->port);
 281                 sin.sin_addr.s_addr = edge->addr;
 282                 sin.sin_len = sizeof(struct sockaddr_in);
 283                 error = soconnect(sync_ctx.centre_socks[i],
 284                                 (struct sockaddr *)&sin, td, TRUE);
 285                 if (error) {
 286                         kprintf("ipfw3sync: centre soconnect failed: %d\n",
 287                                         error);
 288                         return error;
 289                 }
 290         }
 291
 292         return 0;
 293 }
 294
 295 int
 296 ipfw_ctl_sync_edge_test(struct sockopt *sopt)
 297 {
 298         return 0;
 299 }
 300
 301 int
 302 ipfw_ctl_sync_centre_test(struct sockopt *sopt)
 303 {
 304         struct cmd_send_test cmd;
 305         struct mbuf *m;
 306         struct thread *td;
 307         int error, i, len, nsize, *num;
 308
 309         if (sopt->sopt_valsize != sizeof(int)) {
 310                 kprintf("ipfw3sync: invalid centre test parameter\n");
 311                 return -1;
 312         }
 313         if ((sync_ctx.running & 2) == 0) {
 314                 kprintf("ipfw3sync: centre not running\n");
 315                 return -1;
 316         }
 317         num = sopt->sopt_val;
 318         len = sizeof(struct cmd_send_test);
 319         m = m_getl(len, M_WAITOK, MT_DATA, M_PKTHDR, &nsize);
 320         if (m == NULL) {
 321                 kprintf("ipfw3sync: MGET failed\n");
 322                 return -1;
 323         }
 324         cmd.type = 0;
 325         cmd.num = *num;
 326         memcpy(m->m_data, &cmd, len);
 327
 328         m->m_len = len;
 329         m->m_pkthdr.len = len;
 330
 331         td = curthread->td_proc ? curthread : &thread0;
 332         for (i = 0; i < sync_ctx.count; i++) {
 333                 error = so_pru_sosend(sync_ctx.centre_socks[i],
 334                                 NULL, NULL, m, NULL, 0 ,td);
 335                 if (error) {
 336                         kprintf("ipfw3sync: centre sosend failed: %d\n", error);
 337                         return -1;
 338                 }
 339         }
 340         return 0;
 341 }
 342 int
 343 ipfw_ctl_sync_edge_stop(struct sockopt *sopt)
 344 {
 345         if (sync_ctx.running & 1) {
 346                 sync_ctx.running &= 2;
 347                 soclose(sync_ctx.edge_sock, 0);
 348         }
 349         return 0;
 350 }
 351
 352 int
 353 ipfw_ctl_sync_centre_stop(struct sockopt *sopt)
 354 {
 355         int i;
 356
 357         if (sync_ctx.running & 2) {
 358                 sync_ctx.running &= 1;
 359                 for (i = 0; i < sync_ctx.count; i++) {
 360                         soclose(sync_ctx.centre_socks[i], 0);
 361                 }
 362         }
 363         return 0;
 364 }
 365
 366 int
 367 ipfw_ctl_sync_edge_clear(struct sockopt *sopt)
 368 {
 369         return 0;
 370 }
 371
 372 int
 373 ipfw_ctl_sync_centre_clear(struct sockopt *sopt)
 374 {
 375         return 0;
 376 }
 377
 378 /*
 379  * sockopt handler
 380  */
 381 int
 382 ipfw_ctl_sync_sockopt(struct sockopt *sopt)
 383 {
 384         int error = 0;
 385         switch (sopt->sopt_name) {
 386                 case IP_FW_SYNC_EDGE_CONF:
 387                         error = ipfw_ctl_sync_edge_conf(sopt);
 388                         break;
 389                 case IP_FW_SYNC_CENTRE_CONF:
 390                         error = ipfw_ctl_sync_centre_conf(sopt);
 391                         break;
 392                 case IP_FW_SYNC_SHOW_CONF:
 393                         error = ipfw_ctl_sync_show_conf(sopt);
 394                         break;
 395                 case IP_FW_SYNC_SHOW_STATUS:
 396                         error = ipfw_ctl_sync_show_status(sopt);
 397                         break;
 398                 case IP_FW_SYNC_EDGE_START:
 399                         error = ipfw_ctl_sync_edge_start(sopt);
 400                         break;
 401                 case IP_FW_SYNC_CENTRE_START:
 402                         error = ipfw_ctl_sync_centre_start(sopt);
 403                         break;
 404                 case IP_FW_SYNC_EDGE_STOP:
 405                         error = ipfw_ctl_sync_edge_stop(sopt);
 406                         break;
 407                 case IP_FW_SYNC_CENTRE_STOP:
 408                         error = ipfw_ctl_sync_centre_stop(sopt);
 409                         break;
 410                 case IP_FW_SYNC_EDGE_CLEAR:
 411                         error = ipfw_ctl_sync_edge_clear(sopt);
 412                         break;
 413                 case IP_FW_SYNC_CENTRE_CLEAR:
 414                         error = ipfw_ctl_sync_centre_clear(sopt);
 415                         break;
 416                 case IP_FW_SYNC_EDGE_TEST:
 417                         error = ipfw_ctl_sync_edge_test(sopt);
 418                         break;
 419                 case IP_FW_SYNC_CENTRE_TEST:
 420                         error = ipfw_ctl_sync_centre_test(sopt);
 421                         break;
 422                 default:
 423                         kprintf("ipfw3 sync invalid socket option %d\n",
 424                                         sopt->sopt_name);
 425         }
 426         return error;
 427 }
 428
 429 void
 430 ipfw_sync_send_state(struct ip_fw_state *state, int cpu, int hash)
 431 {
 432         struct mbuf *m;
 433         struct thread *td;
 434         int error, i, len, nsize;
 435         struct cmd_send_state cmd;
 436
 437         if ((sync_ctx.running & 2) == 0) {
 438                 /* ipfw3sync: centre not running */
 439                 return;
 440         }
 441         len = sizeof(struct cmd_send_state);
 442         m = m_getl(len, M_WAITOK, MT_DATA, M_PKTHDR, &nsize);
 443         if (m == NULL) {
 444                 kprintf("ipfw3sync: MGET failed\n");
 445                 return;
 446         }
 447
 448         cmd.type = 1;
 449         cmd.rulenum = state->stub->rulenum;
 450         cmd.lifetime = state->lifetime;
 451         cmd.expiry = state->expiry;
 452         cmd.cpu = cpu;
 453         cmd.hash = hash;
 454
 455         memcpy(&cmd.flow, &state->flow_id, sizeof(struct ipfw_flow_id));
 456         memcpy(m->m_data, &cmd, len);
 457
 458         m->m_len = len;
 459         m->m_pkthdr.len = len;
 460
 461         td = curthread->td_proc ? curthread : &thread0;
 462         for (i = 0; i < sync_ctx.count; i++) {
 463                 error = so_pru_sosend(sync_ctx.centre_socks[i],
 464                                 NULL, NULL, m, NULL, 0 ,td);
 465                 if (error) {
 466                         kprintf("ipfw3sync: centre sosend failed: %d\n", error);
 467                         return;
 468                 }
 469         }
 470         return;
 471 }
 472
 473 void
 474 ipfw3_sync_modevent(int type)
 475 {
 476         switch (type) {
 477                 case MOD_LOAD:
 478                         ipfw_sync_send_state_prt = ipfw_sync_send_state;
 479                         break;
 480                 case MOD_UNLOAD:
 481                         if (sync_ctx.edges != NULL) {
 482                                 kfree(sync_ctx.edges, M_IPFW3_SYNC);
 483                         }
 484                         if (sync_ctx.running & 1) {
 485                                 sync_ctx.running = 0;
 486                                 soclose(sync_ctx.edge_sock, 0);
 487                                 sync_ctx.edge_td = NULL;
 488                         }
 489                         if (sync_ctx.running & 2) {
 490                                 int i;
 491                                 for (i = 0; i < sync_ctx.count; i++) {
 492                                         soclose(sync_ctx.centre_socks[i], 0);
 493                                 }
 494                         }
 495                         break;
 496                 default:
 497                         break;
 498         }
 499 }