NetBSD/sys/net/npf/npf_state.c

/*-
 * Copyright (c) 2010-2012 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This material is based upon work partially supported by The
 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * NPF state engine to track connection.
 */

#ifdef _KERNEL
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: npf_state.c,v 1.23 2020/05/30 14:16:56 rmind Exp $");

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/mutex.h>
#endif

#include "npf_impl.h"

/*
 * Generic connection states and timeout table.
 *
 * Note: used for connection-less protocols.
 */

#define	NPF_ANY_CONN_CLOSED		0
#define	NPF_ANY_CONN_NEW		1
#define	NPF_ANY_CONN_ESTABLISHED	2
#define	NPF_ANY_CONN_NSTATES		3

/*
 * Parameters.
 */
typedef struct {
	int		timeouts[NPF_ANY_CONN_NSTATES];
	int		gre_timeout;
} npf_state_params_t;

/*
 * Generic FSM.
 */
static const uint8_t npf_generic_fsm[NPF_ANY_CONN_NSTATES][2] = {
	[NPF_ANY_CONN_CLOSED] = {
		[NPF_FLOW_FORW]		= NPF_ANY_CONN_NEW,
	},
	[NPF_ANY_CONN_NEW] = {
		[NPF_FLOW_FORW]		= NPF_ANY_CONN_NEW,
		[NPF_FLOW_BACK]		= NPF_ANY_CONN_ESTABLISHED,
	},
	[NPF_ANY_CONN_ESTABLISHED] = {
		[NPF_FLOW_FORW]		= NPF_ANY_CONN_ESTABLISHED,
		[NPF_FLOW_BACK]		= NPF_ANY_CONN_ESTABLISHED,
	},
};

/*
 * State sampler for debugging.
 */
#if defined(_NPF_TESTING)
static void (*npf_state_sample)(npf_state_t *, bool) = NULL;
#define	NPF_STATE_SAMPLE(n, r) if (npf_state_sample) (*npf_state_sample)(n, r);
#else
#define	NPF_STATE_SAMPLE(n, r)
#endif

void
npf_state_sysinit(npf_t *npf)
{
	npf_state_params_t *params = npf_param_allocgroup(npf,
	    NPF_PARAMS_GENERIC_STATE, sizeof(npf_state_params_t));
	npf_param_t param_map[] = {
		/*
		 * Generic timeout (in seconds).
		 */
		{
			"state.generic.timeout.closed",
			&params->timeouts[NPF_ANY_CONN_CLOSED],
			.default_val = 0,
			.min = 0, .max = INT_MAX
		},
		{
			"state.generic.timeout.new",
			&params->timeouts[NPF_ANY_CONN_NEW],
			.default_val = 30,
			.min = 0, .max = INT_MAX
		},
		{
			"state.generic.timeout.established",
			&params->timeouts[NPF_ANY_CONN_ESTABLISHED],
			.default_val = 60,
			.min = 0, .max = INT_MAX
		},
		{
			"state.generic.timeout.gre",
			&params->gre_timeout,
			.default_val = 24 * 60 * 60,
			.min = 0, .max = INT_MAX
		},
	};
	npf_param_register(npf, param_map, __arraycount(param_map));
	npf_state_tcp_sysinit(npf);
}

void
npf_state_sysfini(npf_t *npf)
{
	const size_t len = sizeof(npf_state_params_t);
	npf_param_freegroup(npf, NPF_PARAMS_GENERIC_STATE, len);
	npf_state_tcp_sysfini(npf);
}

/*
 * npf_state_init: initialise the state structure.
 *
 * Should normally be called on a first packet, which also determines the
 * direction in a case of connection-orientated protocol.  Returns true on
 * success and false otherwise (e.g. if protocol is not supported).
 */
bool
npf_state_init(npf_cache_t *npc, npf_state_t *nst)
{
	const int proto = npc->npc_proto;
	bool ret;

	KASSERT(npf_iscached(npc, NPC_IP46));
	KASSERT(npf_iscached(npc, NPC_LAYER4));

	memset(nst, 0, sizeof(npf_state_t));

	switch (proto) {
	case IPPROTO_TCP:
		/* Pass to TCP state tracking engine. */
		ret = npf_state_tcp(npc, nst, NPF_FLOW_FORW);
		break;
	case IPPROTO_UDP:
	case IPPROTO_ICMP:
	case IPPROTO_GRE:
		/* Generic. */
		nst->nst_state = npf_generic_fsm[nst->nst_state][NPF_FLOW_FORW];
		ret = true;
		break;
	default:
		ret = false;
	}
	NPF_STATE_SAMPLE(nst, ret);
	return ret;
}

void
npf_state_destroy(npf_state_t *nst)
{
	nst->nst_state = 0;
}

/*
 * npf_state_inspect: inspect the packet according to the protocol state.
 *
 * Return true if packet is considered to match the state (e.g. for TCP,
 * the packet belongs to the tracked connection) and false otherwise.
 */
bool
npf_state_inspect(npf_cache_t *npc, npf_state_t *nst, const npf_flow_t flow)
{
	const int proto = npc->npc_proto;
	bool ret;

	switch (proto) {
	case IPPROTO_TCP:
		/* Pass to TCP state tracking engine. */
		ret = npf_state_tcp(npc, nst, flow);
		break;
	case IPPROTO_UDP:
	case IPPROTO_ICMP:
	case IPPROTO_GRE:
		/* Generic. */
		nst->nst_state = npf_generic_fsm[nst->nst_state][flow];
		ret = true;
		break;
	default:
		ret = false;
	}
	NPF_STATE_SAMPLE(nst, ret);

	return ret;
}

/*
 * npf_state_etime: return the expiration time depending on the state.
 */
int
npf_state_etime(npf_t *npf, const npf_state_t *nst, const int proto)
{
	const npf_state_params_t *params;
	const unsigned state = nst->nst_state;
	int timeout = 0;

	switch (proto) {
	case IPPROTO_TCP:
		/* Pass to TCP state tracking engine. */
		timeout = npf_state_tcp_timeout(npf, nst);
		break;
	case IPPROTO_UDP:
	case IPPROTO_ICMP:
		/* Generic. */
		params = npf->params[NPF_PARAMS_GENERIC_STATE];
		timeout = params->timeouts[state];
		break;
	case IPPROTO_GRE:
		params = npf->params[NPF_PARAMS_GENERIC_STATE];
		timeout = params->gre_timeout;
		break;
	default:
		KASSERT(false);
	}
	return timeout;
}

void
npf_state_dump(const npf_state_t *nst)
{
#if defined(DDB) || defined(_NPF_TESTING)
	const npf_tcpstate_t *fst = &nst->nst_tcpst[0];
	const npf_tcpstate_t *tst = &nst->nst_tcpst[1];

	printf("\tstate (%p) %d:\n\t\t"
	    "F { end %u maxend %u mwin %u wscale %u }\n\t\t"
	    "T { end %u maxend %u mwin %u wscale %u }\n",
	    nst, nst->nst_state,
	    fst->nst_end, fst->nst_maxend, fst->nst_maxwin, fst->nst_wscale,
	    tst->nst_end, tst->nst_maxend, tst->nst_maxwin, tst->nst_wscale
	);
#endif
}

#if defined(_NPF_TESTING)
void
npf_state_setsampler(void (*func)(npf_state_t *, bool))
{
	npf_state_sample = func;
}
#endif