/*- * Copyright (c) 2010-2012 The NetBSD Foundation, Inc. * All rights reserved. * * This material is based upon work partially supported by The * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ /* * NPF state engine to track connection. */ #ifdef _KERNEL #include __KERNEL_RCSID(0, "$NetBSD: npf_state.c,v 1.22.2.1 2020/06/20 15:46:47 martin Exp $"); #include #include #include #endif #include "npf_impl.h" /* * Generic connection states and timeout table. * * Note: used for connection-less protocols. */ #define NPF_ANY_CONN_CLOSED 0 #define NPF_ANY_CONN_NEW 1 #define NPF_ANY_CONN_ESTABLISHED 2 #define NPF_ANY_CONN_NSTATES 3 /* * Parameters. */ typedef struct { int timeouts[NPF_ANY_CONN_NSTATES]; int gre_timeout; } npf_state_params_t; /* * Generic FSM. */ static const uint8_t npf_generic_fsm[NPF_ANY_CONN_NSTATES][2] = { [NPF_ANY_CONN_CLOSED] = { [NPF_FLOW_FORW] = NPF_ANY_CONN_NEW, }, [NPF_ANY_CONN_NEW] = { [NPF_FLOW_FORW] = NPF_ANY_CONN_NEW, [NPF_FLOW_BACK] = NPF_ANY_CONN_ESTABLISHED, }, [NPF_ANY_CONN_ESTABLISHED] = { [NPF_FLOW_FORW] = NPF_ANY_CONN_ESTABLISHED, [NPF_FLOW_BACK] = NPF_ANY_CONN_ESTABLISHED, }, }; /* * State sampler for debugging. */ #if defined(_NPF_TESTING) static void (*npf_state_sample)(npf_state_t *, bool) = NULL; #define NPF_STATE_SAMPLE(n, r) if (npf_state_sample) (*npf_state_sample)(n, r); #else #define NPF_STATE_SAMPLE(n, r) #endif void npf_state_sysinit(npf_t *npf) { npf_state_params_t *params = npf_param_allocgroup(npf, NPF_PARAMS_GENERIC_STATE, sizeof(npf_state_params_t)); npf_param_t param_map[] = { /* * Generic timeout (in seconds). */ { "state.generic.timeout.closed", ¶ms->timeouts[NPF_ANY_CONN_CLOSED], .default_val = 0, .min = 0, .max = INT_MAX }, { "state.generic.timeout.new", ¶ms->timeouts[NPF_ANY_CONN_NEW], .default_val = 30, .min = 0, .max = INT_MAX }, { "state.generic.timeout.established", ¶ms->timeouts[NPF_ANY_CONN_ESTABLISHED], .default_val = 60, .min = 0, .max = INT_MAX }, { "state.generic.timeout.gre", ¶ms->gre_timeout, .default_val = 24 * 60 * 60, .min = 0, .max = INT_MAX }, }; npf_param_register(npf, param_map, __arraycount(param_map)); npf_state_tcp_sysinit(npf); } void npf_state_sysfini(npf_t *npf) { const size_t len = sizeof(npf_state_params_t); npf_param_freegroup(npf, NPF_PARAMS_GENERIC_STATE, len); npf_state_tcp_sysfini(npf); } /* * npf_state_init: initialise the state structure. * * Should normally be called on a first packet, which also determines the * direction in a case of connection-orientated protocol. Returns true on * success and false otherwise (e.g. if protocol is not supported). */ bool npf_state_init(npf_cache_t *npc, npf_state_t *nst) { const int proto = npc->npc_proto; bool ret; KASSERT(npf_iscached(npc, NPC_IP46)); KASSERT(npf_iscached(npc, NPC_LAYER4)); memset(nst, 0, sizeof(npf_state_t)); switch (proto) { case IPPROTO_TCP: /* Pass to TCP state tracking engine. */ ret = npf_state_tcp(npc, nst, NPF_FLOW_FORW); break; case IPPROTO_UDP: case IPPROTO_ICMP: case IPPROTO_GRE: /* Generic. */ nst->nst_state = npf_generic_fsm[nst->nst_state][NPF_FLOW_FORW]; ret = true; break; default: ret = false; } NPF_STATE_SAMPLE(nst, ret); return ret; } void npf_state_destroy(npf_state_t *nst) { nst->nst_state = 0; } /* * npf_state_inspect: inspect the packet according to the protocol state. * * Return true if packet is considered to match the state (e.g. for TCP, * the packet belongs to the tracked connection) and false otherwise. */ bool npf_state_inspect(npf_cache_t *npc, npf_state_t *nst, const npf_flow_t flow) { const int proto = npc->npc_proto; bool ret; switch (proto) { case IPPROTO_TCP: /* Pass to TCP state tracking engine. */ ret = npf_state_tcp(npc, nst, flow); break; case IPPROTO_UDP: case IPPROTO_ICMP: case IPPROTO_GRE: /* Generic. */ nst->nst_state = npf_generic_fsm[nst->nst_state][flow]; ret = true; break; default: ret = false; } NPF_STATE_SAMPLE(nst, ret); return ret; } /* * npf_state_etime: return the expiration time depending on the state. */ int npf_state_etime(npf_t *npf, const npf_state_t *nst, const int proto) { const npf_state_params_t *params; const unsigned state = nst->nst_state; int timeout = 0; switch (proto) { case IPPROTO_TCP: /* Pass to TCP state tracking engine. */ timeout = npf_state_tcp_timeout(npf, nst); break; case IPPROTO_UDP: case IPPROTO_ICMP: /* Generic. */ params = npf->params[NPF_PARAMS_GENERIC_STATE]; timeout = params->timeouts[state]; break; case IPPROTO_GRE: params = npf->params[NPF_PARAMS_GENERIC_STATE]; timeout = params->gre_timeout; break; default: KASSERT(false); } return timeout; } void npf_state_dump(const npf_state_t *nst) { #if defined(DDB) || defined(_NPF_TESTING) const npf_tcpstate_t *fst = &nst->nst_tcpst[0]; const npf_tcpstate_t *tst = &nst->nst_tcpst[1]; printf("\tstate (%p) %d:\n\t\t" "F { end %u maxend %u mwin %u wscale %u }\n\t\t" "T { end %u maxend %u mwin %u wscale %u }\n", nst, nst->nst_state, fst->nst_end, fst->nst_maxend, fst->nst_maxwin, fst->nst_wscale, tst->nst_end, tst->nst_maxend, tst->nst_maxwin, tst->nst_wscale ); #endif } #if defined(_NPF_TESTING) void npf_state_setsampler(void (*func)(npf_state_t *, bool)) { npf_state_sample = func; } #endif