Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/sys/net/npf NPF:
details: https://anonhg.NetBSD.org/src/rev/d8fb6f1d5a42
branches: trunk
changeset: 334660:d8fb6f1d5a42
user: rmind <rmind%NetBSD.org@localhost>
date: Sun Nov 30 00:40:55 2014 +0000
description:
NPF:
- npf_nat_import: take the port only if using the portmap.
- Sprinkle some comments and asserts.
diffstat:
sys/net/npf/npf_conn.c | 8 +++---
sys/net/npf/npf_conn.h | 4 +-
sys/net/npf/npf_nat.c | 19 +++++++++++---
sys/net/npf/npf_ruleset.c | 61 +++++++++++++++++++++++++++++++++++-----------
4 files changed, 67 insertions(+), 25 deletions(-)
diffs (264 lines):
diff -r f6848be64d6b -r d8fb6f1d5a42 sys/net/npf/npf_conn.c
--- a/sys/net/npf/npf_conn.c Sat Nov 29 20:18:44 2014 +0000
+++ b/sys/net/npf/npf_conn.c Sun Nov 30 00:40:55 2014 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_conn.c,v 1.12 2014/08/24 20:36:30 rmind Exp $ */
+/* $NetBSD: npf_conn.c,v 1.13 2014/11/30 00:40:55 rmind Exp $ */
/*-
* Copyright (c) 2014 Mindaugas Rasiukevicius <rmind at netbsd org>
@@ -99,7 +99,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.12 2014/08/24 20:36:30 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.13 2014/11/30 00:40:55 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -680,11 +680,11 @@
}
/*
- * npf_conn_retnat: return associated NAT data entry and indicate
+ * npf_conn_getnat: return associated NAT data entry and indicate
* whether it is a "forwards" or "backwards" stream.
*/
npf_nat_t *
-npf_conn_retnat(npf_conn_t *con, const int di, bool *forw)
+npf_conn_getnat(npf_conn_t *con, const int di, bool *forw)
{
KASSERT(con->c_refcnt > 0);
*forw = (con->c_flags & PFIL_ALL) == di;
diff -r f6848be64d6b -r d8fb6f1d5a42 sys/net/npf/npf_conn.h
--- a/sys/net/npf/npf_conn.h Sat Nov 29 20:18:44 2014 +0000
+++ b/sys/net/npf/npf_conn.h Sun Nov 30 00:40:55 2014 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_conn.h,v 1.6 2014/08/10 19:09:43 rmind Exp $ */
+/* $NetBSD: npf_conn.h,v 1.7 2014/11/30 00:40:55 rmind Exp $ */
/*-
* Copyright (c) 2009-2014 The NetBSD Foundation, Inc.
@@ -113,7 +113,7 @@
void npf_conn_setpass(npf_conn_t *, npf_rproc_t *);
int npf_conn_setnat(const npf_cache_t *, npf_conn_t *,
npf_nat_t *, u_int);
-npf_nat_t * npf_conn_retnat(npf_conn_t *, const int, bool *);
+npf_nat_t * npf_conn_getnat(npf_conn_t *, const int, bool *);
void npf_conn_gc(npf_conndb_t *, bool, bool);
int npf_conn_import(npf_conndb_t *, prop_dictionary_t,
npf_ruleset_t *);
diff -r f6848be64d6b -r d8fb6f1d5a42 sys/net/npf/npf_nat.c
--- a/sys/net/npf/npf_nat.c Sat Nov 29 20:18:44 2014 +0000
+++ b/sys/net/npf/npf_nat.c Sun Nov 30 00:40:55 2014 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_nat.c,v 1.35 2014/11/26 21:25:35 rmind Exp $ */
+/* $NetBSD: npf_nat.c,v 1.36 2014/11/30 00:40:55 rmind Exp $ */
/*-
* Copyright (c) 2014 Mindaugas Rasiukevicius <rmind at netbsd org>
@@ -71,7 +71,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.35 2014/11/26 21:25:35 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.36 2014/11/30 00:40:55 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -252,6 +252,7 @@
np->n_portmap = pm;
} else {
KASSERT(np->n_portmap != NULL);
+ KASSERT(np->n_portmap->p_refcnt > 0);
}
return np;
err:
@@ -417,6 +418,9 @@
u_int n = PORTMAP_SIZE, idx, bit;
uint32_t map, nmap;
+ KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
+ KASSERT(pm->p_refcnt > 0);
+
idx = cprng_fast32() % PORTMAP_SIZE;
for (;;) {
KASSERT(idx < PORTMAP_SIZE);
@@ -450,6 +454,9 @@
uint32_t map, nmap;
u_int idx, bit;
+ KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
+ KASSERT(pm->p_refcnt > 0);
+
port = ntohs(port) - PORTMAP_FIRST;
idx = port >> PORTMAP_SHIFT;
bit = port & PORTMAP_MASK;
@@ -474,6 +481,9 @@
uint32_t map, nmap;
u_int idx, bit;
+ KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
+ KASSERT(pm->p_refcnt > 0);
+
port = ntohs(port) - PORTMAP_FIRST;
idx = port >> PORTMAP_SHIFT;
bit = port & PORTMAP_MASK;
@@ -686,7 +696,7 @@
* Determines whether the stream is "forwards" or "backwards".
* Note: no need to lock, since reference on connection is held.
*/
- if (con && (nt = npf_conn_retnat(con, di, &forw)) != NULL) {
+ if (con && (nt = npf_conn_getnat(con, di, &forw)) != NULL) {
np = nt->nt_natpolicy;
goto translate;
}
@@ -874,7 +884,8 @@
prop_dictionary_get_uint16(natdict, "tport", &nt->nt_tport);
/* Take a specific port from port-map. */
- if (!npf_nat_takeport(np, nt->nt_tport)) {
+ if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport &
+ !npf_nat_takeport(np, nt->nt_tport)) {
pool_cache_put(nat_cache, nt);
return NULL;
}
diff -r f6848be64d6b -r d8fb6f1d5a42 sys/net/npf/npf_ruleset.c
--- a/sys/net/npf/npf_ruleset.c Sat Nov 29 20:18:44 2014 +0000
+++ b/sys/net/npf/npf_ruleset.c Sun Nov 30 00:40:55 2014 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: npf_ruleset.c,v 1.38 2014/11/26 21:25:35 rmind Exp $ */
+/* $NetBSD: npf_ruleset.c,v 1.39 2014/11/30 00:40:55 rmind Exp $ */
/*-
* Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.38 2014/11/26 21:25:35 rmind Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_ruleset.c,v 1.39 2014/11/30 00:40:55 rmind Exp $");
#include <sys/param.h>
#include <sys/types.h>
@@ -216,6 +216,9 @@
return rl;
}
+/*
+ * npf_ruleset_add: insert dynamic rule into the (active) ruleset.
+ */
int
npf_ruleset_add(npf_ruleset_t *rlset, const char *rname, npf_rule_t *rl)
{
@@ -273,6 +276,9 @@
return 0;
}
+/*
+ * npf_ruleset_remove: remove the dynamic rule given the rule ID.
+ */
int
npf_ruleset_remove(npf_ruleset_t *rlset, const char *rname, uint64_t id)
{
@@ -294,6 +300,9 @@
return ENOENT;
}
+/*
+ * npf_ruleset_remkey: remove the dynamic rule given the rule key.
+ */
int
npf_ruleset_remkey(npf_ruleset_t *rlset, const char *rname,
const void *key, size_t len)
@@ -320,6 +329,9 @@
return ENOENT;
}
+/*
+ * npf_ruleset_list: serialise and return the dynamic rules.
+ */
prop_dictionary_t
npf_ruleset_list(npf_ruleset_t *rlset, const char *rname)
{
@@ -363,6 +375,10 @@
return rgdict;
}
+/*
+ * npf_ruleset_flush: flush the dynamic rules in the ruleset by inserting
+ * them into the G/C list.
+ */
int
npf_ruleset_flush(npf_ruleset_t *rlset, const char *rname)
{
@@ -379,6 +395,23 @@
return 0;
}
+/*
+ * npf_ruleset_gc: destroy the rules in G/C list.
+ */
+void
+npf_ruleset_gc(npf_ruleset_t *rlset)
+{
+ npf_rule_t *rl;
+
+ while ((rl = LIST_FIRST(&rlset->rs_gc)) != NULL) {
+ LIST_REMOVE(rl, r_aentry);
+ npf_rule_free(rl);
+ }
+}
+
+/*
+ * npf_ruleset_export: serialise and return the static rules.
+ */
int
npf_ruleset_export(const npf_ruleset_t *rlset, prop_array_t rules)
{
@@ -409,20 +442,9 @@
return error;
}
-void
-npf_ruleset_gc(npf_ruleset_t *rlset)
-{
- npf_rule_t *rl;
-
- while ((rl = LIST_FIRST(&rlset->rs_gc)) != NULL) {
- LIST_REMOVE(rl, r_aentry);
- npf_rule_free(rl);
- }
-}
-
/*
* npf_ruleset_reload: prepare the new ruleset by scanning the active
- * ruleset and 1) sharing the dynamic rules 2) sharing NAT policies.
+ * ruleset and: 1) sharing the dynamic rules 2) sharing NAT policies.
*
* => The active (old) ruleset should be exclusively locked.
*/
@@ -515,13 +537,22 @@
newset->rs_idcnt = oldset->rs_idcnt;
}
+/*
+ * npf_ruleset_sharepm: attempt to share the active NAT portmap.
+ */
npf_rule_t *
npf_ruleset_sharepm(npf_ruleset_t *rlset, npf_natpolicy_t *mnp)
{
npf_natpolicy_t *np;
npf_rule_t *rl;
- /* Find a matching NAT policy in the old ruleset; skip the self. */
+ /*
+ * Scan the NAT policies in the ruleset and match with the
+ * given policy based on the translation IP address. If they
+ * match - adjust the given NAT policy to use the active NAT
+ * portmap. In such case the reference on the old portmap is
+ * dropped and acquired on the active one.
+ */
LIST_FOREACH(rl, &rlset->rs_all, r_aentry) {
np = rl->r_natp;
if (np == NULL || np == mnp)
Home |
Main Index |
Thread Index |
Old Index