pf_if.c revision 1.5.2.5
1 1.5.2.5 skrll /* $NetBSD: pf_if.c,v 1.5.2.5 2004/11/29 07:24:33 skrll Exp $ */ 2 1.5.2.5 skrll /* $OpenBSD: pf_if.c,v 1.20 2004/08/15 15:31:46 henning Exp $ */ 3 1.5.2.2 skrll 4 1.5.2.2 skrll /* 5 1.5.2.2 skrll * Copyright (c) 2001 Daniel Hartmeier 6 1.5.2.2 skrll * Copyright (c) 2003 Cedric Berger 7 1.5.2.2 skrll * All rights reserved. 8 1.5.2.2 skrll * 9 1.5.2.2 skrll * Redistribution and use in source and binary forms, with or without 10 1.5.2.2 skrll * modification, are permitted provided that the following conditions 11 1.5.2.2 skrll * are met: 12 1.5.2.2 skrll * 13 1.5.2.2 skrll * - Redistributions of source code must retain the above copyright 14 1.5.2.2 skrll * notice, this list of conditions and the following disclaimer. 15 1.5.2.2 skrll * - Redistributions in binary form must reproduce the above 16 1.5.2.2 skrll * copyright notice, this list of conditions and the following 17 1.5.2.2 skrll * disclaimer in the documentation and/or other materials provided 18 1.5.2.2 skrll * with the distribution. 19 1.5.2.2 skrll * 20 1.5.2.2 skrll * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 1.5.2.2 skrll * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 1.5.2.2 skrll * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 1.5.2.2 skrll * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 1.5.2.2 skrll * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 1.5.2.2 skrll * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 1.5.2.2 skrll * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 1.5.2.2 skrll * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 1.5.2.2 skrll * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 1.5.2.2 skrll * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 1.5.2.2 skrll * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 1.5.2.2 skrll * POSSIBILITY OF SUCH DAMAGE. 32 1.5.2.2 skrll */ 33 1.5.2.2 skrll 34 1.5.2.2 skrll #ifdef _KERNEL_OPT 35 1.5.2.2 skrll #include "opt_inet.h" 36 1.5.2.2 skrll #endif 37 1.5.2.2 skrll 38 1.5.2.2 skrll #include <sys/param.h> 39 1.5.2.2 skrll #include <sys/systm.h> 40 1.5.2.2 skrll #include <sys/mbuf.h> 41 1.5.2.2 skrll #include <sys/filio.h> 42 1.5.2.2 skrll #include <sys/socket.h> 43 1.5.2.2 skrll #include <sys/socketvar.h> 44 1.5.2.2 skrll #include <sys/kernel.h> 45 1.5.2.2 skrll #include <sys/device.h> 46 1.5.2.2 skrll #include <sys/time.h> 47 1.5.2.2 skrll 48 1.5.2.2 skrll #include <net/if.h> 49 1.5.2.2 skrll #include <net/if_types.h> 50 1.5.2.2 skrll 51 1.5.2.2 skrll #include <netinet/in.h> 52 1.5.2.2 skrll #include <netinet/in_var.h> 53 1.5.2.2 skrll #include <netinet/in_systm.h> 54 1.5.2.2 skrll #include <netinet/ip.h> 55 1.5.2.2 skrll #include <netinet/ip_var.h> 56 1.5.2.2 skrll 57 1.5.2.2 skrll #include <net/pfvar.h> 58 1.5.2.2 skrll 59 1.5.2.2 skrll #ifdef INET6 60 1.5.2.2 skrll #include <netinet/ip6.h> 61 1.5.2.2 skrll #endif /* INET6 */ 62 1.5.2.2 skrll 63 1.5.2.2 skrll #define ACCEPT_FLAGS(oklist) \ 64 1.5.2.2 skrll do { \ 65 1.5.2.2 skrll if ((flags & ~(oklist)) & \ 66 1.5.2.2 skrll PFI_FLAG_ALLMASK) \ 67 1.5.2.2 skrll return (EINVAL); \ 68 1.5.2.2 skrll } while (0) 69 1.5.2.2 skrll 70 1.5.2.2 skrll #define senderr(e) do { rv = (e); goto _bad; } while (0) 71 1.5.2.2 skrll 72 1.5.2.2 skrll struct pfi_kif **pfi_index2kif; 73 1.5.2.2 skrll struct pfi_kif *pfi_self; 74 1.5.2.2 skrll int pfi_indexlim; 75 1.5.2.2 skrll struct pfi_ifhead pfi_ifs; 76 1.5.2.2 skrll struct pfi_statehead pfi_statehead; 77 1.5.2.2 skrll int pfi_ifcnt; 78 1.5.2.2 skrll struct pool pfi_addr_pl; 79 1.5.2.2 skrll long pfi_update = 1; 80 1.5.2.2 skrll struct pfr_addr *pfi_buffer; 81 1.5.2.2 skrll int pfi_buffer_cnt; 82 1.5.2.2 skrll int pfi_buffer_max; 83 1.5.2.2 skrll 84 1.5.2.2 skrll void pfi_dynaddr_update(void *); 85 1.5.2.2 skrll void pfi_kifaddr_update(void *); 86 1.5.2.2 skrll #ifdef __NetBSD__ 87 1.5.2.2 skrll void pfi_kifaddr_update_if(struct ifnet *); 88 1.5.2.2 skrll #endif 89 1.5.2.2 skrll void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, 90 1.5.2.2 skrll int, int); 91 1.5.2.2 skrll void pfi_instance_add(struct ifnet *, int, int); 92 1.5.2.2 skrll void pfi_address_add(struct sockaddr *, int, int); 93 1.5.2.2 skrll int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 94 1.5.2.2 skrll struct pfi_kif *pfi_if_create(const char *, struct pfi_kif *, int); 95 1.5.2.2 skrll void pfi_copy_group(char *, const char *, int); 96 1.5.2.2 skrll void pfi_newgroup(const char *, int); 97 1.5.2.2 skrll int pfi_skip_if(const char *, struct pfi_kif *, int); 98 1.5.2.2 skrll int pfi_unmask(void *); 99 1.5.2.2 skrll void pfi_dohooks(struct pfi_kif *); 100 1.5.2.2 skrll 101 1.5.2.2 skrll RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 102 1.5.2.2 skrll RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 103 1.5.2.2 skrll 104 1.5.2.2 skrll #define PFI_BUFFER_MAX 0x10000 105 1.5.2.2 skrll #define PFI_MTYPE M_IFADDR 106 1.5.2.2 skrll 107 1.5.2.2 skrll #ifdef __NetBSD__ 108 1.5.2.2 skrll static void *hook_establish(struct hook_desc_head *, int, void (*)(void *), 109 1.5.2.2 skrll void *); 110 1.5.2.2 skrll static void hook_disestablish(struct hook_desc_head *, void *); 111 1.5.2.2 skrll static void dohooks(struct hook_desc_head *, int); 112 1.5.2.2 skrll 113 1.5.2.2 skrll #define HOOK_REMOVE 0x01 114 1.5.2.2 skrll #define HOOK_FREE 0x02 115 1.5.2.2 skrll #endif 116 1.5.2.2 skrll 117 1.5.2.2 skrll void 118 1.5.2.2 skrll pfi_initialize(void) 119 1.5.2.2 skrll { 120 1.5.2.2 skrll if (pfi_self != NULL) /* already initialized */ 121 1.5.2.2 skrll return; 122 1.5.2.2 skrll 123 1.5.2.2 skrll TAILQ_INIT(&pfi_statehead); 124 1.5.2.2 skrll pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0, 125 1.5.2.2 skrll "pfiaddrpl", &pool_allocator_nointr); 126 1.5.2.2 skrll pfi_buffer_max = 64; 127 1.5.2.2 skrll pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer), 128 1.5.2.2 skrll PFI_MTYPE, M_WAITOK); 129 1.5.2.2 skrll pfi_self = pfi_if_create("self", NULL, PFI_IFLAG_GROUP); 130 1.5.2.2 skrll } 131 1.5.2.2 skrll 132 1.5.2.2 skrll #ifdef _LKM 133 1.5.2.2 skrll void 134 1.5.2.2 skrll pfi_destroy(void) 135 1.5.2.2 skrll { 136 1.5.2.2 skrll struct pfi_kif *p; 137 1.5.2.2 skrll 138 1.5.2.2 skrll while ((p = TAILQ_FIRST(&pfi_statehead)) != NULL) { 139 1.5.2.2 skrll TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 140 1.5.2.2 skrll free(p, PFI_MTYPE); 141 1.5.2.2 skrll } 142 1.5.2.2 skrll pool_destroy(&pfi_addr_pl); 143 1.5.2.2 skrll 144 1.5.2.2 skrll pfi_self = NULL; 145 1.5.2.2 skrll } 146 1.5.2.2 skrll #endif 147 1.5.2.2 skrll 148 1.5.2.2 skrll void 149 1.5.2.2 skrll pfi_attach_clone(struct if_clone *ifc) 150 1.5.2.2 skrll { 151 1.5.2.2 skrll pfi_initialize(); 152 1.5.2.2 skrll pfi_newgroup(ifc->ifc_name, PFI_IFLAG_CLONABLE); 153 1.5.2.2 skrll } 154 1.5.2.2 skrll 155 1.5.2.2 skrll void 156 1.5.2.2 skrll pfi_attach_ifnet(struct ifnet *ifp) 157 1.5.2.2 skrll { 158 1.5.2.2 skrll struct pfi_kif *p, *q, key; 159 1.5.2.2 skrll int s; 160 1.5.2.2 skrll 161 1.5.2.2 skrll pfi_initialize(); 162 1.5.2.2 skrll s = splsoftnet(); 163 1.5.2.2 skrll pfi_update++; 164 1.5.2.2 skrll if (ifp->if_index >= pfi_indexlim) { 165 1.5.2.2 skrll /* 166 1.5.2.2 skrll * grow pfi_index2kif, similar to ifindex2ifnet code in if.c 167 1.5.2.2 skrll */ 168 1.5.2.2 skrll size_t m, n, oldlim; 169 1.5.2.2 skrll struct pfi_kif **mp, **np; 170 1.5.2.2 skrll 171 1.5.2.2 skrll oldlim = pfi_indexlim; 172 1.5.2.2 skrll if (pfi_indexlim == 0) 173 1.5.2.2 skrll pfi_indexlim = 64; 174 1.5.2.2 skrll while (ifp->if_index >= pfi_indexlim) 175 1.5.2.2 skrll pfi_indexlim <<= 1; 176 1.5.2.2 skrll 177 1.5.2.2 skrll m = oldlim * sizeof(struct pfi_kif *); 178 1.5.2.2 skrll mp = pfi_index2kif; 179 1.5.2.2 skrll n = pfi_indexlim * sizeof(struct pfi_kif *); 180 1.5.2.2 skrll np = malloc(n, PFI_MTYPE, M_DONTWAIT); 181 1.5.2.2 skrll if (np == NULL) 182 1.5.2.2 skrll panic("pfi_attach_ifnet: " 183 1.5.2.2 skrll "cannot allocate translation table"); 184 1.5.2.2 skrll bzero(np, n); 185 1.5.2.2 skrll if (mp != NULL) 186 1.5.2.2 skrll bcopy(mp, np, m); 187 1.5.2.2 skrll pfi_index2kif = np; 188 1.5.2.2 skrll if (mp != NULL) 189 1.5.2.2 skrll free(mp, PFI_MTYPE); 190 1.5.2.2 skrll } 191 1.5.2.2 skrll 192 1.5.2.2 skrll strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 193 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 194 1.5.2.2 skrll if (p == NULL) { 195 1.5.2.2 skrll /* add group */ 196 1.5.2.2 skrll pfi_copy_group(key.pfik_name, ifp->if_xname, 197 1.5.2.2 skrll sizeof(key.pfik_name)); 198 1.5.2.2 skrll q = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 199 1.5.2.2 skrll if (q == NULL) 200 1.5.2.2 skrll q = pfi_if_create(key.pfik_name, pfi_self, PFI_IFLAG_GROUP); 201 1.5.2.2 skrll if (q == NULL) 202 1.5.2.2 skrll panic("pfi_attach_ifnet: " 203 1.5.2.2 skrll "cannot allocate '%s' group", key.pfik_name); 204 1.5.2.2 skrll 205 1.5.2.2 skrll /* add interface */ 206 1.5.2.2 skrll p = pfi_if_create(ifp->if_xname, q, PFI_IFLAG_INSTANCE); 207 1.5.2.2 skrll if (p == NULL) 208 1.5.2.2 skrll panic("pfi_attach_ifnet: " 209 1.5.2.2 skrll "cannot allocate '%s' interface", ifp->if_xname); 210 1.5.2.2 skrll } else 211 1.5.2.2 skrll q = p->pfik_parent; 212 1.5.2.2 skrll p->pfik_ifp = ifp; 213 1.5.2.2 skrll p->pfik_flags |= PFI_IFLAG_ATTACHED; 214 1.5.2.2 skrll #ifdef __OpenBSD__ 215 1.5.2.2 skrll p->pfik_ah_cookie = 216 1.5.2.2 skrll hook_establish(ifp->if_addrhooks, 1, pfi_kifaddr_update, p); 217 1.5.2.2 skrll #else 218 1.5.2.2 skrll p->pfik_ah_cookie = 219 1.5.2.2 skrll hook_establish(p->pfik_ifaddrhooks, 1, pfi_kifaddr_update, p); 220 1.5.2.2 skrll #endif 221 1.5.2.2 skrll pfi_index2kif[ifp->if_index] = p; 222 1.5.2.2 skrll pfi_dohooks(p); 223 1.5.2.2 skrll splx(s); 224 1.5.2.2 skrll } 225 1.5.2.2 skrll 226 1.5.2.2 skrll void 227 1.5.2.2 skrll pfi_detach_ifnet(struct ifnet *ifp) 228 1.5.2.2 skrll { 229 1.5.2.2 skrll struct pfi_kif *p, *q, key; 230 1.5.2.2 skrll int s; 231 1.5.2.2 skrll 232 1.5.2.2 skrll strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 233 1.5.2.2 skrll 234 1.5.2.2 skrll s = splsoftnet(); 235 1.5.2.2 skrll pfi_update++; 236 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 237 1.5.2.2 skrll if (p == NULL) { 238 1.5.2.2 skrll printf("pfi_detach_ifnet: cannot find %s", ifp->if_xname); 239 1.5.2.2 skrll splx(s); 240 1.5.2.2 skrll return; 241 1.5.2.2 skrll } 242 1.5.2.2 skrll #ifdef __OpenBSD__ 243 1.5.2.2 skrll hook_disestablish(p->pfik_ifp->if_addrhooks, p->pfik_ah_cookie); 244 1.5.2.2 skrll #else 245 1.5.2.2 skrll hook_disestablish(p->pfik_ifaddrhooks, p->pfik_ah_cookie); 246 1.5.2.2 skrll #endif 247 1.5.2.2 skrll q = p->pfik_parent; 248 1.5.2.2 skrll p->pfik_ifp = NULL; 249 1.5.2.2 skrll p->pfik_flags &= ~PFI_IFLAG_ATTACHED; 250 1.5.2.2 skrll pfi_index2kif[ifp->if_index] = NULL; 251 1.5.2.2 skrll pfi_dohooks(p); 252 1.5.2.2 skrll pfi_maybe_destroy(p); 253 1.5.2.2 skrll splx(s); 254 1.5.2.2 skrll } 255 1.5.2.2 skrll 256 1.5.2.2 skrll struct pfi_kif * 257 1.5.2.2 skrll pfi_lookup_create(const char *name) 258 1.5.2.2 skrll { 259 1.5.2.2 skrll struct pfi_kif *p, *q, key; 260 1.5.2.2 skrll int s; 261 1.5.2.2 skrll 262 1.5.2.2 skrll s = splsoftnet(); 263 1.5.2.2 skrll p = pfi_lookup_if(name); 264 1.5.2.2 skrll if (p == NULL) { 265 1.5.2.2 skrll pfi_copy_group(key.pfik_name, name, sizeof(key.pfik_name)); 266 1.5.2.2 skrll q = pfi_lookup_if(key.pfik_name); 267 1.5.2.5 skrll if (q == NULL) { 268 1.5.2.5 skrll pfi_newgroup(key.pfik_name, PFI_IFLAG_DYNAMIC); 269 1.5.2.5 skrll q = pfi_lookup_if(key.pfik_name); 270 1.5.2.5 skrll } 271 1.5.2.5 skrll p = pfi_lookup_if(name); 272 1.5.2.5 skrll if (p == NULL && q != NULL) 273 1.5.2.2 skrll p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE); 274 1.5.2.2 skrll } 275 1.5.2.2 skrll splx(s); 276 1.5.2.2 skrll return (p); 277 1.5.2.2 skrll } 278 1.5.2.2 skrll 279 1.5.2.2 skrll struct pfi_kif * 280 1.5.2.2 skrll pfi_attach_rule(const char *name) 281 1.5.2.2 skrll { 282 1.5.2.2 skrll struct pfi_kif *p; 283 1.5.2.2 skrll 284 1.5.2.2 skrll p = pfi_lookup_create(name); 285 1.5.2.2 skrll if (p != NULL) 286 1.5.2.2 skrll p->pfik_rules++; 287 1.5.2.2 skrll return (p); 288 1.5.2.2 skrll } 289 1.5.2.2 skrll 290 1.5.2.2 skrll void 291 1.5.2.2 skrll pfi_detach_rule(struct pfi_kif *p) 292 1.5.2.2 skrll { 293 1.5.2.2 skrll if (p == NULL) 294 1.5.2.2 skrll return; 295 1.5.2.2 skrll if (p->pfik_rules > 0) 296 1.5.2.2 skrll p->pfik_rules--; 297 1.5.2.2 skrll else 298 1.5.2.2 skrll printf("pfi_detach_rule: reference count at 0\n"); 299 1.5.2.2 skrll pfi_maybe_destroy(p); 300 1.5.2.2 skrll } 301 1.5.2.2 skrll 302 1.5.2.2 skrll void 303 1.5.2.2 skrll pfi_attach_state(struct pfi_kif *p) 304 1.5.2.2 skrll { 305 1.5.2.2 skrll if (!p->pfik_states++) 306 1.5.2.2 skrll TAILQ_INSERT_TAIL(&pfi_statehead, p, pfik_w_states); 307 1.5.2.2 skrll } 308 1.5.2.2 skrll 309 1.5.2.2 skrll void 310 1.5.2.2 skrll pfi_detach_state(struct pfi_kif *p) 311 1.5.2.2 skrll { 312 1.5.2.2 skrll if (p == NULL) 313 1.5.2.2 skrll return; 314 1.5.2.2 skrll if (p->pfik_states <= 0) { 315 1.5.2.2 skrll printf("pfi_detach_state: reference count <= 0\n"); 316 1.5.2.2 skrll return; 317 1.5.2.2 skrll } 318 1.5.2.2 skrll if (!--p->pfik_states) 319 1.5.2.2 skrll TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 320 1.5.2.2 skrll pfi_maybe_destroy(p); 321 1.5.2.2 skrll } 322 1.5.2.2 skrll 323 1.5.2.2 skrll int 324 1.5.2.2 skrll pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 325 1.5.2.2 skrll { 326 1.5.2.2 skrll struct pfi_dynaddr *dyn; 327 1.5.2.2 skrll char tblname[PF_TABLE_NAME_SIZE]; 328 1.5.2.2 skrll struct pf_ruleset *ruleset = NULL; 329 1.5.2.2 skrll int s, rv = 0; 330 1.5.2.2 skrll 331 1.5.2.2 skrll if (aw->type != PF_ADDR_DYNIFTL) 332 1.5.2.2 skrll return (0); 333 1.5.2.2 skrll dyn = pool_get(&pfi_addr_pl, PR_NOWAIT); 334 1.5.2.2 skrll if (dyn == NULL) 335 1.5.2.2 skrll return (1); 336 1.5.2.2 skrll bzero(dyn, sizeof(*dyn)); 337 1.5.2.2 skrll 338 1.5.2.2 skrll s = splsoftnet(); 339 1.5.2.2 skrll dyn->pfid_kif = pfi_attach_rule(aw->v.ifname); 340 1.5.2.2 skrll if (dyn->pfid_kif == NULL) 341 1.5.2.2 skrll senderr(1); 342 1.5.2.2 skrll 343 1.5.2.2 skrll dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 344 1.5.2.2 skrll if (af == AF_INET && dyn->pfid_net == 32) 345 1.5.2.2 skrll dyn->pfid_net = 128; 346 1.5.2.2 skrll strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 347 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_NETWORK) 348 1.5.2.2 skrll strlcat(tblname, ":network", sizeof(tblname)); 349 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_BROADCAST) 350 1.5.2.2 skrll strlcat(tblname, ":broadcast", sizeof(tblname)); 351 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_PEER) 352 1.5.2.2 skrll strlcat(tblname, ":peer", sizeof(tblname)); 353 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_NOALIAS) 354 1.5.2.2 skrll strlcat(tblname, ":0", sizeof(tblname)); 355 1.5.2.2 skrll if (dyn->pfid_net != 128) 356 1.5.2.2 skrll snprintf(tblname + strlen(tblname), 357 1.5.2.2 skrll sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 358 1.5.2.5 skrll ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR); 359 1.5.2.2 skrll if (ruleset == NULL) 360 1.5.2.2 skrll senderr(1); 361 1.5.2.2 skrll 362 1.5.2.2 skrll dyn->pfid_kt = pfr_attach_table(ruleset, tblname); 363 1.5.2.2 skrll if (dyn->pfid_kt == NULL) 364 1.5.2.2 skrll senderr(1); 365 1.5.2.2 skrll 366 1.5.2.2 skrll dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 367 1.5.2.2 skrll dyn->pfid_iflags = aw->iflags; 368 1.5.2.2 skrll dyn->pfid_af = af; 369 1.5.2.2 skrll dyn->pfid_hook_cookie = hook_establish(dyn->pfid_kif->pfik_ah_head, 1, 370 1.5.2.2 skrll pfi_dynaddr_update, dyn); 371 1.5.2.2 skrll if (dyn->pfid_hook_cookie == NULL) 372 1.5.2.2 skrll senderr(1); 373 1.5.2.2 skrll 374 1.5.2.2 skrll aw->p.dyn = dyn; 375 1.5.2.2 skrll pfi_dynaddr_update(aw->p.dyn); 376 1.5.2.2 skrll splx(s); 377 1.5.2.2 skrll return (0); 378 1.5.2.2 skrll 379 1.5.2.2 skrll _bad: 380 1.5.2.2 skrll if (dyn->pfid_kt != NULL) 381 1.5.2.2 skrll pfr_detach_table(dyn->pfid_kt); 382 1.5.2.2 skrll if (ruleset != NULL) 383 1.5.2.2 skrll pf_remove_if_empty_ruleset(ruleset); 384 1.5.2.2 skrll if (dyn->pfid_kif != NULL) 385 1.5.2.2 skrll pfi_detach_rule(dyn->pfid_kif); 386 1.5.2.2 skrll pool_put(&pfi_addr_pl, dyn); 387 1.5.2.2 skrll splx(s); 388 1.5.2.2 skrll return (rv); 389 1.5.2.2 skrll } 390 1.5.2.2 skrll 391 1.5.2.2 skrll void 392 1.5.2.2 skrll pfi_dynaddr_update(void *p) 393 1.5.2.2 skrll { 394 1.5.2.2 skrll struct pfi_dynaddr *dyn = (struct pfi_dynaddr *)p; 395 1.5.2.2 skrll struct pfi_kif *kif = dyn->pfid_kif; 396 1.5.2.2 skrll struct pfr_ktable *kt = dyn->pfid_kt; 397 1.5.2.2 skrll 398 1.5.2.2 skrll if (dyn == NULL || kif == NULL || kt == NULL) 399 1.5.2.2 skrll panic("pfi_dynaddr_update"); 400 1.5.2.2 skrll if (kt->pfrkt_larg != pfi_update) { 401 1.5.2.2 skrll /* this table needs to be brought up-to-date */ 402 1.5.2.2 skrll pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 403 1.5.2.2 skrll kt->pfrkt_larg = pfi_update; 404 1.5.2.2 skrll } 405 1.5.2.2 skrll pfr_dynaddr_update(kt, dyn); 406 1.5.2.2 skrll } 407 1.5.2.2 skrll 408 1.5.2.2 skrll void 409 1.5.2.2 skrll pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 410 1.5.2.2 skrll { 411 1.5.2.2 skrll int e, size2 = 0; 412 1.5.2.2 skrll struct pfi_kif *p; 413 1.5.2.2 skrll struct pfr_table t; 414 1.5.2.2 skrll 415 1.5.2.2 skrll if ((kif->pfik_flags & PFI_IFLAG_INSTANCE) && kif->pfik_ifp == NULL) { 416 1.5.2.2 skrll pfr_clr_addrs(&kt->pfrkt_t, NULL, 0); 417 1.5.2.2 skrll return; 418 1.5.2.2 skrll } 419 1.5.2.2 skrll pfi_buffer_cnt = 0; 420 1.5.2.2 skrll if ((kif->pfik_flags & PFI_IFLAG_INSTANCE)) 421 1.5.2.2 skrll pfi_instance_add(kif->pfik_ifp, net, flags); 422 1.5.2.2 skrll else if (strcmp(kif->pfik_name, "self")) { 423 1.5.2.2 skrll TAILQ_FOREACH(p, &kif->pfik_grouphead, pfik_instances) 424 1.5.2.2 skrll pfi_instance_add(p->pfik_ifp, net, flags); 425 1.5.2.2 skrll } else { 426 1.5.2.2 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) 427 1.5.2.2 skrll if (p->pfik_flags & PFI_IFLAG_INSTANCE) 428 1.5.2.2 skrll pfi_instance_add(p->pfik_ifp, net, flags); 429 1.5.2.2 skrll } 430 1.5.2.2 skrll t = kt->pfrkt_t; 431 1.5.2.2 skrll t.pfrt_flags = 0; 432 1.5.2.2 skrll if ((e = pfr_set_addrs(&t, pfi_buffer, pfi_buffer_cnt, &size2, 433 1.5.2.2 skrll NULL, NULL, NULL, 0))) 434 1.5.2.2 skrll printf("pfi_table_update: cannot set %d new addresses " 435 1.5.2.2 skrll "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 436 1.5.2.2 skrll } 437 1.5.2.2 skrll 438 1.5.2.2 skrll void 439 1.5.2.2 skrll pfi_instance_add(struct ifnet *ifp, int net, int flags) 440 1.5.2.2 skrll { 441 1.5.2.2 skrll struct ifaddr *ia; 442 1.5.2.2 skrll int got4 = 0, got6 = 0; 443 1.5.2.2 skrll int net2, af; 444 1.5.2.2 skrll 445 1.5.2.2 skrll if (ifp == NULL) 446 1.5.2.2 skrll return; 447 1.5.2.2 skrll TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) { 448 1.5.2.2 skrll if (ia->ifa_addr == NULL) 449 1.5.2.2 skrll continue; 450 1.5.2.2 skrll af = ia->ifa_addr->sa_family; 451 1.5.2.2 skrll if (af != AF_INET && af != AF_INET6) 452 1.5.2.2 skrll continue; 453 1.5.2.2 skrll if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 454 1.5.2.2 skrll continue; 455 1.5.2.2 skrll if ((flags & PFI_AFLAG_BROADCAST) && 456 1.5.2.2 skrll !(ifp->if_flags & IFF_BROADCAST)) 457 1.5.2.2 skrll continue; 458 1.5.2.2 skrll if ((flags & PFI_AFLAG_PEER) && 459 1.5.2.2 skrll !(ifp->if_flags & IFF_POINTOPOINT)) 460 1.5.2.2 skrll continue; 461 1.5.2.2 skrll if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 462 1.5.2.2 skrll IN6_IS_ADDR_LINKLOCAL( 463 1.5.2.2 skrll &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 464 1.5.2.2 skrll continue; 465 1.5.2.2 skrll if (flags & PFI_AFLAG_NOALIAS) { 466 1.5.2.2 skrll if (af == AF_INET && got4) 467 1.5.2.2 skrll continue; 468 1.5.2.2 skrll if (af == AF_INET6 && got6) 469 1.5.2.2 skrll continue; 470 1.5.2.2 skrll } 471 1.5.2.2 skrll if (af == AF_INET) 472 1.5.2.2 skrll got4 = 1; 473 1.5.2.5 skrll else if (af == AF_INET6) 474 1.5.2.2 skrll got6 = 1; 475 1.5.2.2 skrll net2 = net; 476 1.5.2.2 skrll if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 477 1.5.2.2 skrll if (af == AF_INET) { 478 1.5.2.2 skrll net2 = pfi_unmask(&((struct sockaddr_in *) 479 1.5.2.2 skrll ia->ifa_netmask)->sin_addr); 480 1.5.2.5 skrll } else if (af == AF_INET6) { 481 1.5.2.2 skrll net2 = pfi_unmask(&((struct sockaddr_in6 *) 482 1.5.2.2 skrll ia->ifa_netmask)->sin6_addr); 483 1.5.2.2 skrll } 484 1.5.2.2 skrll } 485 1.5.2.2 skrll if (af == AF_INET && net2 > 32) 486 1.5.2.2 skrll net2 = 32; 487 1.5.2.2 skrll if (flags & PFI_AFLAG_BROADCAST) 488 1.5.2.2 skrll pfi_address_add(ia->ifa_broadaddr, af, net2); 489 1.5.2.2 skrll else if (flags & PFI_AFLAG_PEER) 490 1.5.2.2 skrll pfi_address_add(ia->ifa_dstaddr, af, net2); 491 1.5.2.2 skrll else 492 1.5.2.2 skrll pfi_address_add(ia->ifa_addr, af, net2); 493 1.5.2.2 skrll } 494 1.5.2.2 skrll } 495 1.5.2.2 skrll 496 1.5.2.2 skrll void 497 1.5.2.2 skrll pfi_address_add(struct sockaddr *sa, int af, int net) 498 1.5.2.2 skrll { 499 1.5.2.2 skrll struct pfr_addr *p; 500 1.5.2.2 skrll int i; 501 1.5.2.2 skrll 502 1.5.2.2 skrll if (pfi_buffer_cnt >= pfi_buffer_max) { 503 1.5.2.2 skrll int new_max = pfi_buffer_max * 2; 504 1.5.2.2 skrll 505 1.5.2.2 skrll if (new_max > PFI_BUFFER_MAX) { 506 1.5.2.2 skrll printf("pfi_address_add: address buffer full (%d/%d)\n", 507 1.5.2.2 skrll pfi_buffer_cnt, PFI_BUFFER_MAX); 508 1.5.2.2 skrll return; 509 1.5.2.2 skrll } 510 1.5.2.2 skrll p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, 511 1.5.2.2 skrll M_DONTWAIT); 512 1.5.2.2 skrll if (p == NULL) { 513 1.5.2.2 skrll printf("pfi_address_add: no memory to grow buffer " 514 1.5.2.2 skrll "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 515 1.5.2.2 skrll return; 516 1.5.2.2 skrll } 517 1.5.2.2 skrll memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer)); 518 1.5.2.2 skrll /* no need to zero buffer */ 519 1.5.2.2 skrll free(pfi_buffer, PFI_MTYPE); 520 1.5.2.2 skrll pfi_buffer = p; 521 1.5.2.2 skrll pfi_buffer_max = new_max; 522 1.5.2.2 skrll } 523 1.5.2.2 skrll if (af == AF_INET && net > 32) 524 1.5.2.2 skrll net = 128; 525 1.5.2.2 skrll p = pfi_buffer + pfi_buffer_cnt++; 526 1.5.2.2 skrll bzero(p, sizeof(*p)); 527 1.5.2.2 skrll p->pfra_af = af; 528 1.5.2.2 skrll p->pfra_net = net; 529 1.5.2.2 skrll if (af == AF_INET) 530 1.5.2.2 skrll p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 531 1.5.2.2 skrll if (af == AF_INET6) { 532 1.5.2.2 skrll p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 533 1.5.2.2 skrll if (IN6_IS_ADDR_LINKLOCAL(&p->pfra_ip6addr)) 534 1.5.2.2 skrll p->pfra_ip6addr.s6_addr16[1] = 0; 535 1.5.2.2 skrll } 536 1.5.2.2 skrll /* mask network address bits */ 537 1.5.2.2 skrll if (net < 128) 538 1.5.2.2 skrll ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 539 1.5.2.2 skrll for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 540 1.5.2.2 skrll ((caddr_t)p)[i] = 0; 541 1.5.2.2 skrll } 542 1.5.2.2 skrll 543 1.5.2.2 skrll void 544 1.5.2.2 skrll pfi_dynaddr_remove(struct pf_addr_wrap *aw) 545 1.5.2.2 skrll { 546 1.5.2.2 skrll int s; 547 1.5.2.2 skrll 548 1.5.2.2 skrll if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 549 1.5.2.2 skrll aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 550 1.5.2.2 skrll return; 551 1.5.2.2 skrll 552 1.5.2.2 skrll s = splsoftnet(); 553 1.5.2.2 skrll hook_disestablish(aw->p.dyn->pfid_kif->pfik_ah_head, 554 1.5.2.2 skrll aw->p.dyn->pfid_hook_cookie); 555 1.5.2.2 skrll pfi_detach_rule(aw->p.dyn->pfid_kif); 556 1.5.2.2 skrll aw->p.dyn->pfid_kif = NULL; 557 1.5.2.2 skrll pfr_detach_table(aw->p.dyn->pfid_kt); 558 1.5.2.2 skrll aw->p.dyn->pfid_kt = NULL; 559 1.5.2.2 skrll pool_put(&pfi_addr_pl, aw->p.dyn); 560 1.5.2.2 skrll aw->p.dyn = NULL; 561 1.5.2.2 skrll splx(s); 562 1.5.2.2 skrll } 563 1.5.2.2 skrll 564 1.5.2.2 skrll void 565 1.5.2.2 skrll pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 566 1.5.2.2 skrll { 567 1.5.2.2 skrll if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 568 1.5.2.2 skrll aw->p.dyn->pfid_kif == NULL) 569 1.5.2.2 skrll return; 570 1.5.2.2 skrll aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 571 1.5.2.2 skrll } 572 1.5.2.2 skrll 573 1.5.2.2 skrll void 574 1.5.2.2 skrll pfi_kifaddr_update(void *v) 575 1.5.2.2 skrll { 576 1.5.2.2 skrll int s; 577 1.5.2.2 skrll 578 1.5.2.2 skrll s = splsoftnet(); 579 1.5.2.2 skrll pfi_update++; 580 1.5.2.2 skrll pfi_dohooks(v); 581 1.5.2.2 skrll splx(s); 582 1.5.2.2 skrll } 583 1.5.2.2 skrll 584 1.5.2.2 skrll #ifdef __NetBSD__ 585 1.5.2.2 skrll void 586 1.5.2.2 skrll pfi_kifaddr_update_if(struct ifnet *ifp) 587 1.5.2.2 skrll { 588 1.5.2.2 skrll struct pfi_kif *p; 589 1.5.2.2 skrll 590 1.5.2.2 skrll p = pfi_lookup_if(ifp->if_xname); 591 1.5.2.2 skrll if (p == NULL) 592 1.5.2.2 skrll panic("can't find interface"); 593 1.5.2.2 skrll pfi_kifaddr_update(p); 594 1.5.2.2 skrll } 595 1.5.2.2 skrll #endif 596 1.5.2.2 skrll 597 1.5.2.2 skrll int 598 1.5.2.2 skrll pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 599 1.5.2.2 skrll { 600 1.5.2.2 skrll return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 601 1.5.2.2 skrll } 602 1.5.2.2 skrll 603 1.5.2.2 skrll struct pfi_kif * 604 1.5.2.2 skrll pfi_if_create(const char *name, struct pfi_kif *q, int flags) 605 1.5.2.2 skrll { 606 1.5.2.2 skrll struct pfi_kif *p; 607 1.5.2.2 skrll 608 1.5.2.2 skrll p = malloc(sizeof(*p), PFI_MTYPE, M_DONTWAIT); 609 1.5.2.2 skrll if (p == NULL) 610 1.5.2.2 skrll return (NULL); 611 1.5.2.2 skrll bzero(p, sizeof(*p)); 612 1.5.2.2 skrll p->pfik_ah_head = malloc(sizeof(*p->pfik_ah_head), PFI_MTYPE, 613 1.5.2.2 skrll M_DONTWAIT); 614 1.5.2.2 skrll if (p->pfik_ah_head == NULL) { 615 1.5.2.2 skrll free(p, PFI_MTYPE); 616 1.5.2.2 skrll return (NULL); 617 1.5.2.2 skrll } 618 1.5.2.2 skrll bzero(p->pfik_ah_head, sizeof(*p->pfik_ah_head)); 619 1.5.2.2 skrll #ifdef __NetBSD__ 620 1.5.2.2 skrll p->pfik_ifaddrhooks = malloc(sizeof(*p->pfik_ifaddrhooks), PFI_MTYPE, 621 1.5.2.2 skrll M_DONTWAIT); 622 1.5.2.2 skrll if (p->pfik_ifaddrhooks == NULL) { 623 1.5.2.2 skrll free(p->pfik_ah_head, PFI_MTYPE); 624 1.5.2.2 skrll free(p, PFI_MTYPE); 625 1.5.2.2 skrll return (NULL); 626 1.5.2.2 skrll } 627 1.5.2.2 skrll bzero(p->pfik_ifaddrhooks, sizeof(*p->pfik_ifaddrhooks)); 628 1.5.2.2 skrll #endif 629 1.5.2.2 skrll TAILQ_INIT(p->pfik_ah_head); 630 1.5.2.2 skrll TAILQ_INIT(&p->pfik_grouphead); 631 1.5.2.2 skrll #ifdef __NetBSD__ 632 1.5.2.2 skrll TAILQ_INIT(p->pfik_ifaddrhooks); 633 1.5.2.2 skrll #endif 634 1.5.2.2 skrll strlcpy(p->pfik_name, name, sizeof(p->pfik_name)); 635 1.5.2.2 skrll RB_INIT(&p->pfik_lan_ext); 636 1.5.2.2 skrll RB_INIT(&p->pfik_ext_gwy); 637 1.5.2.2 skrll p->pfik_flags = flags; 638 1.5.2.2 skrll p->pfik_parent = q; 639 1.5.2.5 skrll p->pfik_tzero = time_second; 640 1.5.2.2 skrll 641 1.5.2.2 skrll RB_INSERT(pfi_ifhead, &pfi_ifs, p); 642 1.5.2.2 skrll if (q != NULL) { 643 1.5.2.2 skrll q->pfik_addcnt++; 644 1.5.2.2 skrll TAILQ_INSERT_TAIL(&q->pfik_grouphead, p, pfik_instances); 645 1.5.2.2 skrll } 646 1.5.2.2 skrll pfi_ifcnt++; 647 1.5.2.2 skrll return (p); 648 1.5.2.2 skrll } 649 1.5.2.2 skrll 650 1.5.2.2 skrll int 651 1.5.2.2 skrll pfi_maybe_destroy(struct pfi_kif *p) 652 1.5.2.2 skrll { 653 1.5.2.2 skrll int i, j, k, s; 654 1.5.2.2 skrll struct pfi_kif *q = p->pfik_parent; 655 1.5.2.2 skrll 656 1.5.2.2 skrll if ((p->pfik_flags & (PFI_IFLAG_ATTACHED | PFI_IFLAG_GROUP)) || 657 1.5.2.2 skrll p->pfik_rules > 0 || p->pfik_states > 0) 658 1.5.2.2 skrll return (0); 659 1.5.2.2 skrll 660 1.5.2.2 skrll s = splsoftnet(); 661 1.5.2.2 skrll if (q != NULL) { 662 1.5.2.2 skrll for (i = 0; i < 2; i++) 663 1.5.2.2 skrll for (j = 0; j < 2; j++) 664 1.5.2.2 skrll for (k = 0; k < 2; k++) { 665 1.5.2.2 skrll q->pfik_bytes[i][j][k] += 666 1.5.2.2 skrll p->pfik_bytes[i][j][k]; 667 1.5.2.2 skrll q->pfik_packets[i][j][k] += 668 1.5.2.2 skrll p->pfik_packets[i][j][k]; 669 1.5.2.2 skrll } 670 1.5.2.2 skrll q->pfik_delcnt++; 671 1.5.2.2 skrll TAILQ_REMOVE(&q->pfik_grouphead, p, pfik_instances); 672 1.5.2.2 skrll } 673 1.5.2.2 skrll pfi_ifcnt--; 674 1.5.2.2 skrll RB_REMOVE(pfi_ifhead, &pfi_ifs, p); 675 1.5.2.2 skrll splx(s); 676 1.5.2.2 skrll 677 1.5.2.2 skrll free(p->pfik_ah_head, PFI_MTYPE); 678 1.5.2.2 skrll free(p, PFI_MTYPE); 679 1.5.2.2 skrll return (1); 680 1.5.2.2 skrll } 681 1.5.2.2 skrll 682 1.5.2.2 skrll void 683 1.5.2.2 skrll pfi_copy_group(char *p, const char *q, int m) 684 1.5.2.2 skrll { 685 1.5.2.2 skrll while (m > 1 && *q && !(*q >= '0' && *q <= '9')) { 686 1.5.2.2 skrll *p++ = *q++; 687 1.5.2.2 skrll m--; 688 1.5.2.2 skrll } 689 1.5.2.2 skrll if (m > 0) 690 1.5.2.2 skrll *p++ = '\0'; 691 1.5.2.2 skrll } 692 1.5.2.2 skrll 693 1.5.2.2 skrll void 694 1.5.2.2 skrll pfi_newgroup(const char *name, int flags) 695 1.5.2.2 skrll { 696 1.5.2.2 skrll struct pfi_kif *p; 697 1.5.2.2 skrll 698 1.5.2.2 skrll p = pfi_lookup_if(name); 699 1.5.2.2 skrll if (p == NULL) 700 1.5.2.2 skrll p = pfi_if_create(name, pfi_self, PFI_IFLAG_GROUP); 701 1.5.2.2 skrll if (p == NULL) { 702 1.5.2.2 skrll printf("pfi_newgroup: cannot allocate '%s' group", name); 703 1.5.2.2 skrll return; 704 1.5.2.2 skrll } 705 1.5.2.2 skrll p->pfik_flags |= flags; 706 1.5.2.2 skrll } 707 1.5.2.2 skrll 708 1.5.2.2 skrll void 709 1.5.2.2 skrll pfi_fill_oldstatus(struct pf_status *pfs) 710 1.5.2.2 skrll { 711 1.5.2.2 skrll struct pfi_kif *p, key; 712 1.5.2.2 skrll int i, j, k, s; 713 1.5.2.2 skrll 714 1.5.2.2 skrll strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name)); 715 1.5.2.2 skrll s = splsoftnet(); 716 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 717 1.5.2.2 skrll if (p == NULL) { 718 1.5.2.2 skrll splx(s); 719 1.5.2.2 skrll return; 720 1.5.2.2 skrll } 721 1.5.2.2 skrll bzero(pfs->pcounters, sizeof(pfs->pcounters)); 722 1.5.2.2 skrll bzero(pfs->bcounters, sizeof(pfs->bcounters)); 723 1.5.2.2 skrll for (i = 0; i < 2; i++) 724 1.5.2.2 skrll for (j = 0; j < 2; j++) 725 1.5.2.2 skrll for (k = 0; k < 2; k++) { 726 1.5.2.2 skrll pfs->pcounters[i][j][k] = 727 1.5.2.2 skrll p->pfik_packets[i][j][k]; 728 1.5.2.2 skrll pfs->bcounters[i][j] += 729 1.5.2.2 skrll p->pfik_bytes[i][j][k]; 730 1.5.2.2 skrll } 731 1.5.2.2 skrll splx(s); 732 1.5.2.2 skrll } 733 1.5.2.2 skrll 734 1.5.2.2 skrll int 735 1.5.2.2 skrll pfi_clr_istats(const char *name, int *nzero, int flags) 736 1.5.2.2 skrll { 737 1.5.2.2 skrll struct pfi_kif *p; 738 1.5.2.2 skrll int n = 0, s; 739 1.5.2.5 skrll long tzero = time_second; 740 1.5.2.2 skrll 741 1.5.2.2 skrll s = splsoftnet(); 742 1.5.2.2 skrll ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 743 1.5.2.2 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 744 1.5.2.2 skrll if (pfi_skip_if(name, p, flags)) 745 1.5.2.2 skrll continue; 746 1.5.2.2 skrll bzero(p->pfik_packets, sizeof(p->pfik_packets)); 747 1.5.2.2 skrll bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 748 1.5.2.2 skrll p->pfik_tzero = tzero; 749 1.5.2.2 skrll n++; 750 1.5.2.2 skrll } 751 1.5.2.2 skrll splx(s); 752 1.5.2.2 skrll if (nzero != NULL) 753 1.5.2.2 skrll *nzero = n; 754 1.5.2.2 skrll return (0); 755 1.5.2.2 skrll } 756 1.5.2.2 skrll 757 1.5.2.2 skrll int 758 1.5.2.2 skrll pfi_get_ifaces(const char *name, struct pfi_if *buf, int *size, int flags) 759 1.5.2.2 skrll { 760 1.5.2.2 skrll struct pfi_kif *p; 761 1.5.2.2 skrll int s, n = 0; 762 1.5.2.2 skrll 763 1.5.2.2 skrll ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 764 1.5.2.2 skrll s = splsoftnet(); 765 1.5.2.2 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 766 1.5.2.2 skrll if (pfi_skip_if(name, p, flags)) 767 1.5.2.2 skrll continue; 768 1.5.2.2 skrll if (*size > n++) { 769 1.5.2.2 skrll if (!p->pfik_tzero) 770 1.5.2.5 skrll p->pfik_tzero = time_second; 771 1.5.2.2 skrll if (copyout(p, buf++, sizeof(*buf))) { 772 1.5.2.2 skrll splx(s); 773 1.5.2.2 skrll return (EFAULT); 774 1.5.2.2 skrll } 775 1.5.2.2 skrll } 776 1.5.2.2 skrll } 777 1.5.2.2 skrll splx(s); 778 1.5.2.2 skrll *size = n; 779 1.5.2.2 skrll return (0); 780 1.5.2.2 skrll } 781 1.5.2.2 skrll 782 1.5.2.2 skrll struct pfi_kif * 783 1.5.2.2 skrll pfi_lookup_if(const char *name) 784 1.5.2.2 skrll { 785 1.5.2.2 skrll struct pfi_kif *p, key; 786 1.5.2.2 skrll 787 1.5.2.2 skrll strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 788 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 789 1.5.2.2 skrll return (p); 790 1.5.2.2 skrll } 791 1.5.2.2 skrll 792 1.5.2.2 skrll int 793 1.5.2.2 skrll pfi_skip_if(const char *filter, struct pfi_kif *p, int f) 794 1.5.2.2 skrll { 795 1.5.2.2 skrll int n; 796 1.5.2.2 skrll 797 1.5.2.2 skrll if ((p->pfik_flags & PFI_IFLAG_GROUP) && !(f & PFI_FLAG_GROUP)) 798 1.5.2.2 skrll return (1); 799 1.5.2.2 skrll if ((p->pfik_flags & PFI_IFLAG_INSTANCE) && !(f & PFI_FLAG_INSTANCE)) 800 1.5.2.2 skrll return (1); 801 1.5.2.2 skrll if (filter == NULL || !*filter) 802 1.5.2.2 skrll return (0); 803 1.5.2.2 skrll if (!strcmp(p->pfik_name, filter)) 804 1.5.2.2 skrll return (0); /* exact match */ 805 1.5.2.2 skrll n = strlen(filter); 806 1.5.2.2 skrll if (n < 1 || n >= IFNAMSIZ) 807 1.5.2.2 skrll return (1); /* sanity check */ 808 1.5.2.2 skrll if (filter[n-1] >= '0' && filter[n-1] <= '9') 809 1.5.2.2 skrll return (1); /* only do exact match in that case */ 810 1.5.2.2 skrll if (strncmp(p->pfik_name, filter, n)) 811 1.5.2.2 skrll return (1); /* prefix doesn't match */ 812 1.5.2.2 skrll return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 813 1.5.2.2 skrll } 814 1.5.2.2 skrll 815 1.5.2.2 skrll /* from pf_print_state.c */ 816 1.5.2.2 skrll int 817 1.5.2.2 skrll pfi_unmask(void *addr) 818 1.5.2.2 skrll { 819 1.5.2.2 skrll struct pf_addr *m = addr; 820 1.5.2.2 skrll int i = 31, j = 0, b = 0; 821 1.5.2.2 skrll u_int32_t tmp; 822 1.5.2.2 skrll 823 1.5.2.2 skrll while (j < 4 && m->addr32[j] == 0xffffffff) { 824 1.5.2.2 skrll b += 32; 825 1.5.2.2 skrll j++; 826 1.5.2.2 skrll } 827 1.5.2.2 skrll if (j < 4) { 828 1.5.2.2 skrll tmp = ntohl(m->addr32[j]); 829 1.5.2.2 skrll for (i = 31; tmp & (1 << i); --i) 830 1.5.2.2 skrll b++; 831 1.5.2.2 skrll } 832 1.5.2.2 skrll return (b); 833 1.5.2.2 skrll } 834 1.5.2.2 skrll 835 1.5.2.2 skrll void 836 1.5.2.2 skrll pfi_dohooks(struct pfi_kif *p) 837 1.5.2.2 skrll { 838 1.5.2.2 skrll for (; p != NULL; p = p->pfik_parent) 839 1.5.2.2 skrll dohooks(p->pfik_ah_head, 0); 840 1.5.2.2 skrll } 841 1.5.2.2 skrll 842 1.5.2.2 skrll int 843 1.5.2.2 skrll pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 844 1.5.2.2 skrll { 845 1.5.2.5 skrll switch (af) { 846 1.5.2.5 skrll #ifdef INET 847 1.5.2.5 skrll case AF_INET: 848 1.5.2.2 skrll switch (dyn->pfid_acnt4) { 849 1.5.2.2 skrll case 0: 850 1.5.2.2 skrll return (0); 851 1.5.2.2 skrll case 1: 852 1.5.2.2 skrll return (PF_MATCHA(0, &dyn->pfid_addr4, 853 1.5.2.2 skrll &dyn->pfid_mask4, a, AF_INET)); 854 1.5.2.2 skrll default: 855 1.5.2.2 skrll return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 856 1.5.2.2 skrll } 857 1.5.2.5 skrll break; 858 1.5.2.5 skrll #endif /* INET */ 859 1.5.2.5 skrll #ifdef INET6 860 1.5.2.5 skrll case AF_INET6: 861 1.5.2.2 skrll switch (dyn->pfid_acnt6) { 862 1.5.2.2 skrll case 0: 863 1.5.2.2 skrll return (0); 864 1.5.2.2 skrll case 1: 865 1.5.2.2 skrll return (PF_MATCHA(0, &dyn->pfid_addr6, 866 1.5.2.2 skrll &dyn->pfid_mask6, a, AF_INET6)); 867 1.5.2.2 skrll default: 868 1.5.2.2 skrll return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 869 1.5.2.2 skrll } 870 1.5.2.5 skrll break; 871 1.5.2.5 skrll #endif /* INET6 */ 872 1.5.2.5 skrll default: 873 1.5.2.5 skrll return (0); 874 1.5.2.2 skrll } 875 1.5.2.2 skrll } 876 1.5.2.2 skrll 877 1.5.2.2 skrll /* from openbsd/sys/kern/kern_subr.c */ 878 1.5.2.2 skrll #ifdef __NetBSD__ 879 1.5.2.2 skrll static void * 880 1.5.2.2 skrll hook_establish(struct hook_desc_head *head, int tail, void (*fn)(void *), 881 1.5.2.2 skrll void *arg) 882 1.5.2.2 skrll { 883 1.5.2.2 skrll struct hook_desc *hdp; 884 1.5.2.2 skrll 885 1.5.2.2 skrll hdp = (struct hook_desc *)malloc(sizeof (*hdp), M_DEVBUF, M_NOWAIT); 886 1.5.2.2 skrll if (hdp == NULL) 887 1.5.2.2 skrll return (NULL); 888 1.5.2.2 skrll 889 1.5.2.2 skrll hdp->hd_fn = fn; 890 1.5.2.2 skrll hdp->hd_arg = arg; 891 1.5.2.2 skrll if (tail) 892 1.5.2.2 skrll TAILQ_INSERT_TAIL(head, hdp, hd_list); 893 1.5.2.2 skrll else 894 1.5.2.2 skrll TAILQ_INSERT_HEAD(head, hdp, hd_list); 895 1.5.2.2 skrll 896 1.5.2.2 skrll return (hdp); 897 1.5.2.2 skrll } 898 1.5.2.2 skrll 899 1.5.2.2 skrll static void 900 1.5.2.2 skrll hook_disestablish(struct hook_desc_head *head, void *vhook) 901 1.5.2.2 skrll { 902 1.5.2.2 skrll struct hook_desc *hdp; 903 1.5.2.2 skrll 904 1.5.2.2 skrll #ifdef DIAGNOSTIC 905 1.5.2.2 skrll for (hdp = TAILQ_FIRST(head); hdp != NULL; 906 1.5.2.2 skrll hdp = TAILQ_NEXT(hdp, hd_list)) 907 1.5.2.2 skrll if (hdp == vhook) 908 1.5.2.2 skrll break; 909 1.5.2.2 skrll if (hdp == NULL) 910 1.5.2.2 skrll panic("hook_disestablish: hook not established"); 911 1.5.2.2 skrll #endif 912 1.5.2.2 skrll hdp = vhook; 913 1.5.2.2 skrll TAILQ_REMOVE(head, hdp, hd_list); 914 1.5.2.2 skrll free(hdp, M_DEVBUF); 915 1.5.2.2 skrll } 916 1.5.2.2 skrll 917 1.5.2.2 skrll static void 918 1.5.2.2 skrll dohooks(struct hook_desc_head *head, int flags) 919 1.5.2.2 skrll { 920 1.5.2.2 skrll struct hook_desc *hdp; 921 1.5.2.2 skrll 922 1.5.2.2 skrll if ((flags & HOOK_REMOVE) == 0) { 923 1.5.2.2 skrll TAILQ_FOREACH(hdp, head, hd_list) { 924 1.5.2.2 skrll (*hdp->hd_fn)(hdp->hd_arg); 925 1.5.2.2 skrll } 926 1.5.2.2 skrll } else { 927 1.5.2.2 skrll while ((hdp = TAILQ_FIRST(head)) != NULL) { 928 1.5.2.2 skrll TAILQ_REMOVE(head, hdp, hd_list); 929 1.5.2.2 skrll (*hdp->hd_fn)(hdp->hd_arg); 930 1.5.2.2 skrll if ((flags & HOOK_FREE) != 0) 931 1.5.2.2 skrll free(hdp, M_DEVBUF); 932 1.5.2.2 skrll } 933 1.5.2.2 skrll } 934 1.5.2.2 skrll } 935 1.5.2.2 skrll #endif 936
Indexes created Wed Oct 22 13:09:56 GMT 2025