pf_if.c revision 1.5.2.7
1 1.5.2.7 skrll /* $NetBSD: pf_if.c,v 1.5.2.7 2005/11/10 14:09:07 skrll Exp $ */ 2 1.5.2.7 skrll /* $OpenBSD: pf_if.c,v 1.23 2004/12/22 17:17:55 dhartmei Exp $ */ 3 1.5.2.2 skrll 4 1.5.2.2 skrll /* 5 1.5.2.2 skrll * Copyright (c) 2001 Daniel Hartmeier 6 1.5.2.2 skrll * Copyright (c) 2003 Cedric Berger 7 1.5.2.2 skrll * All rights reserved. 8 1.5.2.2 skrll * 9 1.5.2.2 skrll * Redistribution and use in source and binary forms, with or without 10 1.5.2.2 skrll * modification, are permitted provided that the following conditions 11 1.5.2.2 skrll * are met: 12 1.5.2.2 skrll * 13 1.5.2.2 skrll * - Redistributions of source code must retain the above copyright 14 1.5.2.2 skrll * notice, this list of conditions and the following disclaimer. 15 1.5.2.2 skrll * - Redistributions in binary form must reproduce the above 16 1.5.2.2 skrll * copyright notice, this list of conditions and the following 17 1.5.2.2 skrll * disclaimer in the documentation and/or other materials provided 18 1.5.2.2 skrll * with the distribution. 19 1.5.2.2 skrll * 20 1.5.2.2 skrll * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 1.5.2.2 skrll * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 1.5.2.2 skrll * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 1.5.2.2 skrll * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 1.5.2.2 skrll * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 1.5.2.2 skrll * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 1.5.2.2 skrll * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 1.5.2.2 skrll * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 1.5.2.2 skrll * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 1.5.2.2 skrll * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 1.5.2.2 skrll * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 1.5.2.2 skrll * POSSIBILITY OF SUCH DAMAGE. 32 1.5.2.2 skrll */ 33 1.5.2.2 skrll 34 1.5.2.2 skrll #ifdef _KERNEL_OPT 35 1.5.2.2 skrll #include "opt_inet.h" 36 1.5.2.2 skrll #endif 37 1.5.2.2 skrll 38 1.5.2.2 skrll #include <sys/param.h> 39 1.5.2.2 skrll #include <sys/systm.h> 40 1.5.2.2 skrll #include <sys/mbuf.h> 41 1.5.2.2 skrll #include <sys/filio.h> 42 1.5.2.2 skrll #include <sys/socket.h> 43 1.5.2.2 skrll #include <sys/socketvar.h> 44 1.5.2.2 skrll #include <sys/kernel.h> 45 1.5.2.2 skrll #include <sys/device.h> 46 1.5.2.2 skrll #include <sys/time.h> 47 1.5.2.2 skrll 48 1.5.2.2 skrll #include <net/if.h> 49 1.5.2.2 skrll #include <net/if_types.h> 50 1.5.2.2 skrll 51 1.5.2.2 skrll #include <netinet/in.h> 52 1.5.2.2 skrll #include <netinet/in_var.h> 53 1.5.2.2 skrll #include <netinet/in_systm.h> 54 1.5.2.2 skrll #include <netinet/ip.h> 55 1.5.2.2 skrll #include <netinet/ip_var.h> 56 1.5.2.2 skrll 57 1.5.2.2 skrll #include <net/pfvar.h> 58 1.5.2.2 skrll 59 1.5.2.2 skrll #ifdef INET6 60 1.5.2.2 skrll #include <netinet/ip6.h> 61 1.5.2.2 skrll #endif /* INET6 */ 62 1.5.2.2 skrll 63 1.5.2.2 skrll #define ACCEPT_FLAGS(oklist) \ 64 1.5.2.2 skrll do { \ 65 1.5.2.2 skrll if ((flags & ~(oklist)) & \ 66 1.5.2.2 skrll PFI_FLAG_ALLMASK) \ 67 1.5.2.2 skrll return (EINVAL); \ 68 1.5.2.2 skrll } while (0) 69 1.5.2.2 skrll 70 1.5.2.2 skrll #define senderr(e) do { rv = (e); goto _bad; } while (0) 71 1.5.2.2 skrll 72 1.5.2.2 skrll struct pfi_kif **pfi_index2kif; 73 1.5.2.2 skrll struct pfi_kif *pfi_self; 74 1.5.2.2 skrll int pfi_indexlim; 75 1.5.2.2 skrll struct pfi_ifhead pfi_ifs; 76 1.5.2.2 skrll struct pfi_statehead pfi_statehead; 77 1.5.2.2 skrll int pfi_ifcnt; 78 1.5.2.2 skrll struct pool pfi_addr_pl; 79 1.5.2.2 skrll long pfi_update = 1; 80 1.5.2.2 skrll struct pfr_addr *pfi_buffer; 81 1.5.2.2 skrll int pfi_buffer_cnt; 82 1.5.2.2 skrll int pfi_buffer_max; 83 1.5.2.2 skrll 84 1.5.2.2 skrll void pfi_dynaddr_update(void *); 85 1.5.2.2 skrll void pfi_kifaddr_update(void *); 86 1.5.2.2 skrll #ifdef __NetBSD__ 87 1.5.2.2 skrll void pfi_kifaddr_update_if(struct ifnet *); 88 1.5.2.2 skrll #endif 89 1.5.2.2 skrll void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, 90 1.5.2.2 skrll int, int); 91 1.5.2.2 skrll void pfi_instance_add(struct ifnet *, int, int); 92 1.5.2.2 skrll void pfi_address_add(struct sockaddr *, int, int); 93 1.5.2.2 skrll int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 94 1.5.2.2 skrll struct pfi_kif *pfi_if_create(const char *, struct pfi_kif *, int); 95 1.5.2.2 skrll void pfi_copy_group(char *, const char *, int); 96 1.5.2.2 skrll void pfi_newgroup(const char *, int); 97 1.5.2.2 skrll int pfi_skip_if(const char *, struct pfi_kif *, int); 98 1.5.2.2 skrll int pfi_unmask(void *); 99 1.5.2.2 skrll void pfi_dohooks(struct pfi_kif *); 100 1.5.2.2 skrll 101 1.5.2.2 skrll RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 102 1.5.2.2 skrll RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 103 1.5.2.2 skrll 104 1.5.2.2 skrll #define PFI_BUFFER_MAX 0x10000 105 1.5.2.2 skrll #define PFI_MTYPE M_IFADDR 106 1.5.2.2 skrll 107 1.5.2.2 skrll #ifdef __NetBSD__ 108 1.5.2.2 skrll static void *hook_establish(struct hook_desc_head *, int, void (*)(void *), 109 1.5.2.2 skrll void *); 110 1.5.2.2 skrll static void hook_disestablish(struct hook_desc_head *, void *); 111 1.5.2.2 skrll static void dohooks(struct hook_desc_head *, int); 112 1.5.2.2 skrll 113 1.5.2.2 skrll #define HOOK_REMOVE 0x01 114 1.5.2.2 skrll #define HOOK_FREE 0x02 115 1.5.2.2 skrll #endif 116 1.5.2.2 skrll 117 1.5.2.2 skrll void 118 1.5.2.2 skrll pfi_initialize(void) 119 1.5.2.2 skrll { 120 1.5.2.2 skrll if (pfi_self != NULL) /* already initialized */ 121 1.5.2.2 skrll return; 122 1.5.2.2 skrll 123 1.5.2.2 skrll TAILQ_INIT(&pfi_statehead); 124 1.5.2.2 skrll pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0, 125 1.5.2.2 skrll "pfiaddrpl", &pool_allocator_nointr); 126 1.5.2.2 skrll pfi_buffer_max = 64; 127 1.5.2.2 skrll pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer), 128 1.5.2.2 skrll PFI_MTYPE, M_WAITOK); 129 1.5.2.2 skrll pfi_self = pfi_if_create("self", NULL, PFI_IFLAG_GROUP); 130 1.5.2.2 skrll } 131 1.5.2.2 skrll 132 1.5.2.2 skrll #ifdef _LKM 133 1.5.2.2 skrll void 134 1.5.2.2 skrll pfi_destroy(void) 135 1.5.2.2 skrll { 136 1.5.2.2 skrll pool_destroy(&pfi_addr_pl); 137 1.5.2.2 skrll 138 1.5.2.6 skrll free(pfi_buffer, PFI_MTYPE); 139 1.5.2.2 skrll } 140 1.5.2.2 skrll #endif 141 1.5.2.2 skrll 142 1.5.2.2 skrll void 143 1.5.2.2 skrll pfi_attach_clone(struct if_clone *ifc) 144 1.5.2.2 skrll { 145 1.5.2.2 skrll pfi_initialize(); 146 1.5.2.2 skrll pfi_newgroup(ifc->ifc_name, PFI_IFLAG_CLONABLE); 147 1.5.2.2 skrll } 148 1.5.2.2 skrll 149 1.5.2.2 skrll void 150 1.5.2.2 skrll pfi_attach_ifnet(struct ifnet *ifp) 151 1.5.2.2 skrll { 152 1.5.2.2 skrll struct pfi_kif *p, *q, key; 153 1.5.2.2 skrll int s; 154 1.5.2.2 skrll 155 1.5.2.2 skrll pfi_initialize(); 156 1.5.2.2 skrll s = splsoftnet(); 157 1.5.2.2 skrll pfi_update++; 158 1.5.2.2 skrll if (ifp->if_index >= pfi_indexlim) { 159 1.5.2.2 skrll /* 160 1.5.2.2 skrll * grow pfi_index2kif, similar to ifindex2ifnet code in if.c 161 1.5.2.2 skrll */ 162 1.5.2.2 skrll size_t m, n, oldlim; 163 1.5.2.2 skrll struct pfi_kif **mp, **np; 164 1.5.2.2 skrll 165 1.5.2.2 skrll oldlim = pfi_indexlim; 166 1.5.2.2 skrll if (pfi_indexlim == 0) 167 1.5.2.2 skrll pfi_indexlim = 64; 168 1.5.2.2 skrll while (ifp->if_index >= pfi_indexlim) 169 1.5.2.2 skrll pfi_indexlim <<= 1; 170 1.5.2.2 skrll 171 1.5.2.2 skrll m = oldlim * sizeof(struct pfi_kif *); 172 1.5.2.2 skrll mp = pfi_index2kif; 173 1.5.2.2 skrll n = pfi_indexlim * sizeof(struct pfi_kif *); 174 1.5.2.2 skrll np = malloc(n, PFI_MTYPE, M_DONTWAIT); 175 1.5.2.2 skrll if (np == NULL) 176 1.5.2.2 skrll panic("pfi_attach_ifnet: " 177 1.5.2.2 skrll "cannot allocate translation table"); 178 1.5.2.2 skrll bzero(np, n); 179 1.5.2.2 skrll if (mp != NULL) 180 1.5.2.2 skrll bcopy(mp, np, m); 181 1.5.2.2 skrll pfi_index2kif = np; 182 1.5.2.2 skrll if (mp != NULL) 183 1.5.2.2 skrll free(mp, PFI_MTYPE); 184 1.5.2.2 skrll } 185 1.5.2.2 skrll 186 1.5.2.2 skrll strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 187 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 188 1.5.2.2 skrll if (p == NULL) { 189 1.5.2.2 skrll /* add group */ 190 1.5.2.2 skrll pfi_copy_group(key.pfik_name, ifp->if_xname, 191 1.5.2.2 skrll sizeof(key.pfik_name)); 192 1.5.2.2 skrll q = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 193 1.5.2.2 skrll if (q == NULL) 194 1.5.2.2 skrll q = pfi_if_create(key.pfik_name, pfi_self, PFI_IFLAG_GROUP); 195 1.5.2.2 skrll if (q == NULL) 196 1.5.2.2 skrll panic("pfi_attach_ifnet: " 197 1.5.2.2 skrll "cannot allocate '%s' group", key.pfik_name); 198 1.5.2.2 skrll 199 1.5.2.2 skrll /* add interface */ 200 1.5.2.2 skrll p = pfi_if_create(ifp->if_xname, q, PFI_IFLAG_INSTANCE); 201 1.5.2.2 skrll if (p == NULL) 202 1.5.2.2 skrll panic("pfi_attach_ifnet: " 203 1.5.2.2 skrll "cannot allocate '%s' interface", ifp->if_xname); 204 1.5.2.2 skrll } else 205 1.5.2.2 skrll q = p->pfik_parent; 206 1.5.2.2 skrll p->pfik_ifp = ifp; 207 1.5.2.2 skrll p->pfik_flags |= PFI_IFLAG_ATTACHED; 208 1.5.2.2 skrll #ifdef __OpenBSD__ 209 1.5.2.2 skrll p->pfik_ah_cookie = 210 1.5.2.2 skrll hook_establish(ifp->if_addrhooks, 1, pfi_kifaddr_update, p); 211 1.5.2.2 skrll #else 212 1.5.2.2 skrll p->pfik_ah_cookie = 213 1.5.2.6 skrll hook_establish(&p->pfik_ifaddrhooks, 1, pfi_kifaddr_update, p); 214 1.5.2.2 skrll #endif 215 1.5.2.2 skrll pfi_index2kif[ifp->if_index] = p; 216 1.5.2.2 skrll pfi_dohooks(p); 217 1.5.2.2 skrll splx(s); 218 1.5.2.2 skrll } 219 1.5.2.2 skrll 220 1.5.2.2 skrll void 221 1.5.2.2 skrll pfi_detach_ifnet(struct ifnet *ifp) 222 1.5.2.2 skrll { 223 1.5.2.2 skrll struct pfi_kif *p, *q, key; 224 1.5.2.2 skrll int s; 225 1.5.2.2 skrll 226 1.5.2.2 skrll strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 227 1.5.2.2 skrll 228 1.5.2.2 skrll s = splsoftnet(); 229 1.5.2.2 skrll pfi_update++; 230 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 231 1.5.2.2 skrll if (p == NULL) { 232 1.5.2.2 skrll printf("pfi_detach_ifnet: cannot find %s", ifp->if_xname); 233 1.5.2.2 skrll splx(s); 234 1.5.2.2 skrll return; 235 1.5.2.2 skrll } 236 1.5.2.2 skrll #ifdef __OpenBSD__ 237 1.5.2.2 skrll hook_disestablish(p->pfik_ifp->if_addrhooks, p->pfik_ah_cookie); 238 1.5.2.2 skrll #else 239 1.5.2.6 skrll hook_disestablish(&p->pfik_ifaddrhooks, p->pfik_ah_cookie); 240 1.5.2.2 skrll #endif 241 1.5.2.2 skrll q = p->pfik_parent; 242 1.5.2.2 skrll p->pfik_ifp = NULL; 243 1.5.2.2 skrll p->pfik_flags &= ~PFI_IFLAG_ATTACHED; 244 1.5.2.2 skrll pfi_index2kif[ifp->if_index] = NULL; 245 1.5.2.2 skrll pfi_dohooks(p); 246 1.5.2.2 skrll pfi_maybe_destroy(p); 247 1.5.2.2 skrll splx(s); 248 1.5.2.2 skrll } 249 1.5.2.2 skrll 250 1.5.2.2 skrll struct pfi_kif * 251 1.5.2.2 skrll pfi_lookup_create(const char *name) 252 1.5.2.2 skrll { 253 1.5.2.2 skrll struct pfi_kif *p, *q, key; 254 1.5.2.2 skrll int s; 255 1.5.2.2 skrll 256 1.5.2.2 skrll s = splsoftnet(); 257 1.5.2.2 skrll p = pfi_lookup_if(name); 258 1.5.2.2 skrll if (p == NULL) { 259 1.5.2.2 skrll pfi_copy_group(key.pfik_name, name, sizeof(key.pfik_name)); 260 1.5.2.2 skrll q = pfi_lookup_if(key.pfik_name); 261 1.5.2.5 skrll if (q == NULL) { 262 1.5.2.5 skrll pfi_newgroup(key.pfik_name, PFI_IFLAG_DYNAMIC); 263 1.5.2.5 skrll q = pfi_lookup_if(key.pfik_name); 264 1.5.2.5 skrll } 265 1.5.2.5 skrll p = pfi_lookup_if(name); 266 1.5.2.5 skrll if (p == NULL && q != NULL) 267 1.5.2.2 skrll p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE); 268 1.5.2.2 skrll } 269 1.5.2.2 skrll splx(s); 270 1.5.2.2 skrll return (p); 271 1.5.2.2 skrll } 272 1.5.2.2 skrll 273 1.5.2.2 skrll struct pfi_kif * 274 1.5.2.2 skrll pfi_attach_rule(const char *name) 275 1.5.2.2 skrll { 276 1.5.2.2 skrll struct pfi_kif *p; 277 1.5.2.2 skrll 278 1.5.2.2 skrll p = pfi_lookup_create(name); 279 1.5.2.2 skrll if (p != NULL) 280 1.5.2.2 skrll p->pfik_rules++; 281 1.5.2.2 skrll return (p); 282 1.5.2.2 skrll } 283 1.5.2.2 skrll 284 1.5.2.2 skrll void 285 1.5.2.2 skrll pfi_detach_rule(struct pfi_kif *p) 286 1.5.2.2 skrll { 287 1.5.2.2 skrll if (p == NULL) 288 1.5.2.2 skrll return; 289 1.5.2.2 skrll if (p->pfik_rules > 0) 290 1.5.2.2 skrll p->pfik_rules--; 291 1.5.2.2 skrll else 292 1.5.2.2 skrll printf("pfi_detach_rule: reference count at 0\n"); 293 1.5.2.2 skrll pfi_maybe_destroy(p); 294 1.5.2.2 skrll } 295 1.5.2.2 skrll 296 1.5.2.2 skrll void 297 1.5.2.2 skrll pfi_attach_state(struct pfi_kif *p) 298 1.5.2.2 skrll { 299 1.5.2.2 skrll if (!p->pfik_states++) 300 1.5.2.2 skrll TAILQ_INSERT_TAIL(&pfi_statehead, p, pfik_w_states); 301 1.5.2.2 skrll } 302 1.5.2.2 skrll 303 1.5.2.2 skrll void 304 1.5.2.2 skrll pfi_detach_state(struct pfi_kif *p) 305 1.5.2.2 skrll { 306 1.5.2.2 skrll if (p == NULL) 307 1.5.2.2 skrll return; 308 1.5.2.2 skrll if (p->pfik_states <= 0) { 309 1.5.2.2 skrll printf("pfi_detach_state: reference count <= 0\n"); 310 1.5.2.2 skrll return; 311 1.5.2.2 skrll } 312 1.5.2.2 skrll if (!--p->pfik_states) 313 1.5.2.2 skrll TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 314 1.5.2.2 skrll pfi_maybe_destroy(p); 315 1.5.2.2 skrll } 316 1.5.2.2 skrll 317 1.5.2.2 skrll int 318 1.5.2.2 skrll pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 319 1.5.2.2 skrll { 320 1.5.2.2 skrll struct pfi_dynaddr *dyn; 321 1.5.2.2 skrll char tblname[PF_TABLE_NAME_SIZE]; 322 1.5.2.2 skrll struct pf_ruleset *ruleset = NULL; 323 1.5.2.2 skrll int s, rv = 0; 324 1.5.2.2 skrll 325 1.5.2.2 skrll if (aw->type != PF_ADDR_DYNIFTL) 326 1.5.2.2 skrll return (0); 327 1.5.2.2 skrll dyn = pool_get(&pfi_addr_pl, PR_NOWAIT); 328 1.5.2.2 skrll if (dyn == NULL) 329 1.5.2.2 skrll return (1); 330 1.5.2.2 skrll bzero(dyn, sizeof(*dyn)); 331 1.5.2.2 skrll 332 1.5.2.2 skrll s = splsoftnet(); 333 1.5.2.2 skrll dyn->pfid_kif = pfi_attach_rule(aw->v.ifname); 334 1.5.2.2 skrll if (dyn->pfid_kif == NULL) 335 1.5.2.2 skrll senderr(1); 336 1.5.2.2 skrll 337 1.5.2.2 skrll dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 338 1.5.2.2 skrll if (af == AF_INET && dyn->pfid_net == 32) 339 1.5.2.2 skrll dyn->pfid_net = 128; 340 1.5.2.2 skrll strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 341 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_NETWORK) 342 1.5.2.2 skrll strlcat(tblname, ":network", sizeof(tblname)); 343 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_BROADCAST) 344 1.5.2.2 skrll strlcat(tblname, ":broadcast", sizeof(tblname)); 345 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_PEER) 346 1.5.2.2 skrll strlcat(tblname, ":peer", sizeof(tblname)); 347 1.5.2.2 skrll if (aw->iflags & PFI_AFLAG_NOALIAS) 348 1.5.2.2 skrll strlcat(tblname, ":0", sizeof(tblname)); 349 1.5.2.2 skrll if (dyn->pfid_net != 128) 350 1.5.2.2 skrll snprintf(tblname + strlen(tblname), 351 1.5.2.2 skrll sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 352 1.5.2.5 skrll ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR); 353 1.5.2.2 skrll if (ruleset == NULL) 354 1.5.2.2 skrll senderr(1); 355 1.5.2.2 skrll 356 1.5.2.2 skrll dyn->pfid_kt = pfr_attach_table(ruleset, tblname); 357 1.5.2.2 skrll if (dyn->pfid_kt == NULL) 358 1.5.2.2 skrll senderr(1); 359 1.5.2.2 skrll 360 1.5.2.2 skrll dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 361 1.5.2.2 skrll dyn->pfid_iflags = aw->iflags; 362 1.5.2.2 skrll dyn->pfid_af = af; 363 1.5.2.2 skrll dyn->pfid_hook_cookie = hook_establish(dyn->pfid_kif->pfik_ah_head, 1, 364 1.5.2.2 skrll pfi_dynaddr_update, dyn); 365 1.5.2.2 skrll if (dyn->pfid_hook_cookie == NULL) 366 1.5.2.2 skrll senderr(1); 367 1.5.2.2 skrll 368 1.5.2.2 skrll aw->p.dyn = dyn; 369 1.5.2.2 skrll pfi_dynaddr_update(aw->p.dyn); 370 1.5.2.2 skrll splx(s); 371 1.5.2.2 skrll return (0); 372 1.5.2.2 skrll 373 1.5.2.2 skrll _bad: 374 1.5.2.2 skrll if (dyn->pfid_kt != NULL) 375 1.5.2.2 skrll pfr_detach_table(dyn->pfid_kt); 376 1.5.2.2 skrll if (ruleset != NULL) 377 1.5.2.2 skrll pf_remove_if_empty_ruleset(ruleset); 378 1.5.2.2 skrll if (dyn->pfid_kif != NULL) 379 1.5.2.2 skrll pfi_detach_rule(dyn->pfid_kif); 380 1.5.2.2 skrll pool_put(&pfi_addr_pl, dyn); 381 1.5.2.2 skrll splx(s); 382 1.5.2.2 skrll return (rv); 383 1.5.2.2 skrll } 384 1.5.2.2 skrll 385 1.5.2.2 skrll void 386 1.5.2.2 skrll pfi_dynaddr_update(void *p) 387 1.5.2.2 skrll { 388 1.5.2.2 skrll struct pfi_dynaddr *dyn = (struct pfi_dynaddr *)p; 389 1.5.2.7 skrll struct pfi_kif *kif; 390 1.5.2.7 skrll struct pfr_ktable *kt; 391 1.5.2.2 skrll 392 1.5.2.7 skrll if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) 393 1.5.2.2 skrll panic("pfi_dynaddr_update"); 394 1.5.2.7 skrll 395 1.5.2.7 skrll kif = dyn->pfid_kif; 396 1.5.2.7 skrll kt = dyn->pfid_kt; 397 1.5.2.2 skrll if (kt->pfrkt_larg != pfi_update) { 398 1.5.2.2 skrll /* this table needs to be brought up-to-date */ 399 1.5.2.2 skrll pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 400 1.5.2.2 skrll kt->pfrkt_larg = pfi_update; 401 1.5.2.2 skrll } 402 1.5.2.2 skrll pfr_dynaddr_update(kt, dyn); 403 1.5.2.2 skrll } 404 1.5.2.2 skrll 405 1.5.2.2 skrll void 406 1.5.2.2 skrll pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 407 1.5.2.2 skrll { 408 1.5.2.2 skrll int e, size2 = 0; 409 1.5.2.2 skrll struct pfi_kif *p; 410 1.5.2.2 skrll struct pfr_table t; 411 1.5.2.2 skrll 412 1.5.2.2 skrll if ((kif->pfik_flags & PFI_IFLAG_INSTANCE) && kif->pfik_ifp == NULL) { 413 1.5.2.2 skrll pfr_clr_addrs(&kt->pfrkt_t, NULL, 0); 414 1.5.2.2 skrll return; 415 1.5.2.2 skrll } 416 1.5.2.2 skrll pfi_buffer_cnt = 0; 417 1.5.2.2 skrll if ((kif->pfik_flags & PFI_IFLAG_INSTANCE)) 418 1.5.2.2 skrll pfi_instance_add(kif->pfik_ifp, net, flags); 419 1.5.2.2 skrll else if (strcmp(kif->pfik_name, "self")) { 420 1.5.2.2 skrll TAILQ_FOREACH(p, &kif->pfik_grouphead, pfik_instances) 421 1.5.2.2 skrll pfi_instance_add(p->pfik_ifp, net, flags); 422 1.5.2.2 skrll } else { 423 1.5.2.2 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) 424 1.5.2.2 skrll if (p->pfik_flags & PFI_IFLAG_INSTANCE) 425 1.5.2.2 skrll pfi_instance_add(p->pfik_ifp, net, flags); 426 1.5.2.2 skrll } 427 1.5.2.2 skrll t = kt->pfrkt_t; 428 1.5.2.2 skrll t.pfrt_flags = 0; 429 1.5.2.2 skrll if ((e = pfr_set_addrs(&t, pfi_buffer, pfi_buffer_cnt, &size2, 430 1.5.2.2 skrll NULL, NULL, NULL, 0))) 431 1.5.2.2 skrll printf("pfi_table_update: cannot set %d new addresses " 432 1.5.2.2 skrll "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 433 1.5.2.2 skrll } 434 1.5.2.2 skrll 435 1.5.2.2 skrll void 436 1.5.2.2 skrll pfi_instance_add(struct ifnet *ifp, int net, int flags) 437 1.5.2.2 skrll { 438 1.5.2.2 skrll struct ifaddr *ia; 439 1.5.2.2 skrll int got4 = 0, got6 = 0; 440 1.5.2.2 skrll int net2, af; 441 1.5.2.2 skrll 442 1.5.2.2 skrll if (ifp == NULL) 443 1.5.2.2 skrll return; 444 1.5.2.2 skrll TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) { 445 1.5.2.2 skrll if (ia->ifa_addr == NULL) 446 1.5.2.2 skrll continue; 447 1.5.2.2 skrll af = ia->ifa_addr->sa_family; 448 1.5.2.2 skrll if (af != AF_INET && af != AF_INET6) 449 1.5.2.2 skrll continue; 450 1.5.2.2 skrll if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 451 1.5.2.2 skrll continue; 452 1.5.2.2 skrll if ((flags & PFI_AFLAG_BROADCAST) && 453 1.5.2.2 skrll !(ifp->if_flags & IFF_BROADCAST)) 454 1.5.2.2 skrll continue; 455 1.5.2.2 skrll if ((flags & PFI_AFLAG_PEER) && 456 1.5.2.2 skrll !(ifp->if_flags & IFF_POINTOPOINT)) 457 1.5.2.2 skrll continue; 458 1.5.2.2 skrll if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 459 1.5.2.2 skrll IN6_IS_ADDR_LINKLOCAL( 460 1.5.2.2 skrll &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 461 1.5.2.2 skrll continue; 462 1.5.2.2 skrll if (flags & PFI_AFLAG_NOALIAS) { 463 1.5.2.2 skrll if (af == AF_INET && got4) 464 1.5.2.2 skrll continue; 465 1.5.2.2 skrll if (af == AF_INET6 && got6) 466 1.5.2.2 skrll continue; 467 1.5.2.2 skrll } 468 1.5.2.2 skrll if (af == AF_INET) 469 1.5.2.2 skrll got4 = 1; 470 1.5.2.5 skrll else if (af == AF_INET6) 471 1.5.2.2 skrll got6 = 1; 472 1.5.2.2 skrll net2 = net; 473 1.5.2.2 skrll if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 474 1.5.2.2 skrll if (af == AF_INET) { 475 1.5.2.2 skrll net2 = pfi_unmask(&((struct sockaddr_in *) 476 1.5.2.2 skrll ia->ifa_netmask)->sin_addr); 477 1.5.2.5 skrll } else if (af == AF_INET6) { 478 1.5.2.2 skrll net2 = pfi_unmask(&((struct sockaddr_in6 *) 479 1.5.2.2 skrll ia->ifa_netmask)->sin6_addr); 480 1.5.2.2 skrll } 481 1.5.2.2 skrll } 482 1.5.2.2 skrll if (af == AF_INET && net2 > 32) 483 1.5.2.2 skrll net2 = 32; 484 1.5.2.2 skrll if (flags & PFI_AFLAG_BROADCAST) 485 1.5.2.2 skrll pfi_address_add(ia->ifa_broadaddr, af, net2); 486 1.5.2.2 skrll else if (flags & PFI_AFLAG_PEER) 487 1.5.2.2 skrll pfi_address_add(ia->ifa_dstaddr, af, net2); 488 1.5.2.2 skrll else 489 1.5.2.2 skrll pfi_address_add(ia->ifa_addr, af, net2); 490 1.5.2.2 skrll } 491 1.5.2.2 skrll } 492 1.5.2.2 skrll 493 1.5.2.2 skrll void 494 1.5.2.2 skrll pfi_address_add(struct sockaddr *sa, int af, int net) 495 1.5.2.2 skrll { 496 1.5.2.2 skrll struct pfr_addr *p; 497 1.5.2.2 skrll int i; 498 1.5.2.2 skrll 499 1.5.2.2 skrll if (pfi_buffer_cnt >= pfi_buffer_max) { 500 1.5.2.2 skrll int new_max = pfi_buffer_max * 2; 501 1.5.2.2 skrll 502 1.5.2.2 skrll if (new_max > PFI_BUFFER_MAX) { 503 1.5.2.2 skrll printf("pfi_address_add: address buffer full (%d/%d)\n", 504 1.5.2.2 skrll pfi_buffer_cnt, PFI_BUFFER_MAX); 505 1.5.2.2 skrll return; 506 1.5.2.2 skrll } 507 1.5.2.2 skrll p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, 508 1.5.2.2 skrll M_DONTWAIT); 509 1.5.2.2 skrll if (p == NULL) { 510 1.5.2.2 skrll printf("pfi_address_add: no memory to grow buffer " 511 1.5.2.2 skrll "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 512 1.5.2.2 skrll return; 513 1.5.2.2 skrll } 514 1.5.2.2 skrll memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer)); 515 1.5.2.2 skrll /* no need to zero buffer */ 516 1.5.2.2 skrll free(pfi_buffer, PFI_MTYPE); 517 1.5.2.2 skrll pfi_buffer = p; 518 1.5.2.2 skrll pfi_buffer_max = new_max; 519 1.5.2.2 skrll } 520 1.5.2.2 skrll if (af == AF_INET && net > 32) 521 1.5.2.2 skrll net = 128; 522 1.5.2.2 skrll p = pfi_buffer + pfi_buffer_cnt++; 523 1.5.2.2 skrll bzero(p, sizeof(*p)); 524 1.5.2.2 skrll p->pfra_af = af; 525 1.5.2.2 skrll p->pfra_net = net; 526 1.5.2.2 skrll if (af == AF_INET) 527 1.5.2.2 skrll p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 528 1.5.2.2 skrll if (af == AF_INET6) { 529 1.5.2.2 skrll p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 530 1.5.2.2 skrll if (IN6_IS_ADDR_LINKLOCAL(&p->pfra_ip6addr)) 531 1.5.2.2 skrll p->pfra_ip6addr.s6_addr16[1] = 0; 532 1.5.2.2 skrll } 533 1.5.2.2 skrll /* mask network address bits */ 534 1.5.2.2 skrll if (net < 128) 535 1.5.2.2 skrll ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 536 1.5.2.2 skrll for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 537 1.5.2.2 skrll ((caddr_t)p)[i] = 0; 538 1.5.2.2 skrll } 539 1.5.2.2 skrll 540 1.5.2.2 skrll void 541 1.5.2.2 skrll pfi_dynaddr_remove(struct pf_addr_wrap *aw) 542 1.5.2.2 skrll { 543 1.5.2.2 skrll int s; 544 1.5.2.2 skrll 545 1.5.2.2 skrll if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 546 1.5.2.2 skrll aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 547 1.5.2.2 skrll return; 548 1.5.2.2 skrll 549 1.5.2.2 skrll s = splsoftnet(); 550 1.5.2.2 skrll hook_disestablish(aw->p.dyn->pfid_kif->pfik_ah_head, 551 1.5.2.2 skrll aw->p.dyn->pfid_hook_cookie); 552 1.5.2.2 skrll pfi_detach_rule(aw->p.dyn->pfid_kif); 553 1.5.2.2 skrll aw->p.dyn->pfid_kif = NULL; 554 1.5.2.2 skrll pfr_detach_table(aw->p.dyn->pfid_kt); 555 1.5.2.2 skrll aw->p.dyn->pfid_kt = NULL; 556 1.5.2.2 skrll pool_put(&pfi_addr_pl, aw->p.dyn); 557 1.5.2.2 skrll aw->p.dyn = NULL; 558 1.5.2.2 skrll splx(s); 559 1.5.2.2 skrll } 560 1.5.2.2 skrll 561 1.5.2.2 skrll void 562 1.5.2.2 skrll pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 563 1.5.2.2 skrll { 564 1.5.2.2 skrll if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 565 1.5.2.2 skrll aw->p.dyn->pfid_kif == NULL) 566 1.5.2.2 skrll return; 567 1.5.2.2 skrll aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 568 1.5.2.2 skrll } 569 1.5.2.2 skrll 570 1.5.2.2 skrll void 571 1.5.2.2 skrll pfi_kifaddr_update(void *v) 572 1.5.2.2 skrll { 573 1.5.2.2 skrll int s; 574 1.5.2.2 skrll 575 1.5.2.2 skrll s = splsoftnet(); 576 1.5.2.2 skrll pfi_update++; 577 1.5.2.2 skrll pfi_dohooks(v); 578 1.5.2.2 skrll splx(s); 579 1.5.2.2 skrll } 580 1.5.2.2 skrll 581 1.5.2.2 skrll #ifdef __NetBSD__ 582 1.5.2.2 skrll void 583 1.5.2.2 skrll pfi_kifaddr_update_if(struct ifnet *ifp) 584 1.5.2.2 skrll { 585 1.5.2.2 skrll struct pfi_kif *p; 586 1.5.2.2 skrll 587 1.5.2.2 skrll p = pfi_lookup_if(ifp->if_xname); 588 1.5.2.2 skrll if (p == NULL) 589 1.5.2.2 skrll panic("can't find interface"); 590 1.5.2.2 skrll pfi_kifaddr_update(p); 591 1.5.2.2 skrll } 592 1.5.2.2 skrll #endif 593 1.5.2.2 skrll 594 1.5.2.2 skrll int 595 1.5.2.2 skrll pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 596 1.5.2.2 skrll { 597 1.5.2.2 skrll return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 598 1.5.2.2 skrll } 599 1.5.2.2 skrll 600 1.5.2.2 skrll struct pfi_kif * 601 1.5.2.2 skrll pfi_if_create(const char *name, struct pfi_kif *q, int flags) 602 1.5.2.2 skrll { 603 1.5.2.2 skrll struct pfi_kif *p; 604 1.5.2.2 skrll 605 1.5.2.2 skrll p = malloc(sizeof(*p), PFI_MTYPE, M_DONTWAIT); 606 1.5.2.2 skrll if (p == NULL) 607 1.5.2.2 skrll return (NULL); 608 1.5.2.2 skrll bzero(p, sizeof(*p)); 609 1.5.2.2 skrll p->pfik_ah_head = malloc(sizeof(*p->pfik_ah_head), PFI_MTYPE, 610 1.5.2.2 skrll M_DONTWAIT); 611 1.5.2.2 skrll if (p->pfik_ah_head == NULL) { 612 1.5.2.2 skrll free(p, PFI_MTYPE); 613 1.5.2.2 skrll return (NULL); 614 1.5.2.2 skrll } 615 1.5.2.2 skrll bzero(p->pfik_ah_head, sizeof(*p->pfik_ah_head)); 616 1.5.2.2 skrll TAILQ_INIT(p->pfik_ah_head); 617 1.5.2.2 skrll TAILQ_INIT(&p->pfik_grouphead); 618 1.5.2.2 skrll #ifdef __NetBSD__ 619 1.5.2.6 skrll bzero(&p->pfik_ifaddrhooks, sizeof(p->pfik_ifaddrhooks)); 620 1.5.2.6 skrll TAILQ_INIT(&p->pfik_ifaddrhooks); 621 1.5.2.2 skrll #endif 622 1.5.2.2 skrll strlcpy(p->pfik_name, name, sizeof(p->pfik_name)); 623 1.5.2.2 skrll RB_INIT(&p->pfik_lan_ext); 624 1.5.2.2 skrll RB_INIT(&p->pfik_ext_gwy); 625 1.5.2.2 skrll p->pfik_flags = flags; 626 1.5.2.2 skrll p->pfik_parent = q; 627 1.5.2.5 skrll p->pfik_tzero = time_second; 628 1.5.2.2 skrll 629 1.5.2.2 skrll RB_INSERT(pfi_ifhead, &pfi_ifs, p); 630 1.5.2.2 skrll if (q != NULL) { 631 1.5.2.2 skrll q->pfik_addcnt++; 632 1.5.2.2 skrll TAILQ_INSERT_TAIL(&q->pfik_grouphead, p, pfik_instances); 633 1.5.2.2 skrll } 634 1.5.2.2 skrll pfi_ifcnt++; 635 1.5.2.2 skrll return (p); 636 1.5.2.2 skrll } 637 1.5.2.2 skrll 638 1.5.2.2 skrll int 639 1.5.2.2 skrll pfi_maybe_destroy(struct pfi_kif *p) 640 1.5.2.2 skrll { 641 1.5.2.2 skrll int i, j, k, s; 642 1.5.2.2 skrll struct pfi_kif *q = p->pfik_parent; 643 1.5.2.2 skrll 644 1.5.2.2 skrll if ((p->pfik_flags & (PFI_IFLAG_ATTACHED | PFI_IFLAG_GROUP)) || 645 1.5.2.2 skrll p->pfik_rules > 0 || p->pfik_states > 0) 646 1.5.2.2 skrll return (0); 647 1.5.2.2 skrll 648 1.5.2.2 skrll s = splsoftnet(); 649 1.5.2.2 skrll if (q != NULL) { 650 1.5.2.2 skrll for (i = 0; i < 2; i++) 651 1.5.2.2 skrll for (j = 0; j < 2; j++) 652 1.5.2.2 skrll for (k = 0; k < 2; k++) { 653 1.5.2.2 skrll q->pfik_bytes[i][j][k] += 654 1.5.2.2 skrll p->pfik_bytes[i][j][k]; 655 1.5.2.2 skrll q->pfik_packets[i][j][k] += 656 1.5.2.2 skrll p->pfik_packets[i][j][k]; 657 1.5.2.2 skrll } 658 1.5.2.2 skrll q->pfik_delcnt++; 659 1.5.2.2 skrll TAILQ_REMOVE(&q->pfik_grouphead, p, pfik_instances); 660 1.5.2.2 skrll } 661 1.5.2.2 skrll pfi_ifcnt--; 662 1.5.2.2 skrll RB_REMOVE(pfi_ifhead, &pfi_ifs, p); 663 1.5.2.2 skrll splx(s); 664 1.5.2.2 skrll 665 1.5.2.2 skrll free(p->pfik_ah_head, PFI_MTYPE); 666 1.5.2.2 skrll free(p, PFI_MTYPE); 667 1.5.2.2 skrll return (1); 668 1.5.2.2 skrll } 669 1.5.2.2 skrll 670 1.5.2.2 skrll void 671 1.5.2.2 skrll pfi_copy_group(char *p, const char *q, int m) 672 1.5.2.2 skrll { 673 1.5.2.2 skrll while (m > 1 && *q && !(*q >= '0' && *q <= '9')) { 674 1.5.2.2 skrll *p++ = *q++; 675 1.5.2.2 skrll m--; 676 1.5.2.2 skrll } 677 1.5.2.2 skrll if (m > 0) 678 1.5.2.2 skrll *p++ = '\0'; 679 1.5.2.2 skrll } 680 1.5.2.2 skrll 681 1.5.2.2 skrll void 682 1.5.2.2 skrll pfi_newgroup(const char *name, int flags) 683 1.5.2.2 skrll { 684 1.5.2.2 skrll struct pfi_kif *p; 685 1.5.2.2 skrll 686 1.5.2.2 skrll p = pfi_lookup_if(name); 687 1.5.2.2 skrll if (p == NULL) 688 1.5.2.2 skrll p = pfi_if_create(name, pfi_self, PFI_IFLAG_GROUP); 689 1.5.2.2 skrll if (p == NULL) { 690 1.5.2.2 skrll printf("pfi_newgroup: cannot allocate '%s' group", name); 691 1.5.2.2 skrll return; 692 1.5.2.2 skrll } 693 1.5.2.2 skrll p->pfik_flags |= flags; 694 1.5.2.2 skrll } 695 1.5.2.2 skrll 696 1.5.2.2 skrll void 697 1.5.2.2 skrll pfi_fill_oldstatus(struct pf_status *pfs) 698 1.5.2.2 skrll { 699 1.5.2.2 skrll struct pfi_kif *p, key; 700 1.5.2.2 skrll int i, j, k, s; 701 1.5.2.2 skrll 702 1.5.2.2 skrll strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name)); 703 1.5.2.2 skrll s = splsoftnet(); 704 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 705 1.5.2.2 skrll if (p == NULL) { 706 1.5.2.2 skrll splx(s); 707 1.5.2.2 skrll return; 708 1.5.2.2 skrll } 709 1.5.2.2 skrll bzero(pfs->pcounters, sizeof(pfs->pcounters)); 710 1.5.2.2 skrll bzero(pfs->bcounters, sizeof(pfs->bcounters)); 711 1.5.2.2 skrll for (i = 0; i < 2; i++) 712 1.5.2.2 skrll for (j = 0; j < 2; j++) 713 1.5.2.2 skrll for (k = 0; k < 2; k++) { 714 1.5.2.2 skrll pfs->pcounters[i][j][k] = 715 1.5.2.2 skrll p->pfik_packets[i][j][k]; 716 1.5.2.2 skrll pfs->bcounters[i][j] += 717 1.5.2.2 skrll p->pfik_bytes[i][j][k]; 718 1.5.2.2 skrll } 719 1.5.2.2 skrll splx(s); 720 1.5.2.2 skrll } 721 1.5.2.2 skrll 722 1.5.2.2 skrll int 723 1.5.2.2 skrll pfi_clr_istats(const char *name, int *nzero, int flags) 724 1.5.2.2 skrll { 725 1.5.2.2 skrll struct pfi_kif *p; 726 1.5.2.2 skrll int n = 0, s; 727 1.5.2.5 skrll long tzero = time_second; 728 1.5.2.2 skrll 729 1.5.2.2 skrll ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 730 1.5.2.7 skrll s = splsoftnet(); 731 1.5.2.2 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 732 1.5.2.2 skrll if (pfi_skip_if(name, p, flags)) 733 1.5.2.2 skrll continue; 734 1.5.2.2 skrll bzero(p->pfik_packets, sizeof(p->pfik_packets)); 735 1.5.2.2 skrll bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 736 1.5.2.2 skrll p->pfik_tzero = tzero; 737 1.5.2.2 skrll n++; 738 1.5.2.2 skrll } 739 1.5.2.2 skrll splx(s); 740 1.5.2.2 skrll if (nzero != NULL) 741 1.5.2.2 skrll *nzero = n; 742 1.5.2.2 skrll return (0); 743 1.5.2.2 skrll } 744 1.5.2.2 skrll 745 1.5.2.2 skrll int 746 1.5.2.7 skrll pfi_set_flags(const char *name, int flags) 747 1.5.2.7 skrll { 748 1.5.2.7 skrll struct pfi_kif *p; 749 1.5.2.7 skrll int s; 750 1.5.2.7 skrll 751 1.5.2.7 skrll if (flags & ~PFI_IFLAG_SETABLE_MASK) 752 1.5.2.7 skrll return (EINVAL); 753 1.5.2.7 skrll 754 1.5.2.7 skrll s = splsoftnet(); 755 1.5.2.7 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 756 1.5.2.7 skrll if (pfi_skip_if(name, p, PFI_FLAG_GROUP|PFI_FLAG_INSTANCE)) 757 1.5.2.7 skrll continue; 758 1.5.2.7 skrll p->pfik_flags |= flags; 759 1.5.2.7 skrll } 760 1.5.2.7 skrll splx(s); 761 1.5.2.7 skrll return (0); 762 1.5.2.7 skrll } 763 1.5.2.7 skrll 764 1.5.2.7 skrll int 765 1.5.2.7 skrll pfi_clear_flags(const char *name, int flags) 766 1.5.2.7 skrll { 767 1.5.2.7 skrll struct pfi_kif *p; 768 1.5.2.7 skrll int s; 769 1.5.2.7 skrll 770 1.5.2.7 skrll if (flags & ~PFI_IFLAG_SETABLE_MASK) 771 1.5.2.7 skrll return (EINVAL); 772 1.5.2.7 skrll 773 1.5.2.7 skrll s = splsoftnet(); 774 1.5.2.7 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 775 1.5.2.7 skrll if (pfi_skip_if(name, p, PFI_FLAG_GROUP|PFI_FLAG_INSTANCE)) 776 1.5.2.7 skrll continue; 777 1.5.2.7 skrll p->pfik_flags &= ~flags; 778 1.5.2.7 skrll } 779 1.5.2.7 skrll splx(s); 780 1.5.2.7 skrll return (0); 781 1.5.2.7 skrll } 782 1.5.2.7 skrll 783 1.5.2.7 skrll int 784 1.5.2.2 skrll pfi_get_ifaces(const char *name, struct pfi_if *buf, int *size, int flags) 785 1.5.2.2 skrll { 786 1.5.2.2 skrll struct pfi_kif *p; 787 1.5.2.2 skrll int s, n = 0; 788 1.5.2.2 skrll 789 1.5.2.2 skrll ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 790 1.5.2.2 skrll s = splsoftnet(); 791 1.5.2.2 skrll RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 792 1.5.2.2 skrll if (pfi_skip_if(name, p, flags)) 793 1.5.2.2 skrll continue; 794 1.5.2.2 skrll if (*size > n++) { 795 1.5.2.2 skrll if (!p->pfik_tzero) 796 1.5.2.5 skrll p->pfik_tzero = time_second; 797 1.5.2.2 skrll if (copyout(p, buf++, sizeof(*buf))) { 798 1.5.2.2 skrll splx(s); 799 1.5.2.2 skrll return (EFAULT); 800 1.5.2.2 skrll } 801 1.5.2.2 skrll } 802 1.5.2.2 skrll } 803 1.5.2.2 skrll splx(s); 804 1.5.2.2 skrll *size = n; 805 1.5.2.2 skrll return (0); 806 1.5.2.2 skrll } 807 1.5.2.2 skrll 808 1.5.2.2 skrll struct pfi_kif * 809 1.5.2.2 skrll pfi_lookup_if(const char *name) 810 1.5.2.2 skrll { 811 1.5.2.2 skrll struct pfi_kif *p, key; 812 1.5.2.2 skrll 813 1.5.2.2 skrll strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 814 1.5.2.2 skrll p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 815 1.5.2.2 skrll return (p); 816 1.5.2.2 skrll } 817 1.5.2.2 skrll 818 1.5.2.2 skrll int 819 1.5.2.2 skrll pfi_skip_if(const char *filter, struct pfi_kif *p, int f) 820 1.5.2.2 skrll { 821 1.5.2.2 skrll int n; 822 1.5.2.2 skrll 823 1.5.2.2 skrll if ((p->pfik_flags & PFI_IFLAG_GROUP) && !(f & PFI_FLAG_GROUP)) 824 1.5.2.2 skrll return (1); 825 1.5.2.2 skrll if ((p->pfik_flags & PFI_IFLAG_INSTANCE) && !(f & PFI_FLAG_INSTANCE)) 826 1.5.2.2 skrll return (1); 827 1.5.2.2 skrll if (filter == NULL || !*filter) 828 1.5.2.2 skrll return (0); 829 1.5.2.2 skrll if (!strcmp(p->pfik_name, filter)) 830 1.5.2.2 skrll return (0); /* exact match */ 831 1.5.2.2 skrll n = strlen(filter); 832 1.5.2.2 skrll if (n < 1 || n >= IFNAMSIZ) 833 1.5.2.2 skrll return (1); /* sanity check */ 834 1.5.2.2 skrll if (filter[n-1] >= '0' && filter[n-1] <= '9') 835 1.5.2.2 skrll return (1); /* only do exact match in that case */ 836 1.5.2.2 skrll if (strncmp(p->pfik_name, filter, n)) 837 1.5.2.2 skrll return (1); /* prefix doesn't match */ 838 1.5.2.2 skrll return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 839 1.5.2.2 skrll } 840 1.5.2.2 skrll 841 1.5.2.2 skrll /* from pf_print_state.c */ 842 1.5.2.2 skrll int 843 1.5.2.2 skrll pfi_unmask(void *addr) 844 1.5.2.2 skrll { 845 1.5.2.2 skrll struct pf_addr *m = addr; 846 1.5.2.2 skrll int i = 31, j = 0, b = 0; 847 1.5.2.2 skrll u_int32_t tmp; 848 1.5.2.2 skrll 849 1.5.2.2 skrll while (j < 4 && m->addr32[j] == 0xffffffff) { 850 1.5.2.2 skrll b += 32; 851 1.5.2.2 skrll j++; 852 1.5.2.2 skrll } 853 1.5.2.2 skrll if (j < 4) { 854 1.5.2.2 skrll tmp = ntohl(m->addr32[j]); 855 1.5.2.2 skrll for (i = 31; tmp & (1 << i); --i) 856 1.5.2.2 skrll b++; 857 1.5.2.2 skrll } 858 1.5.2.2 skrll return (b); 859 1.5.2.2 skrll } 860 1.5.2.2 skrll 861 1.5.2.2 skrll void 862 1.5.2.2 skrll pfi_dohooks(struct pfi_kif *p) 863 1.5.2.2 skrll { 864 1.5.2.2 skrll for (; p != NULL; p = p->pfik_parent) 865 1.5.2.2 skrll dohooks(p->pfik_ah_head, 0); 866 1.5.2.2 skrll } 867 1.5.2.2 skrll 868 1.5.2.2 skrll int 869 1.5.2.2 skrll pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 870 1.5.2.2 skrll { 871 1.5.2.5 skrll switch (af) { 872 1.5.2.5 skrll #ifdef INET 873 1.5.2.5 skrll case AF_INET: 874 1.5.2.2 skrll switch (dyn->pfid_acnt4) { 875 1.5.2.2 skrll case 0: 876 1.5.2.2 skrll return (0); 877 1.5.2.2 skrll case 1: 878 1.5.2.2 skrll return (PF_MATCHA(0, &dyn->pfid_addr4, 879 1.5.2.2 skrll &dyn->pfid_mask4, a, AF_INET)); 880 1.5.2.2 skrll default: 881 1.5.2.2 skrll return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 882 1.5.2.2 skrll } 883 1.5.2.5 skrll break; 884 1.5.2.5 skrll #endif /* INET */ 885 1.5.2.5 skrll #ifdef INET6 886 1.5.2.5 skrll case AF_INET6: 887 1.5.2.2 skrll switch (dyn->pfid_acnt6) { 888 1.5.2.2 skrll case 0: 889 1.5.2.2 skrll return (0); 890 1.5.2.2 skrll case 1: 891 1.5.2.2 skrll return (PF_MATCHA(0, &dyn->pfid_addr6, 892 1.5.2.2 skrll &dyn->pfid_mask6, a, AF_INET6)); 893 1.5.2.2 skrll default: 894 1.5.2.2 skrll return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 895 1.5.2.2 skrll } 896 1.5.2.5 skrll break; 897 1.5.2.5 skrll #endif /* INET6 */ 898 1.5.2.5 skrll default: 899 1.5.2.5 skrll return (0); 900 1.5.2.2 skrll } 901 1.5.2.2 skrll } 902 1.5.2.2 skrll 903 1.5.2.2 skrll /* from openbsd/sys/kern/kern_subr.c */ 904 1.5.2.2 skrll #ifdef __NetBSD__ 905 1.5.2.2 skrll static void * 906 1.5.2.2 skrll hook_establish(struct hook_desc_head *head, int tail, void (*fn)(void *), 907 1.5.2.2 skrll void *arg) 908 1.5.2.2 skrll { 909 1.5.2.2 skrll struct hook_desc *hdp; 910 1.5.2.2 skrll 911 1.5.2.2 skrll hdp = (struct hook_desc *)malloc(sizeof (*hdp), M_DEVBUF, M_NOWAIT); 912 1.5.2.2 skrll if (hdp == NULL) 913 1.5.2.2 skrll return (NULL); 914 1.5.2.2 skrll 915 1.5.2.2 skrll hdp->hd_fn = fn; 916 1.5.2.2 skrll hdp->hd_arg = arg; 917 1.5.2.2 skrll if (tail) 918 1.5.2.2 skrll TAILQ_INSERT_TAIL(head, hdp, hd_list); 919 1.5.2.2 skrll else 920 1.5.2.2 skrll TAILQ_INSERT_HEAD(head, hdp, hd_list); 921 1.5.2.2 skrll 922 1.5.2.2 skrll return (hdp); 923 1.5.2.2 skrll } 924 1.5.2.2 skrll 925 1.5.2.2 skrll static void 926 1.5.2.2 skrll hook_disestablish(struct hook_desc_head *head, void *vhook) 927 1.5.2.2 skrll { 928 1.5.2.2 skrll struct hook_desc *hdp; 929 1.5.2.2 skrll 930 1.5.2.2 skrll #ifdef DIAGNOSTIC 931 1.5.2.2 skrll for (hdp = TAILQ_FIRST(head); hdp != NULL; 932 1.5.2.2 skrll hdp = TAILQ_NEXT(hdp, hd_list)) 933 1.5.2.2 skrll if (hdp == vhook) 934 1.5.2.2 skrll break; 935 1.5.2.2 skrll if (hdp == NULL) 936 1.5.2.2 skrll panic("hook_disestablish: hook not established"); 937 1.5.2.2 skrll #endif 938 1.5.2.2 skrll hdp = vhook; 939 1.5.2.2 skrll TAILQ_REMOVE(head, hdp, hd_list); 940 1.5.2.2 skrll free(hdp, M_DEVBUF); 941 1.5.2.2 skrll } 942 1.5.2.2 skrll 943 1.5.2.2 skrll static void 944 1.5.2.2 skrll dohooks(struct hook_desc_head *head, int flags) 945 1.5.2.2 skrll { 946 1.5.2.2 skrll struct hook_desc *hdp; 947 1.5.2.2 skrll 948 1.5.2.2 skrll if ((flags & HOOK_REMOVE) == 0) { 949 1.5.2.2 skrll TAILQ_FOREACH(hdp, head, hd_list) { 950 1.5.2.2 skrll (*hdp->hd_fn)(hdp->hd_arg); 951 1.5.2.2 skrll } 952 1.5.2.2 skrll } else { 953 1.5.2.2 skrll while ((hdp = TAILQ_FIRST(head)) != NULL) { 954 1.5.2.2 skrll TAILQ_REMOVE(head, hdp, hd_list); 955 1.5.2.2 skrll (*hdp->hd_fn)(hdp->hd_arg); 956 1.5.2.2 skrll if ((flags & HOOK_FREE) != 0) 957 1.5.2.2 skrll free(hdp, M_DEVBUF); 958 1.5.2.2 skrll } 959 1.5.2.2 skrll } 960 1.5.2.2 skrll } 961 1.5.2.2 skrll #endif 962
Indexes created Sun Oct 12 09:09:55 GMT 2025