pf_if.c revision 1.1
1 /* $OpenBSD: pf_if.c,v 1.11 2004/03/15 11:38:23 cedric Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2003 Cedric Berger 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/param.h> 34 #include <sys/systm.h> 35 #include <sys/mbuf.h> 36 #include <sys/filio.h> 37 #include <sys/socket.h> 38 #include <sys/socketvar.h> 39 #include <sys/kernel.h> 40 #include <sys/device.h> 41 #include <sys/time.h> 42 43 #include <net/if.h> 44 #include <net/if_types.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_var.h> 48 #include <netinet/in_systm.h> 49 #include <netinet/ip.h> 50 #include <netinet/ip_var.h> 51 52 #include <net/pfvar.h> 53 54 #ifdef INET6 55 #include <netinet/ip6.h> 56 #endif /* INET6 */ 57 58 #define ACCEPT_FLAGS(oklist) \ 59 do { \ 60 if ((flags & ~(oklist)) & \ 61 PFI_FLAG_ALLMASK) \ 62 return (EINVAL); \ 63 } while (0) 64 65 #define senderr(e) do { rv = (e); goto _bad; } while (0) 66 67 struct pfi_kif **pfi_index2kif; 68 struct pfi_kif *pfi_self; 69 int pfi_indexlim; 70 struct pfi_ifhead pfi_ifs; 71 struct pfi_statehead pfi_statehead; 72 int pfi_ifcnt; 73 struct pool pfi_addr_pl; 74 long pfi_update = 1; 75 struct pfr_addr *pfi_buffer; 76 int pfi_buffer_cnt; 77 int pfi_buffer_max; 78 char pfi_reserved_anchor[PF_ANCHOR_NAME_SIZE] = 79 PF_RESERVED_ANCHOR; 80 char pfi_interface_ruleset[PF_RULESET_NAME_SIZE] = 81 PF_INTERFACE_RULESET; 82 83 void pfi_dynaddr_update(void *); 84 void pfi_kifaddr_update(void *); 85 void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, 86 int, int); 87 void pfi_instance_add(struct ifnet *, int, int); 88 void pfi_address_add(struct sockaddr *, int, int); 89 int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 90 struct pfi_kif *pfi_if_create(const char *, struct pfi_kif *, int); 91 void pfi_copy_group(char *, const char *, int); 92 void pfi_dynamic_drivers(void); 93 void pfi_newgroup(const char *, int); 94 int pfi_skip_if(const char *, struct pfi_kif *, int); 95 int pfi_unmask(void *); 96 void pfi_dohooks(struct pfi_kif *); 97 98 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 99 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 100 101 #define PFI_DYNAMIC_BUSES { "pcmcia", "cardbus", "uhub" } 102 #define PFI_BUFFER_MAX 0x10000 103 #define PFI_MTYPE M_IFADDR 104 105 void 106 pfi_initialize(void) 107 { 108 if (pfi_self != NULL) /* already initialized */ 109 return; 110 111 TAILQ_INIT(&pfi_statehead); 112 pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0, 113 "pfiaddrpl", &pool_allocator_nointr); 114 pfi_buffer_max = 64; 115 pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer), 116 PFI_MTYPE, M_WAITOK); 117 pfi_self = pfi_if_create("self", NULL, PFI_IFLAG_GROUP); 118 pfi_dynamic_drivers(); 119 } 120 121 void 122 pfi_attach_clone(struct if_clone *ifc) 123 { 124 pfi_initialize(); 125 pfi_newgroup(ifc->ifc_name, PFI_IFLAG_CLONABLE); 126 } 127 128 void 129 pfi_attach_ifnet(struct ifnet *ifp) 130 { 131 struct pfi_kif *p, *q, key; 132 int s; 133 134 pfi_initialize(); 135 s = splsoftnet(); 136 pfi_update++; 137 if (ifp->if_index >= pfi_indexlim) { 138 /* 139 * grow pfi_index2kif, similar to ifindex2ifnet code in if.c 140 */ 141 size_t m, n, oldlim; 142 struct pfi_kif **mp, **np; 143 144 oldlim = pfi_indexlim; 145 if (pfi_indexlim == 0) 146 pfi_indexlim = 64; 147 while (ifp->if_index >= pfi_indexlim) 148 pfi_indexlim <<= 1; 149 150 m = oldlim * sizeof(struct pfi_kif *); 151 mp = pfi_index2kif; 152 n = pfi_indexlim * sizeof(struct pfi_kif *); 153 np = malloc(n, PFI_MTYPE, M_DONTWAIT); 154 if (np == NULL) 155 panic("pfi_attach_ifnet: " 156 "cannot allocate translation table"); 157 bzero(np, n); 158 if (mp != NULL) 159 bcopy(mp, np, m); 160 pfi_index2kif = np; 161 if (mp != NULL) 162 free(mp, PFI_MTYPE); 163 } 164 165 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 166 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 167 if (p == NULL) { 168 /* add group */ 169 pfi_copy_group(key.pfik_name, ifp->if_xname, 170 sizeof(key.pfik_name)); 171 q = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 172 if (q == NULL) 173 q = pfi_if_create(key.pfik_name, pfi_self, PFI_IFLAG_GROUP); 174 if (q == NULL) 175 panic("pfi_attach_ifnet: " 176 "cannot allocate '%s' group", key.pfik_name); 177 178 /* add interface */ 179 p = pfi_if_create(ifp->if_xname, q, PFI_IFLAG_INSTANCE); 180 if (p == NULL) 181 panic("pfi_attach_ifnet: " 182 "cannot allocate '%s' interface", ifp->if_xname); 183 } else 184 q = p->pfik_parent; 185 p->pfik_ifp = ifp; 186 p->pfik_flags |= PFI_IFLAG_ATTACHED; 187 p->pfik_ah_cookie = 188 hook_establish(ifp->if_addrhooks, 1, pfi_kifaddr_update, p); 189 pfi_index2kif[ifp->if_index] = p; 190 pfi_dohooks(p); 191 splx(s); 192 } 193 194 void 195 pfi_detach_ifnet(struct ifnet *ifp) 196 { 197 struct pfi_kif *p, *q, key; 198 int s; 199 200 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 201 202 s = splsoftnet(); 203 pfi_update++; 204 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 205 if (p == NULL) { 206 printf("pfi_detach_ifnet: cannot find %s", ifp->if_xname); 207 splx(s); 208 return; 209 } 210 hook_disestablish(p->pfik_ifp->if_addrhooks, p->pfik_ah_cookie); 211 q = p->pfik_parent; 212 p->pfik_ifp = NULL; 213 p->pfik_flags &= ~PFI_IFLAG_ATTACHED; 214 pfi_index2kif[ifp->if_index] = NULL; 215 pfi_dohooks(p); 216 pfi_maybe_destroy(p); 217 splx(s); 218 } 219 220 struct pfi_kif * 221 pfi_lookup_create(const char *name) 222 { 223 struct pfi_kif *p, *q, key; 224 int s; 225 226 s = splsoftnet(); 227 p = pfi_lookup_if(name); 228 if (p == NULL) { 229 pfi_copy_group(key.pfik_name, name, sizeof(key.pfik_name)); 230 q = pfi_lookup_if(key.pfik_name); 231 if (q != NULL) 232 p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE); 233 } 234 splx(s); 235 return (p); 236 } 237 238 struct pfi_kif * 239 pfi_attach_rule(const char *name) 240 { 241 struct pfi_kif *p; 242 243 p = pfi_lookup_create(name); 244 if (p != NULL) 245 p->pfik_rules++; 246 return (p); 247 } 248 249 void 250 pfi_detach_rule(struct pfi_kif *p) 251 { 252 if (p == NULL) 253 return; 254 if (p->pfik_rules > 0) 255 p->pfik_rules--; 256 else 257 printf("pfi_detach_rule: reference count at 0\n"); 258 pfi_maybe_destroy(p); 259 } 260 261 void 262 pfi_attach_state(struct pfi_kif *p) 263 { 264 if (!p->pfik_states++) 265 TAILQ_INSERT_TAIL(&pfi_statehead, p, pfik_w_states); 266 } 267 268 void 269 pfi_detach_state(struct pfi_kif *p) 270 { 271 if (p == NULL) 272 return; 273 if (p->pfik_states <= 0) { 274 printf("pfi_detach_state: reference count <= 0\n"); 275 return; 276 } 277 if (!--p->pfik_states) 278 TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 279 pfi_maybe_destroy(p); 280 } 281 282 int 283 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 284 { 285 struct pfi_dynaddr *dyn; 286 char tblname[PF_TABLE_NAME_SIZE]; 287 struct pf_ruleset *ruleset = NULL; 288 int s, rv = 0; 289 290 if (aw->type != PF_ADDR_DYNIFTL) 291 return (0); 292 dyn = pool_get(&pfi_addr_pl, PR_NOWAIT); 293 if (dyn == NULL) 294 return (1); 295 bzero(dyn, sizeof(*dyn)); 296 297 s = splsoftnet(); 298 dyn->pfid_kif = pfi_attach_rule(aw->v.ifname); 299 if (dyn->pfid_kif == NULL) 300 senderr(1); 301 302 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 303 if (af == AF_INET && dyn->pfid_net == 32) 304 dyn->pfid_net = 128; 305 strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 306 if (aw->iflags & PFI_AFLAG_NETWORK) 307 strlcat(tblname, ":network", sizeof(tblname)); 308 if (aw->iflags & PFI_AFLAG_BROADCAST) 309 strlcat(tblname, ":broadcast", sizeof(tblname)); 310 if (aw->iflags & PFI_AFLAG_PEER) 311 strlcat(tblname, ":peer", sizeof(tblname)); 312 if (aw->iflags & PFI_AFLAG_NOALIAS) 313 strlcat(tblname, ":0", sizeof(tblname)); 314 if (dyn->pfid_net != 128) 315 snprintf(tblname + strlen(tblname), 316 sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 317 ruleset = pf_find_or_create_ruleset(pfi_reserved_anchor, 318 pfi_interface_ruleset); 319 if (ruleset == NULL) 320 senderr(1); 321 322 dyn->pfid_kt = pfr_attach_table(ruleset, tblname); 323 if (dyn->pfid_kt == NULL) 324 senderr(1); 325 326 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 327 dyn->pfid_iflags = aw->iflags; 328 dyn->pfid_af = af; 329 dyn->pfid_hook_cookie = hook_establish(dyn->pfid_kif->pfik_ah_head, 1, 330 pfi_dynaddr_update, dyn); 331 if (dyn->pfid_hook_cookie == NULL) 332 senderr(1); 333 334 aw->p.dyn = dyn; 335 pfi_dynaddr_update(aw->p.dyn); 336 splx(s); 337 return (0); 338 339 _bad: 340 if (dyn->pfid_kt != NULL) 341 pfr_detach_table(dyn->pfid_kt); 342 if (ruleset != NULL) 343 pf_remove_if_empty_ruleset(ruleset); 344 if (dyn->pfid_kif != NULL) 345 pfi_detach_rule(dyn->pfid_kif); 346 pool_put(&pfi_addr_pl, dyn); 347 splx(s); 348 return (rv); 349 } 350 351 void 352 pfi_dynaddr_update(void *p) 353 { 354 struct pfi_dynaddr *dyn = (struct pfi_dynaddr *)p; 355 struct pfi_kif *kif = dyn->pfid_kif; 356 struct pfr_ktable *kt = dyn->pfid_kt; 357 358 if (dyn == NULL || kif == NULL || kt == NULL) 359 panic("pfi_dynaddr_update"); 360 if (kt->pfrkt_larg != pfi_update) { 361 /* this table needs to be brought up-to-date */ 362 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 363 kt->pfrkt_larg = pfi_update; 364 } 365 pfr_dynaddr_update(kt, dyn); 366 } 367 368 void 369 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 370 { 371 int e, size2 = 0; 372 struct pfi_kif *p; 373 struct pfr_table t; 374 375 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE) && kif->pfik_ifp == NULL) { 376 pfr_clr_addrs(&kt->pfrkt_t, NULL, 0); 377 return; 378 } 379 pfi_buffer_cnt = 0; 380 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE)) 381 pfi_instance_add(kif->pfik_ifp, net, flags); 382 else if (strcmp(kif->pfik_name, "self")) { 383 TAILQ_FOREACH(p, &kif->pfik_grouphead, pfik_instances) 384 pfi_instance_add(p->pfik_ifp, net, flags); 385 } else { 386 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) 387 if (p->pfik_flags & PFI_IFLAG_INSTANCE) 388 pfi_instance_add(p->pfik_ifp, net, flags); 389 } 390 t = kt->pfrkt_t; 391 t.pfrt_flags = 0; 392 if ((e = pfr_set_addrs(&t, pfi_buffer, pfi_buffer_cnt, &size2, 393 NULL, NULL, NULL, 0))) 394 printf("pfi_table_update: cannot set %d new addresses " 395 "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 396 } 397 398 void 399 pfi_instance_add(struct ifnet *ifp, int net, int flags) 400 { 401 struct ifaddr *ia; 402 int got4 = 0, got6 = 0; 403 int net2, af; 404 405 if (ifp == NULL) 406 return; 407 TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) { 408 if (ia->ifa_addr == NULL) 409 continue; 410 af = ia->ifa_addr->sa_family; 411 if (af != AF_INET && af != AF_INET6) 412 continue; 413 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 414 continue; 415 if ((flags & PFI_AFLAG_BROADCAST) && 416 !(ifp->if_flags & IFF_BROADCAST)) 417 continue; 418 if ((flags & PFI_AFLAG_PEER) && 419 !(ifp->if_flags & IFF_POINTOPOINT)) 420 continue; 421 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 422 IN6_IS_ADDR_LINKLOCAL( 423 &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 424 continue; 425 if (flags & PFI_AFLAG_NOALIAS) { 426 if (af == AF_INET && got4) 427 continue; 428 if (af == AF_INET6 && got6) 429 continue; 430 } 431 if (af == AF_INET) 432 got4 = 1; 433 else 434 got6 = 1; 435 net2 = net; 436 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 437 if (af == AF_INET) { 438 net2 = pfi_unmask(&((struct sockaddr_in *) 439 ia->ifa_netmask)->sin_addr); 440 } else { 441 net2 = pfi_unmask(&((struct sockaddr_in6 *) 442 ia->ifa_netmask)->sin6_addr); 443 } 444 } 445 if (af == AF_INET && net2 > 32) 446 net2 = 32; 447 if (flags & PFI_AFLAG_BROADCAST) 448 pfi_address_add(ia->ifa_broadaddr, af, net2); 449 else if (flags & PFI_AFLAG_PEER) 450 pfi_address_add(ia->ifa_dstaddr, af, net2); 451 else 452 pfi_address_add(ia->ifa_addr, af, net2); 453 } 454 } 455 456 void 457 pfi_address_add(struct sockaddr *sa, int af, int net) 458 { 459 struct pfr_addr *p; 460 int i; 461 462 if (pfi_buffer_cnt >= pfi_buffer_max) { 463 int new_max = pfi_buffer_max * 2; 464 465 if (new_max > PFI_BUFFER_MAX) { 466 printf("pfi_address_add: address buffer full (%d/%d)\n", 467 pfi_buffer_cnt, PFI_BUFFER_MAX); 468 return; 469 } 470 p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, 471 M_DONTWAIT); 472 if (p == NULL) { 473 printf("pfi_address_add: no memory to grow buffer " 474 "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 475 return; 476 } 477 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer)); 478 /* no need to zero buffer */ 479 free(pfi_buffer, PFI_MTYPE); 480 pfi_buffer = p; 481 pfi_buffer_max = new_max; 482 } 483 if (af == AF_INET && net > 32) 484 net = 128; 485 p = pfi_buffer + pfi_buffer_cnt++; 486 bzero(p, sizeof(*p)); 487 p->pfra_af = af; 488 p->pfra_net = net; 489 if (af == AF_INET) 490 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 491 if (af == AF_INET6) { 492 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 493 if (IN6_IS_ADDR_LINKLOCAL(&p->pfra_ip6addr)) 494 p->pfra_ip6addr.s6_addr16[1] = 0; 495 } 496 /* mask network address bits */ 497 if (net < 128) 498 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 499 for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 500 ((caddr_t)p)[i] = 0; 501 } 502 503 void 504 pfi_dynaddr_remove(struct pf_addr_wrap *aw) 505 { 506 int s; 507 508 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 509 aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 510 return; 511 512 s = splsoftnet(); 513 hook_disestablish(aw->p.dyn->pfid_kif->pfik_ah_head, 514 aw->p.dyn->pfid_hook_cookie); 515 pfi_detach_rule(aw->p.dyn->pfid_kif); 516 aw->p.dyn->pfid_kif = NULL; 517 pfr_detach_table(aw->p.dyn->pfid_kt); 518 aw->p.dyn->pfid_kt = NULL; 519 pool_put(&pfi_addr_pl, aw->p.dyn); 520 aw->p.dyn = NULL; 521 splx(s); 522 } 523 524 void 525 pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 526 { 527 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 528 aw->p.dyn->pfid_kif == NULL) 529 return; 530 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 531 } 532 533 void 534 pfi_kifaddr_update(void *v) 535 { 536 int s; 537 538 s = splsoftnet(); 539 pfi_update++; 540 pfi_dohooks(v); 541 splx(s); 542 } 543 544 int 545 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 546 { 547 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 548 } 549 550 struct pfi_kif * 551 pfi_if_create(const char *name, struct pfi_kif *q, int flags) 552 { 553 struct pfi_kif *p; 554 555 p = malloc(sizeof(*p), PFI_MTYPE, M_DONTWAIT); 556 if (p == NULL) 557 return (NULL); 558 bzero(p, sizeof(*p)); 559 p->pfik_ah_head = malloc(sizeof(*p->pfik_ah_head), PFI_MTYPE, 560 M_DONTWAIT); 561 if (p->pfik_ah_head == NULL) { 562 free(p, PFI_MTYPE); 563 return (NULL); 564 } 565 bzero(p->pfik_ah_head, sizeof(*p->pfik_ah_head)); 566 TAILQ_INIT(p->pfik_ah_head); 567 TAILQ_INIT(&p->pfik_grouphead); 568 strlcpy(p->pfik_name, name, sizeof(p->pfik_name)); 569 RB_INIT(&p->pfik_lan_ext); 570 RB_INIT(&p->pfik_ext_gwy); 571 p->pfik_flags = flags; 572 p->pfik_parent = q; 573 p->pfik_tzero = time.tv_sec; 574 575 RB_INSERT(pfi_ifhead, &pfi_ifs, p); 576 if (q != NULL) { 577 q->pfik_addcnt++; 578 TAILQ_INSERT_TAIL(&q->pfik_grouphead, p, pfik_instances); 579 } 580 pfi_ifcnt++; 581 return (p); 582 } 583 584 int 585 pfi_maybe_destroy(struct pfi_kif *p) 586 { 587 int i, j, k, s; 588 struct pfi_kif *q = p->pfik_parent; 589 590 if ((p->pfik_flags & (PFI_IFLAG_ATTACHED | PFI_IFLAG_GROUP)) || 591 p->pfik_rules > 0 || p->pfik_states > 0) 592 return (0); 593 594 s = splsoftnet(); 595 if (q != NULL) { 596 for (i = 0; i < 2; i++) 597 for (j = 0; j < 2; j++) 598 for (k = 0; k < 2; k++) { 599 q->pfik_bytes[i][j][k] += 600 p->pfik_bytes[i][j][k]; 601 q->pfik_packets[i][j][k] += 602 p->pfik_packets[i][j][k]; 603 } 604 q->pfik_delcnt++; 605 TAILQ_REMOVE(&q->pfik_grouphead, p, pfik_instances); 606 } 607 pfi_ifcnt--; 608 RB_REMOVE(pfi_ifhead, &pfi_ifs, p); 609 splx(s); 610 611 free(p->pfik_ah_head, PFI_MTYPE); 612 free(p, PFI_MTYPE); 613 return (1); 614 } 615 616 void 617 pfi_copy_group(char *p, const char *q, int m) 618 { 619 while (m > 1 && *q && !(*q >= '0' && *q <= '9')) { 620 *p++ = *q++; 621 m--; 622 } 623 if (m > 0) 624 *p++ = '\0'; 625 } 626 627 void 628 pfi_dynamic_drivers(void) 629 { 630 char *buses[] = PFI_DYNAMIC_BUSES; 631 int nbuses = sizeof(buses)/sizeof(buses[0]); 632 int enabled[sizeof(buses)/sizeof(buses[0])]; 633 struct device *dev; 634 struct cfdata *cf; 635 struct cfdriver *drv; 636 short *p; 637 int i; 638 639 bzero(enabled, sizeof(enabled)); 640 TAILQ_FOREACH(dev, &alldevs, dv_list) { 641 if (!(dev->dv_flags & DVF_ACTIVE)) 642 continue; 643 for (i = 0; i < nbuses; i++) 644 if (!enabled[i] && !strcmp(buses[i], 645 dev->dv_cfdata->cf_driver->cd_name)) 646 enabled[i] = 1; 647 } 648 for (cf = cfdata; cf->cf_driver; cf++) { 649 if (cf->cf_driver->cd_class != DV_IFNET) 650 continue; 651 for (p = cf->cf_parents; p && *p >= 0; p++) { 652 if ((drv = cfdata[*p].cf_driver) == NULL) 653 continue; 654 for (i = 0; i < nbuses; i++) 655 if (enabled[i] && 656 !strcmp(drv->cd_name, buses[i])) 657 break; 658 if (i < nbuses) { 659 pfi_newgroup(cf->cf_driver->cd_name, 660 PFI_IFLAG_DYNAMIC); 661 break; 662 } 663 } 664 } 665 } 666 667 void 668 pfi_newgroup(const char *name, int flags) 669 { 670 struct pfi_kif *p; 671 672 p = pfi_lookup_if(name); 673 if (p == NULL) 674 p = pfi_if_create(name, pfi_self, PFI_IFLAG_GROUP); 675 if (p == NULL) { 676 printf("pfi_newgroup: cannot allocate '%s' group", name); 677 return; 678 } 679 p->pfik_flags |= flags; 680 } 681 682 void 683 pfi_fill_oldstatus(struct pf_status *pfs) 684 { 685 struct pfi_kif *p, key; 686 int i, j, k, s; 687 688 strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name)); 689 s = splsoftnet(); 690 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 691 if (p == NULL) { 692 splx(s); 693 return; 694 } 695 bzero(pfs->pcounters, sizeof(pfs->pcounters)); 696 bzero(pfs->bcounters, sizeof(pfs->bcounters)); 697 for (i = 0; i < 2; i++) 698 for (j = 0; j < 2; j++) 699 for (k = 0; k < 2; k++) { 700 pfs->pcounters[i][j][k] = 701 p->pfik_packets[i][j][k]; 702 pfs->bcounters[i][j] += 703 p->pfik_bytes[i][j][k]; 704 } 705 splx(s); 706 } 707 708 int 709 pfi_clr_istats(const char *name, int *nzero, int flags) 710 { 711 struct pfi_kif *p; 712 int n = 0, s; 713 long tzero = time.tv_sec; 714 715 s = splsoftnet(); 716 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 717 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 718 if (pfi_skip_if(name, p, flags)) 719 continue; 720 bzero(p->pfik_packets, sizeof(p->pfik_packets)); 721 bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 722 p->pfik_tzero = tzero; 723 n++; 724 } 725 splx(s); 726 if (nzero != NULL) 727 *nzero = n; 728 return (0); 729 } 730 731 int 732 pfi_get_ifaces(const char *name, struct pfi_if *buf, int *size, int flags) 733 { 734 struct pfi_kif *p; 735 int s, n = 0; 736 737 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 738 s = splsoftnet(); 739 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 740 if (pfi_skip_if(name, p, flags)) 741 continue; 742 if (*size > n++) { 743 if (!p->pfik_tzero) 744 p->pfik_tzero = boottime.tv_sec; 745 if (copyout(p, buf++, sizeof(*buf))) { 746 splx(s); 747 return (EFAULT); 748 } 749 } 750 } 751 splx(s); 752 *size = n; 753 return (0); 754 } 755 756 struct pfi_kif * 757 pfi_lookup_if(const char *name) 758 { 759 struct pfi_kif *p, key; 760 761 strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 762 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 763 return (p); 764 } 765 766 int 767 pfi_skip_if(const char *filter, struct pfi_kif *p, int f) 768 { 769 int n; 770 771 if ((p->pfik_flags & PFI_IFLAG_GROUP) && !(f & PFI_FLAG_GROUP)) 772 return (1); 773 if ((p->pfik_flags & PFI_IFLAG_INSTANCE) && !(f & PFI_FLAG_INSTANCE)) 774 return (1); 775 if (filter == NULL || !*filter) 776 return (0); 777 if (!strcmp(p->pfik_name, filter)) 778 return (0); /* exact match */ 779 n = strlen(filter); 780 if (n < 1 || n >= IFNAMSIZ) 781 return (1); /* sanity check */ 782 if (filter[n-1] >= '0' && filter[n-1] <= '9') 783 return (1); /* only do exact match in that case */ 784 if (strncmp(p->pfik_name, filter, n)) 785 return (1); /* prefix doesn't match */ 786 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 787 } 788 789 /* from pf_print_state.c */ 790 int 791 pfi_unmask(void *addr) 792 { 793 struct pf_addr *m = addr; 794 int i = 31, j = 0, b = 0; 795 u_int32_t tmp; 796 797 while (j < 4 && m->addr32[j] == 0xffffffff) { 798 b += 32; 799 j++; 800 } 801 if (j < 4) { 802 tmp = ntohl(m->addr32[j]); 803 for (i = 31; tmp & (1 << i); --i) 804 b++; 805 } 806 return (b); 807 } 808 809 void 810 pfi_dohooks(struct pfi_kif *p) 811 { 812 for (; p != NULL; p = p->pfik_parent) 813 dohooks(p->pfik_ah_head, 0); 814 } 815 816 int 817 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 818 { 819 if (af == AF_INET) { 820 switch (dyn->pfid_acnt4) { 821 case 0: 822 return (0); 823 case 1: 824 return (PF_MATCHA(0, &dyn->pfid_addr4, 825 &dyn->pfid_mask4, a, AF_INET)); 826 default: 827 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 828 } 829 } else { 830 switch (dyn->pfid_acnt6) { 831 case 0: 832 return (0); 833 case 1: 834 return (PF_MATCHA(0, &dyn->pfid_addr6, 835 &dyn->pfid_mask6, a, AF_INET6)); 836 default: 837 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 838 } 839 } 840 } 841
Indexes created Wed Sep 24 15:09:51 GMT 2025