pf_if.c revision 1.1.1.3
1 /* $OpenBSD: pf_if.c,v 1.23 2004/12/22 17:17:55 dhartmei Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2003 Cedric Berger 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/param.h> 34 #include <sys/systm.h> 35 #include <sys/mbuf.h> 36 #include <sys/filio.h> 37 #include <sys/socket.h> 38 #include <sys/socketvar.h> 39 #include <sys/kernel.h> 40 #include <sys/device.h> 41 #include <sys/time.h> 42 43 #include <net/if.h> 44 #include <net/if_types.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_var.h> 48 #include <netinet/in_systm.h> 49 #include <netinet/ip.h> 50 #include <netinet/ip_var.h> 51 52 #include <net/pfvar.h> 53 54 #ifdef INET6 55 #include <netinet/ip6.h> 56 #endif /* INET6 */ 57 58 #define ACCEPT_FLAGS(oklist) \ 59 do { \ 60 if ((flags & ~(oklist)) & \ 61 PFI_FLAG_ALLMASK) \ 62 return (EINVAL); \ 63 } while (0) 64 65 #define senderr(e) do { rv = (e); goto _bad; } while (0) 66 67 struct pfi_kif **pfi_index2kif; 68 struct pfi_kif *pfi_self; 69 int pfi_indexlim; 70 struct pfi_ifhead pfi_ifs; 71 struct pfi_statehead pfi_statehead; 72 int pfi_ifcnt; 73 struct pool pfi_addr_pl; 74 long pfi_update = 1; 75 struct pfr_addr *pfi_buffer; 76 int pfi_buffer_cnt; 77 int pfi_buffer_max; 78 79 void pfi_dynaddr_update(void *); 80 void pfi_kifaddr_update(void *); 81 void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, 82 int, int); 83 void pfi_instance_add(struct ifnet *, int, int); 84 void pfi_address_add(struct sockaddr *, int, int); 85 int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 86 struct pfi_kif *pfi_if_create(const char *, struct pfi_kif *, int); 87 void pfi_copy_group(char *, const char *, int); 88 void pfi_newgroup(const char *, int); 89 int pfi_skip_if(const char *, struct pfi_kif *, int); 90 int pfi_unmask(void *); 91 void pfi_dohooks(struct pfi_kif *); 92 93 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 94 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 95 96 #define PFI_BUFFER_MAX 0x10000 97 #define PFI_MTYPE M_IFADDR 98 99 void 100 pfi_initialize(void) 101 { 102 if (pfi_self != NULL) /* already initialized */ 103 return; 104 105 TAILQ_INIT(&pfi_statehead); 106 pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0, 107 "pfiaddrpl", &pool_allocator_nointr); 108 pfi_buffer_max = 64; 109 pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer), 110 PFI_MTYPE, M_WAITOK); 111 pfi_self = pfi_if_create("self", NULL, PFI_IFLAG_GROUP); 112 } 113 114 void 115 pfi_attach_clone(struct if_clone *ifc) 116 { 117 pfi_initialize(); 118 pfi_newgroup(ifc->ifc_name, PFI_IFLAG_CLONABLE); 119 } 120 121 void 122 pfi_attach_ifnet(struct ifnet *ifp) 123 { 124 struct pfi_kif *p, *q, key; 125 int s; 126 127 pfi_initialize(); 128 s = splsoftnet(); 129 pfi_update++; 130 if (ifp->if_index >= pfi_indexlim) { 131 /* 132 * grow pfi_index2kif, similar to ifindex2ifnet code in if.c 133 */ 134 size_t m, n, oldlim; 135 struct pfi_kif **mp, **np; 136 137 oldlim = pfi_indexlim; 138 if (pfi_indexlim == 0) 139 pfi_indexlim = 64; 140 while (ifp->if_index >= pfi_indexlim) 141 pfi_indexlim <<= 1; 142 143 m = oldlim * sizeof(struct pfi_kif *); 144 mp = pfi_index2kif; 145 n = pfi_indexlim * sizeof(struct pfi_kif *); 146 np = malloc(n, PFI_MTYPE, M_DONTWAIT); 147 if (np == NULL) 148 panic("pfi_attach_ifnet: " 149 "cannot allocate translation table"); 150 bzero(np, n); 151 if (mp != NULL) 152 bcopy(mp, np, m); 153 pfi_index2kif = np; 154 if (mp != NULL) 155 free(mp, PFI_MTYPE); 156 } 157 158 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 159 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 160 if (p == NULL) { 161 /* add group */ 162 pfi_copy_group(key.pfik_name, ifp->if_xname, 163 sizeof(key.pfik_name)); 164 q = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 165 if (q == NULL) 166 q = pfi_if_create(key.pfik_name, pfi_self, PFI_IFLAG_GROUP); 167 if (q == NULL) 168 panic("pfi_attach_ifnet: " 169 "cannot allocate '%s' group", key.pfik_name); 170 171 /* add interface */ 172 p = pfi_if_create(ifp->if_xname, q, PFI_IFLAG_INSTANCE); 173 if (p == NULL) 174 panic("pfi_attach_ifnet: " 175 "cannot allocate '%s' interface", ifp->if_xname); 176 } else 177 q = p->pfik_parent; 178 p->pfik_ifp = ifp; 179 p->pfik_flags |= PFI_IFLAG_ATTACHED; 180 p->pfik_ah_cookie = 181 hook_establish(ifp->if_addrhooks, 1, pfi_kifaddr_update, p); 182 pfi_index2kif[ifp->if_index] = p; 183 pfi_dohooks(p); 184 splx(s); 185 } 186 187 void 188 pfi_detach_ifnet(struct ifnet *ifp) 189 { 190 struct pfi_kif *p, *q, key; 191 int s; 192 193 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 194 195 s = splsoftnet(); 196 pfi_update++; 197 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 198 if (p == NULL) { 199 printf("pfi_detach_ifnet: cannot find %s", ifp->if_xname); 200 splx(s); 201 return; 202 } 203 hook_disestablish(p->pfik_ifp->if_addrhooks, p->pfik_ah_cookie); 204 q = p->pfik_parent; 205 p->pfik_ifp = NULL; 206 p->pfik_flags &= ~PFI_IFLAG_ATTACHED; 207 pfi_index2kif[ifp->if_index] = NULL; 208 pfi_dohooks(p); 209 pfi_maybe_destroy(p); 210 splx(s); 211 } 212 213 struct pfi_kif * 214 pfi_lookup_create(const char *name) 215 { 216 struct pfi_kif *p, *q, key; 217 int s; 218 219 s = splsoftnet(); 220 p = pfi_lookup_if(name); 221 if (p == NULL) { 222 pfi_copy_group(key.pfik_name, name, sizeof(key.pfik_name)); 223 q = pfi_lookup_if(key.pfik_name); 224 if (q == NULL) { 225 pfi_newgroup(key.pfik_name, PFI_IFLAG_DYNAMIC); 226 q = pfi_lookup_if(key.pfik_name); 227 } 228 p = pfi_lookup_if(name); 229 if (p == NULL && q != NULL) 230 p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE); 231 } 232 splx(s); 233 return (p); 234 } 235 236 struct pfi_kif * 237 pfi_attach_rule(const char *name) 238 { 239 struct pfi_kif *p; 240 241 p = pfi_lookup_create(name); 242 if (p != NULL) 243 p->pfik_rules++; 244 return (p); 245 } 246 247 void 248 pfi_detach_rule(struct pfi_kif *p) 249 { 250 if (p == NULL) 251 return; 252 if (p->pfik_rules > 0) 253 p->pfik_rules--; 254 else 255 printf("pfi_detach_rule: reference count at 0\n"); 256 pfi_maybe_destroy(p); 257 } 258 259 void 260 pfi_attach_state(struct pfi_kif *p) 261 { 262 if (!p->pfik_states++) 263 TAILQ_INSERT_TAIL(&pfi_statehead, p, pfik_w_states); 264 } 265 266 void 267 pfi_detach_state(struct pfi_kif *p) 268 { 269 if (p == NULL) 270 return; 271 if (p->pfik_states <= 0) { 272 printf("pfi_detach_state: reference count <= 0\n"); 273 return; 274 } 275 if (!--p->pfik_states) 276 TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 277 pfi_maybe_destroy(p); 278 } 279 280 int 281 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 282 { 283 struct pfi_dynaddr *dyn; 284 char tblname[PF_TABLE_NAME_SIZE]; 285 struct pf_ruleset *ruleset = NULL; 286 int s, rv = 0; 287 288 if (aw->type != PF_ADDR_DYNIFTL) 289 return (0); 290 dyn = pool_get(&pfi_addr_pl, PR_NOWAIT); 291 if (dyn == NULL) 292 return (1); 293 bzero(dyn, sizeof(*dyn)); 294 295 s = splsoftnet(); 296 dyn->pfid_kif = pfi_attach_rule(aw->v.ifname); 297 if (dyn->pfid_kif == NULL) 298 senderr(1); 299 300 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 301 if (af == AF_INET && dyn->pfid_net == 32) 302 dyn->pfid_net = 128; 303 strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 304 if (aw->iflags & PFI_AFLAG_NETWORK) 305 strlcat(tblname, ":network", sizeof(tblname)); 306 if (aw->iflags & PFI_AFLAG_BROADCAST) 307 strlcat(tblname, ":broadcast", sizeof(tblname)); 308 if (aw->iflags & PFI_AFLAG_PEER) 309 strlcat(tblname, ":peer", sizeof(tblname)); 310 if (aw->iflags & PFI_AFLAG_NOALIAS) 311 strlcat(tblname, ":0", sizeof(tblname)); 312 if (dyn->pfid_net != 128) 313 snprintf(tblname + strlen(tblname), 314 sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 315 ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR); 316 if (ruleset == NULL) 317 senderr(1); 318 319 dyn->pfid_kt = pfr_attach_table(ruleset, tblname); 320 if (dyn->pfid_kt == NULL) 321 senderr(1); 322 323 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 324 dyn->pfid_iflags = aw->iflags; 325 dyn->pfid_af = af; 326 dyn->pfid_hook_cookie = hook_establish(dyn->pfid_kif->pfik_ah_head, 1, 327 pfi_dynaddr_update, dyn); 328 if (dyn->pfid_hook_cookie == NULL) 329 senderr(1); 330 331 aw->p.dyn = dyn; 332 pfi_dynaddr_update(aw->p.dyn); 333 splx(s); 334 return (0); 335 336 _bad: 337 if (dyn->pfid_kt != NULL) 338 pfr_detach_table(dyn->pfid_kt); 339 if (ruleset != NULL) 340 pf_remove_if_empty_ruleset(ruleset); 341 if (dyn->pfid_kif != NULL) 342 pfi_detach_rule(dyn->pfid_kif); 343 pool_put(&pfi_addr_pl, dyn); 344 splx(s); 345 return (rv); 346 } 347 348 void 349 pfi_dynaddr_update(void *p) 350 { 351 struct pfi_dynaddr *dyn = (struct pfi_dynaddr *)p; 352 struct pfi_kif *kif; 353 struct pfr_ktable *kt; 354 355 if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) 356 panic("pfi_dynaddr_update"); 357 358 kif = dyn->pfid_kif; 359 kt = dyn->pfid_kt; 360 if (kt->pfrkt_larg != pfi_update) { 361 /* this table needs to be brought up-to-date */ 362 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 363 kt->pfrkt_larg = pfi_update; 364 } 365 pfr_dynaddr_update(kt, dyn); 366 } 367 368 void 369 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 370 { 371 int e, size2 = 0; 372 struct pfi_kif *p; 373 struct pfr_table t; 374 375 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE) && kif->pfik_ifp == NULL) { 376 pfr_clr_addrs(&kt->pfrkt_t, NULL, 0); 377 return; 378 } 379 pfi_buffer_cnt = 0; 380 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE)) 381 pfi_instance_add(kif->pfik_ifp, net, flags); 382 else if (strcmp(kif->pfik_name, "self")) { 383 TAILQ_FOREACH(p, &kif->pfik_grouphead, pfik_instances) 384 pfi_instance_add(p->pfik_ifp, net, flags); 385 } else { 386 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) 387 if (p->pfik_flags & PFI_IFLAG_INSTANCE) 388 pfi_instance_add(p->pfik_ifp, net, flags); 389 } 390 t = kt->pfrkt_t; 391 t.pfrt_flags = 0; 392 if ((e = pfr_set_addrs(&t, pfi_buffer, pfi_buffer_cnt, &size2, 393 NULL, NULL, NULL, 0))) 394 printf("pfi_table_update: cannot set %d new addresses " 395 "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 396 } 397 398 void 399 pfi_instance_add(struct ifnet *ifp, int net, int flags) 400 { 401 struct ifaddr *ia; 402 int got4 = 0, got6 = 0; 403 int net2, af; 404 405 if (ifp == NULL) 406 return; 407 TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) { 408 if (ia->ifa_addr == NULL) 409 continue; 410 af = ia->ifa_addr->sa_family; 411 if (af != AF_INET && af != AF_INET6) 412 continue; 413 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 414 continue; 415 if ((flags & PFI_AFLAG_BROADCAST) && 416 !(ifp->if_flags & IFF_BROADCAST)) 417 continue; 418 if ((flags & PFI_AFLAG_PEER) && 419 !(ifp->if_flags & IFF_POINTOPOINT)) 420 continue; 421 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 422 IN6_IS_ADDR_LINKLOCAL( 423 &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 424 continue; 425 if (flags & PFI_AFLAG_NOALIAS) { 426 if (af == AF_INET && got4) 427 continue; 428 if (af == AF_INET6 && got6) 429 continue; 430 } 431 if (af == AF_INET) 432 got4 = 1; 433 else if (af == AF_INET6) 434 got6 = 1; 435 net2 = net; 436 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 437 if (af == AF_INET) { 438 net2 = pfi_unmask(&((struct sockaddr_in *) 439 ia->ifa_netmask)->sin_addr); 440 } else if (af == AF_INET6) { 441 net2 = pfi_unmask(&((struct sockaddr_in6 *) 442 ia->ifa_netmask)->sin6_addr); 443 } 444 } 445 if (af == AF_INET && net2 > 32) 446 net2 = 32; 447 if (flags & PFI_AFLAG_BROADCAST) 448 pfi_address_add(ia->ifa_broadaddr, af, net2); 449 else if (flags & PFI_AFLAG_PEER) 450 pfi_address_add(ia->ifa_dstaddr, af, net2); 451 else 452 pfi_address_add(ia->ifa_addr, af, net2); 453 } 454 } 455 456 void 457 pfi_address_add(struct sockaddr *sa, int af, int net) 458 { 459 struct pfr_addr *p; 460 int i; 461 462 if (pfi_buffer_cnt >= pfi_buffer_max) { 463 int new_max = pfi_buffer_max * 2; 464 465 if (new_max > PFI_BUFFER_MAX) { 466 printf("pfi_address_add: address buffer full (%d/%d)\n", 467 pfi_buffer_cnt, PFI_BUFFER_MAX); 468 return; 469 } 470 p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, 471 M_DONTWAIT); 472 if (p == NULL) { 473 printf("pfi_address_add: no memory to grow buffer " 474 "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 475 return; 476 } 477 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer)); 478 /* no need to zero buffer */ 479 free(pfi_buffer, PFI_MTYPE); 480 pfi_buffer = p; 481 pfi_buffer_max = new_max; 482 } 483 if (af == AF_INET && net > 32) 484 net = 128; 485 p = pfi_buffer + pfi_buffer_cnt++; 486 bzero(p, sizeof(*p)); 487 p->pfra_af = af; 488 p->pfra_net = net; 489 if (af == AF_INET) 490 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 491 if (af == AF_INET6) { 492 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 493 if (IN6_IS_ADDR_LINKLOCAL(&p->pfra_ip6addr)) 494 p->pfra_ip6addr.s6_addr16[1] = 0; 495 } 496 /* mask network address bits */ 497 if (net < 128) 498 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 499 for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 500 ((caddr_t)p)[i] = 0; 501 } 502 503 void 504 pfi_dynaddr_remove(struct pf_addr_wrap *aw) 505 { 506 int s; 507 508 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 509 aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 510 return; 511 512 s = splsoftnet(); 513 hook_disestablish(aw->p.dyn->pfid_kif->pfik_ah_head, 514 aw->p.dyn->pfid_hook_cookie); 515 pfi_detach_rule(aw->p.dyn->pfid_kif); 516 aw->p.dyn->pfid_kif = NULL; 517 pfr_detach_table(aw->p.dyn->pfid_kt); 518 aw->p.dyn->pfid_kt = NULL; 519 pool_put(&pfi_addr_pl, aw->p.dyn); 520 aw->p.dyn = NULL; 521 splx(s); 522 } 523 524 void 525 pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 526 { 527 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 528 aw->p.dyn->pfid_kif == NULL) 529 return; 530 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 531 } 532 533 void 534 pfi_kifaddr_update(void *v) 535 { 536 int s; 537 538 s = splsoftnet(); 539 pfi_update++; 540 pfi_dohooks(v); 541 splx(s); 542 } 543 544 int 545 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 546 { 547 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 548 } 549 550 struct pfi_kif * 551 pfi_if_create(const char *name, struct pfi_kif *q, int flags) 552 { 553 struct pfi_kif *p; 554 555 p = malloc(sizeof(*p), PFI_MTYPE, M_DONTWAIT); 556 if (p == NULL) 557 return (NULL); 558 bzero(p, sizeof(*p)); 559 p->pfik_ah_head = malloc(sizeof(*p->pfik_ah_head), PFI_MTYPE, 560 M_DONTWAIT); 561 if (p->pfik_ah_head == NULL) { 562 free(p, PFI_MTYPE); 563 return (NULL); 564 } 565 bzero(p->pfik_ah_head, sizeof(*p->pfik_ah_head)); 566 TAILQ_INIT(p->pfik_ah_head); 567 TAILQ_INIT(&p->pfik_grouphead); 568 strlcpy(p->pfik_name, name, sizeof(p->pfik_name)); 569 RB_INIT(&p->pfik_lan_ext); 570 RB_INIT(&p->pfik_ext_gwy); 571 p->pfik_flags = flags; 572 p->pfik_parent = q; 573 p->pfik_tzero = time_second; 574 575 RB_INSERT(pfi_ifhead, &pfi_ifs, p); 576 if (q != NULL) { 577 q->pfik_addcnt++; 578 TAILQ_INSERT_TAIL(&q->pfik_grouphead, p, pfik_instances); 579 } 580 pfi_ifcnt++; 581 return (p); 582 } 583 584 int 585 pfi_maybe_destroy(struct pfi_kif *p) 586 { 587 int i, j, k, s; 588 struct pfi_kif *q = p->pfik_parent; 589 590 if ((p->pfik_flags & (PFI_IFLAG_ATTACHED | PFI_IFLAG_GROUP)) || 591 p->pfik_rules > 0 || p->pfik_states > 0) 592 return (0); 593 594 s = splsoftnet(); 595 if (q != NULL) { 596 for (i = 0; i < 2; i++) 597 for (j = 0; j < 2; j++) 598 for (k = 0; k < 2; k++) { 599 q->pfik_bytes[i][j][k] += 600 p->pfik_bytes[i][j][k]; 601 q->pfik_packets[i][j][k] += 602 p->pfik_packets[i][j][k]; 603 } 604 q->pfik_delcnt++; 605 TAILQ_REMOVE(&q->pfik_grouphead, p, pfik_instances); 606 } 607 pfi_ifcnt--; 608 RB_REMOVE(pfi_ifhead, &pfi_ifs, p); 609 splx(s); 610 611 free(p->pfik_ah_head, PFI_MTYPE); 612 free(p, PFI_MTYPE); 613 return (1); 614 } 615 616 void 617 pfi_copy_group(char *p, const char *q, int m) 618 { 619 while (m > 1 && *q && !(*q >= '0' && *q <= '9')) { 620 *p++ = *q++; 621 m--; 622 } 623 if (m > 0) 624 *p++ = '\0'; 625 } 626 627 void 628 pfi_newgroup(const char *name, int flags) 629 { 630 struct pfi_kif *p; 631 632 p = pfi_lookup_if(name); 633 if (p == NULL) 634 p = pfi_if_create(name, pfi_self, PFI_IFLAG_GROUP); 635 if (p == NULL) { 636 printf("pfi_newgroup: cannot allocate '%s' group", name); 637 return; 638 } 639 p->pfik_flags |= flags; 640 } 641 642 void 643 pfi_fill_oldstatus(struct pf_status *pfs) 644 { 645 struct pfi_kif *p, key; 646 int i, j, k, s; 647 648 strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name)); 649 s = splsoftnet(); 650 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 651 if (p == NULL) { 652 splx(s); 653 return; 654 } 655 bzero(pfs->pcounters, sizeof(pfs->pcounters)); 656 bzero(pfs->bcounters, sizeof(pfs->bcounters)); 657 for (i = 0; i < 2; i++) 658 for (j = 0; j < 2; j++) 659 for (k = 0; k < 2; k++) { 660 pfs->pcounters[i][j][k] = 661 p->pfik_packets[i][j][k]; 662 pfs->bcounters[i][j] += 663 p->pfik_bytes[i][j][k]; 664 } 665 splx(s); 666 } 667 668 int 669 pfi_clr_istats(const char *name, int *nzero, int flags) 670 { 671 struct pfi_kif *p; 672 int n = 0, s; 673 long tzero = time_second; 674 675 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 676 s = splsoftnet(); 677 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 678 if (pfi_skip_if(name, p, flags)) 679 continue; 680 bzero(p->pfik_packets, sizeof(p->pfik_packets)); 681 bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 682 p->pfik_tzero = tzero; 683 n++; 684 } 685 splx(s); 686 if (nzero != NULL) 687 *nzero = n; 688 return (0); 689 } 690 691 int 692 pfi_set_flags(const char *name, int flags) 693 { 694 struct pfi_kif *p; 695 int s; 696 697 if (flags & ~PFI_IFLAG_SETABLE_MASK) 698 return (EINVAL); 699 700 s = splsoftnet(); 701 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 702 if (pfi_skip_if(name, p, PFI_FLAG_GROUP|PFI_FLAG_INSTANCE)) 703 continue; 704 p->pfik_flags |= flags; 705 } 706 splx(s); 707 return (0); 708 } 709 710 int 711 pfi_clear_flags(const char *name, int flags) 712 { 713 struct pfi_kif *p; 714 int s; 715 716 if (flags & ~PFI_IFLAG_SETABLE_MASK) 717 return (EINVAL); 718 719 s = splsoftnet(); 720 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 721 if (pfi_skip_if(name, p, PFI_FLAG_GROUP|PFI_FLAG_INSTANCE)) 722 continue; 723 p->pfik_flags &= ~flags; 724 } 725 splx(s); 726 return (0); 727 } 728 729 int 730 pfi_get_ifaces(const char *name, struct pfi_if *buf, int *size, int flags) 731 { 732 struct pfi_kif *p; 733 int s, n = 0; 734 735 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 736 s = splsoftnet(); 737 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 738 if (pfi_skip_if(name, p, flags)) 739 continue; 740 if (*size > n++) { 741 if (!p->pfik_tzero) 742 p->pfik_tzero = time_second; 743 if (copyout(p, buf++, sizeof(*buf))) { 744 splx(s); 745 return (EFAULT); 746 } 747 } 748 } 749 splx(s); 750 *size = n; 751 return (0); 752 } 753 754 struct pfi_kif * 755 pfi_lookup_if(const char *name) 756 { 757 struct pfi_kif *p, key; 758 759 strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 760 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 761 return (p); 762 } 763 764 int 765 pfi_skip_if(const char *filter, struct pfi_kif *p, int f) 766 { 767 int n; 768 769 if ((p->pfik_flags & PFI_IFLAG_GROUP) && !(f & PFI_FLAG_GROUP)) 770 return (1); 771 if ((p->pfik_flags & PFI_IFLAG_INSTANCE) && !(f & PFI_FLAG_INSTANCE)) 772 return (1); 773 if (filter == NULL || !*filter) 774 return (0); 775 if (!strcmp(p->pfik_name, filter)) 776 return (0); /* exact match */ 777 n = strlen(filter); 778 if (n < 1 || n >= IFNAMSIZ) 779 return (1); /* sanity check */ 780 if (filter[n-1] >= '0' && filter[n-1] <= '9') 781 return (1); /* only do exact match in that case */ 782 if (strncmp(p->pfik_name, filter, n)) 783 return (1); /* prefix doesn't match */ 784 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 785 } 786 787 /* from pf_print_state.c */ 788 int 789 pfi_unmask(void *addr) 790 { 791 struct pf_addr *m = addr; 792 int i = 31, j = 0, b = 0; 793 u_int32_t tmp; 794 795 while (j < 4 && m->addr32[j] == 0xffffffff) { 796 b += 32; 797 j++; 798 } 799 if (j < 4) { 800 tmp = ntohl(m->addr32[j]); 801 for (i = 31; tmp & (1 << i); --i) 802 b++; 803 } 804 return (b); 805 } 806 807 void 808 pfi_dohooks(struct pfi_kif *p) 809 { 810 for (; p != NULL; p = p->pfik_parent) 811 dohooks(p->pfik_ah_head, 0); 812 } 813 814 int 815 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 816 { 817 switch (af) { 818 #ifdef INET 819 case AF_INET: 820 switch (dyn->pfid_acnt4) { 821 case 0: 822 return (0); 823 case 1: 824 return (PF_MATCHA(0, &dyn->pfid_addr4, 825 &dyn->pfid_mask4, a, AF_INET)); 826 default: 827 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 828 } 829 break; 830 #endif /* INET */ 831 #ifdef INET6 832 case AF_INET6: 833 switch (dyn->pfid_acnt6) { 834 case 0: 835 return (0); 836 case 1: 837 return (PF_MATCHA(0, &dyn->pfid_addr6, 838 &dyn->pfid_mask6, a, AF_INET6)); 839 default: 840 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 841 } 842 break; 843 #endif /* INET6 */ 844 default: 845 return (0); 846 } 847 } 848
Indexes created Sun Oct 12 09:09:55 GMT 2025