pf_if.c revision 1.5.2.4
1 /* $NetBSD: pf_if.c,v 1.5.2.4 2004/09/21 13:34:43 skrll Exp $ */ 2 /* $OpenBSD: pf_if.c,v 1.11 2004/03/15 11:38:23 cedric Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2003 Cedric Berger 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #ifdef _KERNEL_OPT 35 #include "opt_inet.h" 36 #endif 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/mbuf.h> 41 #include <sys/filio.h> 42 #include <sys/socket.h> 43 #include <sys/socketvar.h> 44 #include <sys/kernel.h> 45 #include <sys/device.h> 46 #include <sys/time.h> 47 48 #include <net/if.h> 49 #include <net/if_types.h> 50 51 #include <netinet/in.h> 52 #include <netinet/in_var.h> 53 #include <netinet/in_systm.h> 54 #include <netinet/ip.h> 55 #include <netinet/ip_var.h> 56 57 #include <net/pfvar.h> 58 59 #ifdef INET6 60 #include <netinet/ip6.h> 61 #endif /* INET6 */ 62 63 #define ACCEPT_FLAGS(oklist) \ 64 do { \ 65 if ((flags & ~(oklist)) & \ 66 PFI_FLAG_ALLMASK) \ 67 return (EINVAL); \ 68 } while (0) 69 70 #define senderr(e) do { rv = (e); goto _bad; } while (0) 71 72 struct pfi_kif **pfi_index2kif; 73 struct pfi_kif *pfi_self; 74 int pfi_indexlim; 75 struct pfi_ifhead pfi_ifs; 76 struct pfi_statehead pfi_statehead; 77 int pfi_ifcnt; 78 struct pool pfi_addr_pl; 79 long pfi_update = 1; 80 struct pfr_addr *pfi_buffer; 81 int pfi_buffer_cnt; 82 int pfi_buffer_max; 83 char pfi_reserved_anchor[PF_ANCHOR_NAME_SIZE] = 84 PF_RESERVED_ANCHOR; 85 char pfi_interface_ruleset[PF_RULESET_NAME_SIZE] = 86 PF_INTERFACE_RULESET; 87 88 void pfi_dynaddr_update(void *); 89 void pfi_kifaddr_update(void *); 90 #ifdef __NetBSD__ 91 void pfi_kifaddr_update_if(struct ifnet *); 92 #endif 93 void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, 94 int, int); 95 void pfi_instance_add(struct ifnet *, int, int); 96 void pfi_address_add(struct sockaddr *, int, int); 97 int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 98 struct pfi_kif *pfi_if_create(const char *, struct pfi_kif *, int); 99 void pfi_copy_group(char *, const char *, int); 100 void pfi_dynamic_drivers(void); 101 void pfi_newgroup(const char *, int); 102 int pfi_skip_if(const char *, struct pfi_kif *, int); 103 int pfi_unmask(void *); 104 void pfi_dohooks(struct pfi_kif *); 105 106 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 107 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 108 109 #define PFI_DYNAMIC_BUSES { "pcmcia", "cardbus", "uhub" } 110 #define PFI_BUFFER_MAX 0x10000 111 #define PFI_MTYPE M_IFADDR 112 113 #ifdef __NetBSD__ 114 static void *hook_establish(struct hook_desc_head *, int, void (*)(void *), 115 void *); 116 static void hook_disestablish(struct hook_desc_head *, void *); 117 static void dohooks(struct hook_desc_head *, int); 118 119 #define HOOK_REMOVE 0x01 120 #define HOOK_FREE 0x02 121 #endif 122 123 void 124 pfi_initialize(void) 125 { 126 if (pfi_self != NULL) /* already initialized */ 127 return; 128 129 TAILQ_INIT(&pfi_statehead); 130 pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0, 131 "pfiaddrpl", &pool_allocator_nointr); 132 pfi_buffer_max = 64; 133 pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer), 134 PFI_MTYPE, M_WAITOK); 135 pfi_self = pfi_if_create("self", NULL, PFI_IFLAG_GROUP); 136 pfi_dynamic_drivers(); 137 } 138 139 #ifdef _LKM 140 void 141 pfi_destroy(void) 142 { 143 struct pfi_kif *p; 144 145 while ((p = TAILQ_FIRST(&pfi_statehead)) != NULL) { 146 TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 147 free(p, PFI_MTYPE); 148 } 149 pool_destroy(&pfi_addr_pl); 150 151 pfi_self = NULL; 152 } 153 #endif 154 155 void 156 pfi_attach_clone(struct if_clone *ifc) 157 { 158 pfi_initialize(); 159 pfi_newgroup(ifc->ifc_name, PFI_IFLAG_CLONABLE); 160 } 161 162 void 163 pfi_attach_ifnet(struct ifnet *ifp) 164 { 165 struct pfi_kif *p, *q, key; 166 int s; 167 168 pfi_initialize(); 169 s = splsoftnet(); 170 pfi_update++; 171 if (ifp->if_index >= pfi_indexlim) { 172 /* 173 * grow pfi_index2kif, similar to ifindex2ifnet code in if.c 174 */ 175 size_t m, n, oldlim; 176 struct pfi_kif **mp, **np; 177 178 oldlim = pfi_indexlim; 179 if (pfi_indexlim == 0) 180 pfi_indexlim = 64; 181 while (ifp->if_index >= pfi_indexlim) 182 pfi_indexlim <<= 1; 183 184 m = oldlim * sizeof(struct pfi_kif *); 185 mp = pfi_index2kif; 186 n = pfi_indexlim * sizeof(struct pfi_kif *); 187 np = malloc(n, PFI_MTYPE, M_DONTWAIT); 188 if (np == NULL) 189 panic("pfi_attach_ifnet: " 190 "cannot allocate translation table"); 191 bzero(np, n); 192 if (mp != NULL) 193 bcopy(mp, np, m); 194 pfi_index2kif = np; 195 if (mp != NULL) 196 free(mp, PFI_MTYPE); 197 } 198 199 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 200 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 201 if (p == NULL) { 202 /* add group */ 203 pfi_copy_group(key.pfik_name, ifp->if_xname, 204 sizeof(key.pfik_name)); 205 q = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 206 if (q == NULL) 207 q = pfi_if_create(key.pfik_name, pfi_self, PFI_IFLAG_GROUP); 208 if (q == NULL) 209 panic("pfi_attach_ifnet: " 210 "cannot allocate '%s' group", key.pfik_name); 211 212 /* add interface */ 213 p = pfi_if_create(ifp->if_xname, q, PFI_IFLAG_INSTANCE); 214 if (p == NULL) 215 panic("pfi_attach_ifnet: " 216 "cannot allocate '%s' interface", ifp->if_xname); 217 } else 218 q = p->pfik_parent; 219 p->pfik_ifp = ifp; 220 p->pfik_flags |= PFI_IFLAG_ATTACHED; 221 #ifdef __OpenBSD__ 222 p->pfik_ah_cookie = 223 hook_establish(ifp->if_addrhooks, 1, pfi_kifaddr_update, p); 224 #else 225 p->pfik_ah_cookie = 226 hook_establish(p->pfik_ifaddrhooks, 1, pfi_kifaddr_update, p); 227 #endif 228 pfi_index2kif[ifp->if_index] = p; 229 pfi_dohooks(p); 230 splx(s); 231 } 232 233 void 234 pfi_detach_ifnet(struct ifnet *ifp) 235 { 236 struct pfi_kif *p, *q, key; 237 int s; 238 239 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 240 241 s = splsoftnet(); 242 pfi_update++; 243 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 244 if (p == NULL) { 245 printf("pfi_detach_ifnet: cannot find %s", ifp->if_xname); 246 splx(s); 247 return; 248 } 249 #ifdef __OpenBSD__ 250 hook_disestablish(p->pfik_ifp->if_addrhooks, p->pfik_ah_cookie); 251 #else 252 hook_disestablish(p->pfik_ifaddrhooks, p->pfik_ah_cookie); 253 #endif 254 q = p->pfik_parent; 255 p->pfik_ifp = NULL; 256 p->pfik_flags &= ~PFI_IFLAG_ATTACHED; 257 pfi_index2kif[ifp->if_index] = NULL; 258 pfi_dohooks(p); 259 pfi_maybe_destroy(p); 260 splx(s); 261 } 262 263 struct pfi_kif * 264 pfi_lookup_create(const char *name) 265 { 266 struct pfi_kif *p, *q, key; 267 int s; 268 269 s = splsoftnet(); 270 p = pfi_lookup_if(name); 271 if (p == NULL) { 272 pfi_copy_group(key.pfik_name, name, sizeof(key.pfik_name)); 273 q = pfi_lookup_if(key.pfik_name); 274 if (q != NULL) 275 p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE); 276 } 277 splx(s); 278 return (p); 279 } 280 281 struct pfi_kif * 282 pfi_attach_rule(const char *name) 283 { 284 struct pfi_kif *p; 285 286 p = pfi_lookup_create(name); 287 if (p != NULL) 288 p->pfik_rules++; 289 return (p); 290 } 291 292 void 293 pfi_detach_rule(struct pfi_kif *p) 294 { 295 if (p == NULL) 296 return; 297 if (p->pfik_rules > 0) 298 p->pfik_rules--; 299 else 300 printf("pfi_detach_rule: reference count at 0\n"); 301 pfi_maybe_destroy(p); 302 } 303 304 void 305 pfi_attach_state(struct pfi_kif *p) 306 { 307 if (!p->pfik_states++) 308 TAILQ_INSERT_TAIL(&pfi_statehead, p, pfik_w_states); 309 } 310 311 void 312 pfi_detach_state(struct pfi_kif *p) 313 { 314 if (p == NULL) 315 return; 316 if (p->pfik_states <= 0) { 317 printf("pfi_detach_state: reference count <= 0\n"); 318 return; 319 } 320 if (!--p->pfik_states) 321 TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 322 pfi_maybe_destroy(p); 323 } 324 325 int 326 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 327 { 328 struct pfi_dynaddr *dyn; 329 char tblname[PF_TABLE_NAME_SIZE]; 330 struct pf_ruleset *ruleset = NULL; 331 int s, rv = 0; 332 333 if (aw->type != PF_ADDR_DYNIFTL) 334 return (0); 335 dyn = pool_get(&pfi_addr_pl, PR_NOWAIT); 336 if (dyn == NULL) 337 return (1); 338 bzero(dyn, sizeof(*dyn)); 339 340 s = splsoftnet(); 341 dyn->pfid_kif = pfi_attach_rule(aw->v.ifname); 342 if (dyn->pfid_kif == NULL) 343 senderr(1); 344 345 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 346 if (af == AF_INET && dyn->pfid_net == 32) 347 dyn->pfid_net = 128; 348 strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 349 if (aw->iflags & PFI_AFLAG_NETWORK) 350 strlcat(tblname, ":network", sizeof(tblname)); 351 if (aw->iflags & PFI_AFLAG_BROADCAST) 352 strlcat(tblname, ":broadcast", sizeof(tblname)); 353 if (aw->iflags & PFI_AFLAG_PEER) 354 strlcat(tblname, ":peer", sizeof(tblname)); 355 if (aw->iflags & PFI_AFLAG_NOALIAS) 356 strlcat(tblname, ":0", sizeof(tblname)); 357 if (dyn->pfid_net != 128) 358 snprintf(tblname + strlen(tblname), 359 sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 360 ruleset = pf_find_or_create_ruleset(pfi_reserved_anchor, 361 pfi_interface_ruleset); 362 if (ruleset == NULL) 363 senderr(1); 364 365 dyn->pfid_kt = pfr_attach_table(ruleset, tblname); 366 if (dyn->pfid_kt == NULL) 367 senderr(1); 368 369 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 370 dyn->pfid_iflags = aw->iflags; 371 dyn->pfid_af = af; 372 dyn->pfid_hook_cookie = hook_establish(dyn->pfid_kif->pfik_ah_head, 1, 373 pfi_dynaddr_update, dyn); 374 if (dyn->pfid_hook_cookie == NULL) 375 senderr(1); 376 377 aw->p.dyn = dyn; 378 pfi_dynaddr_update(aw->p.dyn); 379 splx(s); 380 return (0); 381 382 _bad: 383 if (dyn->pfid_kt != NULL) 384 pfr_detach_table(dyn->pfid_kt); 385 if (ruleset != NULL) 386 pf_remove_if_empty_ruleset(ruleset); 387 if (dyn->pfid_kif != NULL) 388 pfi_detach_rule(dyn->pfid_kif); 389 pool_put(&pfi_addr_pl, dyn); 390 splx(s); 391 return (rv); 392 } 393 394 void 395 pfi_dynaddr_update(void *p) 396 { 397 struct pfi_dynaddr *dyn = (struct pfi_dynaddr *)p; 398 struct pfi_kif *kif = dyn->pfid_kif; 399 struct pfr_ktable *kt = dyn->pfid_kt; 400 401 if (dyn == NULL || kif == NULL || kt == NULL) 402 panic("pfi_dynaddr_update"); 403 if (kt->pfrkt_larg != pfi_update) { 404 /* this table needs to be brought up-to-date */ 405 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 406 kt->pfrkt_larg = pfi_update; 407 } 408 pfr_dynaddr_update(kt, dyn); 409 } 410 411 void 412 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 413 { 414 int e, size2 = 0; 415 struct pfi_kif *p; 416 struct pfr_table t; 417 418 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE) && kif->pfik_ifp == NULL) { 419 pfr_clr_addrs(&kt->pfrkt_t, NULL, 0); 420 return; 421 } 422 pfi_buffer_cnt = 0; 423 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE)) 424 pfi_instance_add(kif->pfik_ifp, net, flags); 425 else if (strcmp(kif->pfik_name, "self")) { 426 TAILQ_FOREACH(p, &kif->pfik_grouphead, pfik_instances) 427 pfi_instance_add(p->pfik_ifp, net, flags); 428 } else { 429 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) 430 if (p->pfik_flags & PFI_IFLAG_INSTANCE) 431 pfi_instance_add(p->pfik_ifp, net, flags); 432 } 433 t = kt->pfrkt_t; 434 t.pfrt_flags = 0; 435 if ((e = pfr_set_addrs(&t, pfi_buffer, pfi_buffer_cnt, &size2, 436 NULL, NULL, NULL, 0))) 437 printf("pfi_table_update: cannot set %d new addresses " 438 "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 439 } 440 441 void 442 pfi_instance_add(struct ifnet *ifp, int net, int flags) 443 { 444 struct ifaddr *ia; 445 int got4 = 0, got6 = 0; 446 int net2, af; 447 448 if (ifp == NULL) 449 return; 450 TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) { 451 if (ia->ifa_addr == NULL) 452 continue; 453 af = ia->ifa_addr->sa_family; 454 if (af != AF_INET && af != AF_INET6) 455 continue; 456 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 457 continue; 458 if ((flags & PFI_AFLAG_BROADCAST) && 459 !(ifp->if_flags & IFF_BROADCAST)) 460 continue; 461 if ((flags & PFI_AFLAG_PEER) && 462 !(ifp->if_flags & IFF_POINTOPOINT)) 463 continue; 464 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 465 IN6_IS_ADDR_LINKLOCAL( 466 &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 467 continue; 468 if (flags & PFI_AFLAG_NOALIAS) { 469 if (af == AF_INET && got4) 470 continue; 471 if (af == AF_INET6 && got6) 472 continue; 473 } 474 if (af == AF_INET) 475 got4 = 1; 476 else 477 got6 = 1; 478 net2 = net; 479 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 480 if (af == AF_INET) { 481 net2 = pfi_unmask(&((struct sockaddr_in *) 482 ia->ifa_netmask)->sin_addr); 483 } else { 484 net2 = pfi_unmask(&((struct sockaddr_in6 *) 485 ia->ifa_netmask)->sin6_addr); 486 } 487 } 488 if (af == AF_INET && net2 > 32) 489 net2 = 32; 490 if (flags & PFI_AFLAG_BROADCAST) 491 pfi_address_add(ia->ifa_broadaddr, af, net2); 492 else if (flags & PFI_AFLAG_PEER) 493 pfi_address_add(ia->ifa_dstaddr, af, net2); 494 else 495 pfi_address_add(ia->ifa_addr, af, net2); 496 } 497 } 498 499 void 500 pfi_address_add(struct sockaddr *sa, int af, int net) 501 { 502 struct pfr_addr *p; 503 int i; 504 505 if (pfi_buffer_cnt >= pfi_buffer_max) { 506 int new_max = pfi_buffer_max * 2; 507 508 if (new_max > PFI_BUFFER_MAX) { 509 printf("pfi_address_add: address buffer full (%d/%d)\n", 510 pfi_buffer_cnt, PFI_BUFFER_MAX); 511 return; 512 } 513 p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, 514 M_DONTWAIT); 515 if (p == NULL) { 516 printf("pfi_address_add: no memory to grow buffer " 517 "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 518 return; 519 } 520 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer)); 521 /* no need to zero buffer */ 522 free(pfi_buffer, PFI_MTYPE); 523 pfi_buffer = p; 524 pfi_buffer_max = new_max; 525 } 526 if (af == AF_INET && net > 32) 527 net = 128; 528 p = pfi_buffer + pfi_buffer_cnt++; 529 bzero(p, sizeof(*p)); 530 p->pfra_af = af; 531 p->pfra_net = net; 532 if (af == AF_INET) 533 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 534 if (af == AF_INET6) { 535 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 536 if (IN6_IS_ADDR_LINKLOCAL(&p->pfra_ip6addr)) 537 p->pfra_ip6addr.s6_addr16[1] = 0; 538 } 539 /* mask network address bits */ 540 if (net < 128) 541 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 542 for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 543 ((caddr_t)p)[i] = 0; 544 } 545 546 void 547 pfi_dynaddr_remove(struct pf_addr_wrap *aw) 548 { 549 int s; 550 551 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 552 aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 553 return; 554 555 s = splsoftnet(); 556 hook_disestablish(aw->p.dyn->pfid_kif->pfik_ah_head, 557 aw->p.dyn->pfid_hook_cookie); 558 pfi_detach_rule(aw->p.dyn->pfid_kif); 559 aw->p.dyn->pfid_kif = NULL; 560 pfr_detach_table(aw->p.dyn->pfid_kt); 561 aw->p.dyn->pfid_kt = NULL; 562 pool_put(&pfi_addr_pl, aw->p.dyn); 563 aw->p.dyn = NULL; 564 splx(s); 565 } 566 567 void 568 pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 569 { 570 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 571 aw->p.dyn->pfid_kif == NULL) 572 return; 573 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 574 } 575 576 void 577 pfi_kifaddr_update(void *v) 578 { 579 int s; 580 581 s = splsoftnet(); 582 pfi_update++; 583 pfi_dohooks(v); 584 splx(s); 585 } 586 587 #ifdef __NetBSD__ 588 void 589 pfi_kifaddr_update_if(struct ifnet *ifp) 590 { 591 struct pfi_kif *p; 592 593 p = pfi_lookup_if(ifp->if_xname); 594 if (p == NULL) 595 panic("can't find interface"); 596 pfi_kifaddr_update(p); 597 } 598 #endif 599 600 int 601 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 602 { 603 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 604 } 605 606 struct pfi_kif * 607 pfi_if_create(const char *name, struct pfi_kif *q, int flags) 608 { 609 struct pfi_kif *p; 610 611 p = malloc(sizeof(*p), PFI_MTYPE, M_DONTWAIT); 612 if (p == NULL) 613 return (NULL); 614 bzero(p, sizeof(*p)); 615 p->pfik_ah_head = malloc(sizeof(*p->pfik_ah_head), PFI_MTYPE, 616 M_DONTWAIT); 617 if (p->pfik_ah_head == NULL) { 618 free(p, PFI_MTYPE); 619 return (NULL); 620 } 621 bzero(p->pfik_ah_head, sizeof(*p->pfik_ah_head)); 622 #ifdef __NetBSD__ 623 p->pfik_ifaddrhooks = malloc(sizeof(*p->pfik_ifaddrhooks), PFI_MTYPE, 624 M_DONTWAIT); 625 if (p->pfik_ifaddrhooks == NULL) { 626 free(p->pfik_ah_head, PFI_MTYPE); 627 free(p, PFI_MTYPE); 628 return (NULL); 629 } 630 bzero(p->pfik_ifaddrhooks, sizeof(*p->pfik_ifaddrhooks)); 631 #endif 632 TAILQ_INIT(p->pfik_ah_head); 633 TAILQ_INIT(&p->pfik_grouphead); 634 #ifdef __NetBSD__ 635 TAILQ_INIT(p->pfik_ifaddrhooks); 636 #endif 637 strlcpy(p->pfik_name, name, sizeof(p->pfik_name)); 638 RB_INIT(&p->pfik_lan_ext); 639 RB_INIT(&p->pfik_ext_gwy); 640 p->pfik_flags = flags; 641 p->pfik_parent = q; 642 p->pfik_tzero = time.tv_sec; 643 644 RB_INSERT(pfi_ifhead, &pfi_ifs, p); 645 if (q != NULL) { 646 q->pfik_addcnt++; 647 TAILQ_INSERT_TAIL(&q->pfik_grouphead, p, pfik_instances); 648 } 649 pfi_ifcnt++; 650 return (p); 651 } 652 653 int 654 pfi_maybe_destroy(struct pfi_kif *p) 655 { 656 int i, j, k, s; 657 struct pfi_kif *q = p->pfik_parent; 658 659 if ((p->pfik_flags & (PFI_IFLAG_ATTACHED | PFI_IFLAG_GROUP)) || 660 p->pfik_rules > 0 || p->pfik_states > 0) 661 return (0); 662 663 s = splsoftnet(); 664 if (q != NULL) { 665 for (i = 0; i < 2; i++) 666 for (j = 0; j < 2; j++) 667 for (k = 0; k < 2; k++) { 668 q->pfik_bytes[i][j][k] += 669 p->pfik_bytes[i][j][k]; 670 q->pfik_packets[i][j][k] += 671 p->pfik_packets[i][j][k]; 672 } 673 q->pfik_delcnt++; 674 TAILQ_REMOVE(&q->pfik_grouphead, p, pfik_instances); 675 } 676 pfi_ifcnt--; 677 RB_REMOVE(pfi_ifhead, &pfi_ifs, p); 678 splx(s); 679 680 free(p->pfik_ah_head, PFI_MTYPE); 681 free(p, PFI_MTYPE); 682 return (1); 683 } 684 685 void 686 pfi_copy_group(char *p, const char *q, int m) 687 { 688 while (m > 1 && *q && !(*q >= '0' && *q <= '9')) { 689 *p++ = *q++; 690 m--; 691 } 692 if (m > 0) 693 *p++ = '\0'; 694 } 695 696 void 697 pfi_dynamic_drivers(void) 698 { 699 #ifdef __OpenBSD__ 700 char *buses[] = PFI_DYNAMIC_BUSES; 701 int nbuses = sizeof(buses)/sizeof(buses[0]); 702 int enabled[sizeof(buses)/sizeof(buses[0])]; 703 struct device *dev; 704 struct cfdata *cf; 705 struct cfdriver *drv; 706 short *p; 707 int i; 708 709 bzero(enabled, sizeof(enabled)); 710 TAILQ_FOREACH(dev, &alldevs, dv_list) { 711 if (!(dev->dv_flags & DVF_ACTIVE)) 712 continue; 713 for (i = 0; i < nbuses; i++) 714 if (!enabled[i] && !strcmp(buses[i], 715 dev->dv_cfdata->cf_driver->cd_name)) 716 enabled[i] = 1; 717 } 718 for (cf = cfdata; cf->cf_driver; cf++) { 719 if (cf->cf_driver->cd_class != DV_IFNET) 720 continue; 721 for (p = cf->cf_parents; p && *p >= 0; p++) { 722 if ((drv = cfdata[*p].cf_driver) == NULL) 723 continue; 724 for (i = 0; i < nbuses; i++) 725 if (enabled[i] && 726 !strcmp(drv->cd_name, buses[i])) 727 break; 728 if (i < nbuses) { 729 pfi_newgroup(cf->cf_driver->cd_name, 730 PFI_IFLAG_DYNAMIC); 731 break; 732 } 733 } 734 } 735 #else 736 struct if_clone *ifc; 737 extern LIST_HEAD(if_cloners, if_clone) if_cloners; 738 739 LIST_FOREACH(ifc, &if_cloners, ifc_list) 740 pfi_newgroup(ifc->ifc_name, PFI_IFLAG_DYNAMIC); 741 #endif 742 } 743 744 void 745 pfi_newgroup(const char *name, int flags) 746 { 747 struct pfi_kif *p; 748 749 p = pfi_lookup_if(name); 750 if (p == NULL) 751 p = pfi_if_create(name, pfi_self, PFI_IFLAG_GROUP); 752 if (p == NULL) { 753 printf("pfi_newgroup: cannot allocate '%s' group", name); 754 return; 755 } 756 p->pfik_flags |= flags; 757 } 758 759 void 760 pfi_fill_oldstatus(struct pf_status *pfs) 761 { 762 struct pfi_kif *p, key; 763 int i, j, k, s; 764 765 strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name)); 766 s = splsoftnet(); 767 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 768 if (p == NULL) { 769 splx(s); 770 return; 771 } 772 bzero(pfs->pcounters, sizeof(pfs->pcounters)); 773 bzero(pfs->bcounters, sizeof(pfs->bcounters)); 774 for (i = 0; i < 2; i++) 775 for (j = 0; j < 2; j++) 776 for (k = 0; k < 2; k++) { 777 pfs->pcounters[i][j][k] = 778 p->pfik_packets[i][j][k]; 779 pfs->bcounters[i][j] += 780 p->pfik_bytes[i][j][k]; 781 } 782 splx(s); 783 } 784 785 int 786 pfi_clr_istats(const char *name, int *nzero, int flags) 787 { 788 struct pfi_kif *p; 789 int n = 0, s; 790 long tzero = time.tv_sec; 791 792 s = splsoftnet(); 793 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 794 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 795 if (pfi_skip_if(name, p, flags)) 796 continue; 797 bzero(p->pfik_packets, sizeof(p->pfik_packets)); 798 bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 799 p->pfik_tzero = tzero; 800 n++; 801 } 802 splx(s); 803 if (nzero != NULL) 804 *nzero = n; 805 return (0); 806 } 807 808 int 809 pfi_get_ifaces(const char *name, struct pfi_if *buf, int *size, int flags) 810 { 811 struct pfi_kif *p; 812 int s, n = 0; 813 814 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 815 s = splsoftnet(); 816 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 817 if (pfi_skip_if(name, p, flags)) 818 continue; 819 if (*size > n++) { 820 if (!p->pfik_tzero) 821 p->pfik_tzero = boottime.tv_sec; 822 if (copyout(p, buf++, sizeof(*buf))) { 823 splx(s); 824 return (EFAULT); 825 } 826 } 827 } 828 splx(s); 829 *size = n; 830 return (0); 831 } 832 833 struct pfi_kif * 834 pfi_lookup_if(const char *name) 835 { 836 struct pfi_kif *p, key; 837 838 strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 839 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 840 return (p); 841 } 842 843 int 844 pfi_skip_if(const char *filter, struct pfi_kif *p, int f) 845 { 846 int n; 847 848 if ((p->pfik_flags & PFI_IFLAG_GROUP) && !(f & PFI_FLAG_GROUP)) 849 return (1); 850 if ((p->pfik_flags & PFI_IFLAG_INSTANCE) && !(f & PFI_FLAG_INSTANCE)) 851 return (1); 852 if (filter == NULL || !*filter) 853 return (0); 854 if (!strcmp(p->pfik_name, filter)) 855 return (0); /* exact match */ 856 n = strlen(filter); 857 if (n < 1 || n >= IFNAMSIZ) 858 return (1); /* sanity check */ 859 if (filter[n-1] >= '0' && filter[n-1] <= '9') 860 return (1); /* only do exact match in that case */ 861 if (strncmp(p->pfik_name, filter, n)) 862 return (1); /* prefix doesn't match */ 863 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 864 } 865 866 /* from pf_print_state.c */ 867 int 868 pfi_unmask(void *addr) 869 { 870 struct pf_addr *m = addr; 871 int i = 31, j = 0, b = 0; 872 u_int32_t tmp; 873 874 while (j < 4 && m->addr32[j] == 0xffffffff) { 875 b += 32; 876 j++; 877 } 878 if (j < 4) { 879 tmp = ntohl(m->addr32[j]); 880 for (i = 31; tmp & (1 << i); --i) 881 b++; 882 } 883 return (b); 884 } 885 886 void 887 pfi_dohooks(struct pfi_kif *p) 888 { 889 for (; p != NULL; p = p->pfik_parent) 890 dohooks(p->pfik_ah_head, 0); 891 } 892 893 int 894 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 895 { 896 if (af == AF_INET) { 897 switch (dyn->pfid_acnt4) { 898 case 0: 899 return (0); 900 case 1: 901 return (PF_MATCHA(0, &dyn->pfid_addr4, 902 &dyn->pfid_mask4, a, AF_INET)); 903 default: 904 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 905 } 906 } else { 907 switch (dyn->pfid_acnt6) { 908 case 0: 909 return (0); 910 case 1: 911 return (PF_MATCHA(0, &dyn->pfid_addr6, 912 &dyn->pfid_mask6, a, AF_INET6)); 913 default: 914 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 915 } 916 } 917 } 918 919 /* from openbsd/sys/kern/kern_subr.c */ 920 #ifdef __NetBSD__ 921 static void * 922 hook_establish(struct hook_desc_head *head, int tail, void (*fn)(void *), 923 void *arg) 924 { 925 struct hook_desc *hdp; 926 927 hdp = (struct hook_desc *)malloc(sizeof (*hdp), M_DEVBUF, M_NOWAIT); 928 if (hdp == NULL) 929 return (NULL); 930 931 hdp->hd_fn = fn; 932 hdp->hd_arg = arg; 933 if (tail) 934 TAILQ_INSERT_TAIL(head, hdp, hd_list); 935 else 936 TAILQ_INSERT_HEAD(head, hdp, hd_list); 937 938 return (hdp); 939 } 940 941 static void 942 hook_disestablish(struct hook_desc_head *head, void *vhook) 943 { 944 struct hook_desc *hdp; 945 946 #ifdef DIAGNOSTIC 947 for (hdp = TAILQ_FIRST(head); hdp != NULL; 948 hdp = TAILQ_NEXT(hdp, hd_list)) 949 if (hdp == vhook) 950 break; 951 if (hdp == NULL) 952 panic("hook_disestablish: hook not established"); 953 #endif 954 hdp = vhook; 955 TAILQ_REMOVE(head, hdp, hd_list); 956 free(hdp, M_DEVBUF); 957 } 958 959 static void 960 dohooks(struct hook_desc_head *head, int flags) 961 { 962 struct hook_desc *hdp; 963 964 if ((flags & HOOK_REMOVE) == 0) { 965 TAILQ_FOREACH(hdp, head, hd_list) { 966 (*hdp->hd_fn)(hdp->hd_arg); 967 } 968 } else { 969 while ((hdp = TAILQ_FIRST(head)) != NULL) { 970 TAILQ_REMOVE(head, hdp, hd_list); 971 (*hdp->hd_fn)(hdp->hd_arg); 972 if ((flags & HOOK_FREE) != 0) 973 free(hdp, M_DEVBUF); 974 } 975 } 976 } 977 #endif 978
Indexes created Sun Oct 12 05:10:08 GMT 2025