pf_if.c revision 1.6
1 /* $NetBSD: pf_if.c,v 1.6 2004/11/14 11:12:16 yamt Exp $ */ 2 /* $OpenBSD: pf_if.c,v 1.20 2004/08/15 15:31:46 henning Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2003 Cedric Berger 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #ifdef _KERNEL_OPT 35 #include "opt_inet.h" 36 #endif 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/mbuf.h> 41 #include <sys/filio.h> 42 #include <sys/socket.h> 43 #include <sys/socketvar.h> 44 #include <sys/kernel.h> 45 #include <sys/device.h> 46 #include <sys/time.h> 47 48 #include <net/if.h> 49 #include <net/if_types.h> 50 51 #include <netinet/in.h> 52 #include <netinet/in_var.h> 53 #include <netinet/in_systm.h> 54 #include <netinet/ip.h> 55 #include <netinet/ip_var.h> 56 57 #include <net/pfvar.h> 58 59 #ifdef INET6 60 #include <netinet/ip6.h> 61 #endif /* INET6 */ 62 63 #define ACCEPT_FLAGS(oklist) \ 64 do { \ 65 if ((flags & ~(oklist)) & \ 66 PFI_FLAG_ALLMASK) \ 67 return (EINVAL); \ 68 } while (0) 69 70 #define senderr(e) do { rv = (e); goto _bad; } while (0) 71 72 struct pfi_kif **pfi_index2kif; 73 struct pfi_kif *pfi_self; 74 int pfi_indexlim; 75 struct pfi_ifhead pfi_ifs; 76 struct pfi_statehead pfi_statehead; 77 int pfi_ifcnt; 78 struct pool pfi_addr_pl; 79 long pfi_update = 1; 80 struct pfr_addr *pfi_buffer; 81 int pfi_buffer_cnt; 82 int pfi_buffer_max; 83 84 void pfi_dynaddr_update(void *); 85 void pfi_kifaddr_update(void *); 86 #ifdef __NetBSD__ 87 void pfi_kifaddr_update_if(struct ifnet *); 88 #endif 89 void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, 90 int, int); 91 void pfi_instance_add(struct ifnet *, int, int); 92 void pfi_address_add(struct sockaddr *, int, int); 93 int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 94 struct pfi_kif *pfi_if_create(const char *, struct pfi_kif *, int); 95 void pfi_copy_group(char *, const char *, int); 96 void pfi_newgroup(const char *, int); 97 int pfi_skip_if(const char *, struct pfi_kif *, int); 98 int pfi_unmask(void *); 99 void pfi_dohooks(struct pfi_kif *); 100 101 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 102 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 103 104 #define PFI_BUFFER_MAX 0x10000 105 #define PFI_MTYPE M_IFADDR 106 107 #ifdef __NetBSD__ 108 static void *hook_establish(struct hook_desc_head *, int, void (*)(void *), 109 void *); 110 static void hook_disestablish(struct hook_desc_head *, void *); 111 static void dohooks(struct hook_desc_head *, int); 112 113 #define HOOK_REMOVE 0x01 114 #define HOOK_FREE 0x02 115 #endif 116 117 void 118 pfi_initialize(void) 119 { 120 if (pfi_self != NULL) /* already initialized */ 121 return; 122 123 TAILQ_INIT(&pfi_statehead); 124 pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0, 125 "pfiaddrpl", &pool_allocator_nointr); 126 pfi_buffer_max = 64; 127 pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer), 128 PFI_MTYPE, M_WAITOK); 129 pfi_self = pfi_if_create("self", NULL, PFI_IFLAG_GROUP); 130 } 131 132 #ifdef _LKM 133 void 134 pfi_destroy(void) 135 { 136 struct pfi_kif *p; 137 138 while ((p = TAILQ_FIRST(&pfi_statehead)) != NULL) { 139 TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 140 free(p, PFI_MTYPE); 141 } 142 pool_destroy(&pfi_addr_pl); 143 144 pfi_self = NULL; 145 } 146 #endif 147 148 void 149 pfi_attach_clone(struct if_clone *ifc) 150 { 151 pfi_initialize(); 152 pfi_newgroup(ifc->ifc_name, PFI_IFLAG_CLONABLE); 153 } 154 155 void 156 pfi_attach_ifnet(struct ifnet *ifp) 157 { 158 struct pfi_kif *p, *q, key; 159 int s; 160 161 pfi_initialize(); 162 s = splsoftnet(); 163 pfi_update++; 164 if (ifp->if_index >= pfi_indexlim) { 165 /* 166 * grow pfi_index2kif, similar to ifindex2ifnet code in if.c 167 */ 168 size_t m, n, oldlim; 169 struct pfi_kif **mp, **np; 170 171 oldlim = pfi_indexlim; 172 if (pfi_indexlim == 0) 173 pfi_indexlim = 64; 174 while (ifp->if_index >= pfi_indexlim) 175 pfi_indexlim <<= 1; 176 177 m = oldlim * sizeof(struct pfi_kif *); 178 mp = pfi_index2kif; 179 n = pfi_indexlim * sizeof(struct pfi_kif *); 180 np = malloc(n, PFI_MTYPE, M_DONTWAIT); 181 if (np == NULL) 182 panic("pfi_attach_ifnet: " 183 "cannot allocate translation table"); 184 bzero(np, n); 185 if (mp != NULL) 186 bcopy(mp, np, m); 187 pfi_index2kif = np; 188 if (mp != NULL) 189 free(mp, PFI_MTYPE); 190 } 191 192 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 193 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 194 if (p == NULL) { 195 /* add group */ 196 pfi_copy_group(key.pfik_name, ifp->if_xname, 197 sizeof(key.pfik_name)); 198 q = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 199 if (q == NULL) 200 q = pfi_if_create(key.pfik_name, pfi_self, PFI_IFLAG_GROUP); 201 if (q == NULL) 202 panic("pfi_attach_ifnet: " 203 "cannot allocate '%s' group", key.pfik_name); 204 205 /* add interface */ 206 p = pfi_if_create(ifp->if_xname, q, PFI_IFLAG_INSTANCE); 207 if (p == NULL) 208 panic("pfi_attach_ifnet: " 209 "cannot allocate '%s' interface", ifp->if_xname); 210 } else 211 q = p->pfik_parent; 212 p->pfik_ifp = ifp; 213 p->pfik_flags |= PFI_IFLAG_ATTACHED; 214 #ifdef __OpenBSD__ 215 p->pfik_ah_cookie = 216 hook_establish(ifp->if_addrhooks, 1, pfi_kifaddr_update, p); 217 #else 218 p->pfik_ah_cookie = 219 hook_establish(p->pfik_ifaddrhooks, 1, pfi_kifaddr_update, p); 220 #endif 221 pfi_index2kif[ifp->if_index] = p; 222 pfi_dohooks(p); 223 splx(s); 224 } 225 226 void 227 pfi_detach_ifnet(struct ifnet *ifp) 228 { 229 struct pfi_kif *p, *q, key; 230 int s; 231 232 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 233 234 s = splsoftnet(); 235 pfi_update++; 236 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 237 if (p == NULL) { 238 printf("pfi_detach_ifnet: cannot find %s", ifp->if_xname); 239 splx(s); 240 return; 241 } 242 #ifdef __OpenBSD__ 243 hook_disestablish(p->pfik_ifp->if_addrhooks, p->pfik_ah_cookie); 244 #else 245 hook_disestablish(p->pfik_ifaddrhooks, p->pfik_ah_cookie); 246 #endif 247 q = p->pfik_parent; 248 p->pfik_ifp = NULL; 249 p->pfik_flags &= ~PFI_IFLAG_ATTACHED; 250 pfi_index2kif[ifp->if_index] = NULL; 251 pfi_dohooks(p); 252 pfi_maybe_destroy(p); 253 splx(s); 254 } 255 256 struct pfi_kif * 257 pfi_lookup_create(const char *name) 258 { 259 struct pfi_kif *p, *q, key; 260 int s; 261 262 s = splsoftnet(); 263 p = pfi_lookup_if(name); 264 if (p == NULL) { 265 pfi_copy_group(key.pfik_name, name, sizeof(key.pfik_name)); 266 q = pfi_lookup_if(key.pfik_name); 267 if (q == NULL) { 268 pfi_newgroup(key.pfik_name, PFI_IFLAG_DYNAMIC); 269 q = pfi_lookup_if(key.pfik_name); 270 } 271 p = pfi_lookup_if(name); 272 if (p == NULL && q != NULL) 273 p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE); 274 } 275 splx(s); 276 return (p); 277 } 278 279 struct pfi_kif * 280 pfi_attach_rule(const char *name) 281 { 282 struct pfi_kif *p; 283 284 p = pfi_lookup_create(name); 285 if (p != NULL) 286 p->pfik_rules++; 287 return (p); 288 } 289 290 void 291 pfi_detach_rule(struct pfi_kif *p) 292 { 293 if (p == NULL) 294 return; 295 if (p->pfik_rules > 0) 296 p->pfik_rules--; 297 else 298 printf("pfi_detach_rule: reference count at 0\n"); 299 pfi_maybe_destroy(p); 300 } 301 302 void 303 pfi_attach_state(struct pfi_kif *p) 304 { 305 if (!p->pfik_states++) 306 TAILQ_INSERT_TAIL(&pfi_statehead, p, pfik_w_states); 307 } 308 309 void 310 pfi_detach_state(struct pfi_kif *p) 311 { 312 if (p == NULL) 313 return; 314 if (p->pfik_states <= 0) { 315 printf("pfi_detach_state: reference count <= 0\n"); 316 return; 317 } 318 if (!--p->pfik_states) 319 TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states); 320 pfi_maybe_destroy(p); 321 } 322 323 int 324 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 325 { 326 struct pfi_dynaddr *dyn; 327 char tblname[PF_TABLE_NAME_SIZE]; 328 struct pf_ruleset *ruleset = NULL; 329 int s, rv = 0; 330 331 if (aw->type != PF_ADDR_DYNIFTL) 332 return (0); 333 dyn = pool_get(&pfi_addr_pl, PR_NOWAIT); 334 if (dyn == NULL) 335 return (1); 336 bzero(dyn, sizeof(*dyn)); 337 338 s = splsoftnet(); 339 dyn->pfid_kif = pfi_attach_rule(aw->v.ifname); 340 if (dyn->pfid_kif == NULL) 341 senderr(1); 342 343 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 344 if (af == AF_INET && dyn->pfid_net == 32) 345 dyn->pfid_net = 128; 346 strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 347 if (aw->iflags & PFI_AFLAG_NETWORK) 348 strlcat(tblname, ":network", sizeof(tblname)); 349 if (aw->iflags & PFI_AFLAG_BROADCAST) 350 strlcat(tblname, ":broadcast", sizeof(tblname)); 351 if (aw->iflags & PFI_AFLAG_PEER) 352 strlcat(tblname, ":peer", sizeof(tblname)); 353 if (aw->iflags & PFI_AFLAG_NOALIAS) 354 strlcat(tblname, ":0", sizeof(tblname)); 355 if (dyn->pfid_net != 128) 356 snprintf(tblname + strlen(tblname), 357 sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 358 ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR); 359 if (ruleset == NULL) 360 senderr(1); 361 362 dyn->pfid_kt = pfr_attach_table(ruleset, tblname); 363 if (dyn->pfid_kt == NULL) 364 senderr(1); 365 366 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 367 dyn->pfid_iflags = aw->iflags; 368 dyn->pfid_af = af; 369 dyn->pfid_hook_cookie = hook_establish(dyn->pfid_kif->pfik_ah_head, 1, 370 pfi_dynaddr_update, dyn); 371 if (dyn->pfid_hook_cookie == NULL) 372 senderr(1); 373 374 aw->p.dyn = dyn; 375 pfi_dynaddr_update(aw->p.dyn); 376 splx(s); 377 return (0); 378 379 _bad: 380 if (dyn->pfid_kt != NULL) 381 pfr_detach_table(dyn->pfid_kt); 382 if (ruleset != NULL) 383 pf_remove_if_empty_ruleset(ruleset); 384 if (dyn->pfid_kif != NULL) 385 pfi_detach_rule(dyn->pfid_kif); 386 pool_put(&pfi_addr_pl, dyn); 387 splx(s); 388 return (rv); 389 } 390 391 void 392 pfi_dynaddr_update(void *p) 393 { 394 struct pfi_dynaddr *dyn = (struct pfi_dynaddr *)p; 395 struct pfi_kif *kif = dyn->pfid_kif; 396 struct pfr_ktable *kt = dyn->pfid_kt; 397 398 if (dyn == NULL || kif == NULL || kt == NULL) 399 panic("pfi_dynaddr_update"); 400 if (kt->pfrkt_larg != pfi_update) { 401 /* this table needs to be brought up-to-date */ 402 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 403 kt->pfrkt_larg = pfi_update; 404 } 405 pfr_dynaddr_update(kt, dyn); 406 } 407 408 void 409 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 410 { 411 int e, size2 = 0; 412 struct pfi_kif *p; 413 struct pfr_table t; 414 415 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE) && kif->pfik_ifp == NULL) { 416 pfr_clr_addrs(&kt->pfrkt_t, NULL, 0); 417 return; 418 } 419 pfi_buffer_cnt = 0; 420 if ((kif->pfik_flags & PFI_IFLAG_INSTANCE)) 421 pfi_instance_add(kif->pfik_ifp, net, flags); 422 else if (strcmp(kif->pfik_name, "self")) { 423 TAILQ_FOREACH(p, &kif->pfik_grouphead, pfik_instances) 424 pfi_instance_add(p->pfik_ifp, net, flags); 425 } else { 426 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) 427 if (p->pfik_flags & PFI_IFLAG_INSTANCE) 428 pfi_instance_add(p->pfik_ifp, net, flags); 429 } 430 t = kt->pfrkt_t; 431 t.pfrt_flags = 0; 432 if ((e = pfr_set_addrs(&t, pfi_buffer, pfi_buffer_cnt, &size2, 433 NULL, NULL, NULL, 0))) 434 printf("pfi_table_update: cannot set %d new addresses " 435 "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 436 } 437 438 void 439 pfi_instance_add(struct ifnet *ifp, int net, int flags) 440 { 441 struct ifaddr *ia; 442 int got4 = 0, got6 = 0; 443 int net2, af; 444 445 if (ifp == NULL) 446 return; 447 TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) { 448 if (ia->ifa_addr == NULL) 449 continue; 450 af = ia->ifa_addr->sa_family; 451 if (af != AF_INET && af != AF_INET6) 452 continue; 453 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 454 continue; 455 if ((flags & PFI_AFLAG_BROADCAST) && 456 !(ifp->if_flags & IFF_BROADCAST)) 457 continue; 458 if ((flags & PFI_AFLAG_PEER) && 459 !(ifp->if_flags & IFF_POINTOPOINT)) 460 continue; 461 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 462 IN6_IS_ADDR_LINKLOCAL( 463 &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 464 continue; 465 if (flags & PFI_AFLAG_NOALIAS) { 466 if (af == AF_INET && got4) 467 continue; 468 if (af == AF_INET6 && got6) 469 continue; 470 } 471 if (af == AF_INET) 472 got4 = 1; 473 else if (af == AF_INET6) 474 got6 = 1; 475 net2 = net; 476 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 477 if (af == AF_INET) { 478 net2 = pfi_unmask(&((struct sockaddr_in *) 479 ia->ifa_netmask)->sin_addr); 480 } else if (af == AF_INET6) { 481 net2 = pfi_unmask(&((struct sockaddr_in6 *) 482 ia->ifa_netmask)->sin6_addr); 483 } 484 } 485 if (af == AF_INET && net2 > 32) 486 net2 = 32; 487 if (flags & PFI_AFLAG_BROADCAST) 488 pfi_address_add(ia->ifa_broadaddr, af, net2); 489 else if (flags & PFI_AFLAG_PEER) 490 pfi_address_add(ia->ifa_dstaddr, af, net2); 491 else 492 pfi_address_add(ia->ifa_addr, af, net2); 493 } 494 } 495 496 void 497 pfi_address_add(struct sockaddr *sa, int af, int net) 498 { 499 struct pfr_addr *p; 500 int i; 501 502 if (pfi_buffer_cnt >= pfi_buffer_max) { 503 int new_max = pfi_buffer_max * 2; 504 505 if (new_max > PFI_BUFFER_MAX) { 506 printf("pfi_address_add: address buffer full (%d/%d)\n", 507 pfi_buffer_cnt, PFI_BUFFER_MAX); 508 return; 509 } 510 p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, 511 M_DONTWAIT); 512 if (p == NULL) { 513 printf("pfi_address_add: no memory to grow buffer " 514 "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 515 return; 516 } 517 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer)); 518 /* no need to zero buffer */ 519 free(pfi_buffer, PFI_MTYPE); 520 pfi_buffer = p; 521 pfi_buffer_max = new_max; 522 } 523 if (af == AF_INET && net > 32) 524 net = 128; 525 p = pfi_buffer + pfi_buffer_cnt++; 526 bzero(p, sizeof(*p)); 527 p->pfra_af = af; 528 p->pfra_net = net; 529 if (af == AF_INET) 530 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 531 if (af == AF_INET6) { 532 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 533 if (IN6_IS_ADDR_LINKLOCAL(&p->pfra_ip6addr)) 534 p->pfra_ip6addr.s6_addr16[1] = 0; 535 } 536 /* mask network address bits */ 537 if (net < 128) 538 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 539 for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 540 ((caddr_t)p)[i] = 0; 541 } 542 543 void 544 pfi_dynaddr_remove(struct pf_addr_wrap *aw) 545 { 546 int s; 547 548 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 549 aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 550 return; 551 552 s = splsoftnet(); 553 hook_disestablish(aw->p.dyn->pfid_kif->pfik_ah_head, 554 aw->p.dyn->pfid_hook_cookie); 555 pfi_detach_rule(aw->p.dyn->pfid_kif); 556 aw->p.dyn->pfid_kif = NULL; 557 pfr_detach_table(aw->p.dyn->pfid_kt); 558 aw->p.dyn->pfid_kt = NULL; 559 pool_put(&pfi_addr_pl, aw->p.dyn); 560 aw->p.dyn = NULL; 561 splx(s); 562 } 563 564 void 565 pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 566 { 567 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 568 aw->p.dyn->pfid_kif == NULL) 569 return; 570 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 571 } 572 573 void 574 pfi_kifaddr_update(void *v) 575 { 576 int s; 577 578 s = splsoftnet(); 579 pfi_update++; 580 pfi_dohooks(v); 581 splx(s); 582 } 583 584 #ifdef __NetBSD__ 585 void 586 pfi_kifaddr_update_if(struct ifnet *ifp) 587 { 588 struct pfi_kif *p; 589 590 p = pfi_lookup_if(ifp->if_xname); 591 if (p == NULL) 592 panic("can't find interface"); 593 pfi_kifaddr_update(p); 594 } 595 #endif 596 597 int 598 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 599 { 600 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 601 } 602 603 struct pfi_kif * 604 pfi_if_create(const char *name, struct pfi_kif *q, int flags) 605 { 606 struct pfi_kif *p; 607 608 p = malloc(sizeof(*p), PFI_MTYPE, M_DONTWAIT); 609 if (p == NULL) 610 return (NULL); 611 bzero(p, sizeof(*p)); 612 p->pfik_ah_head = malloc(sizeof(*p->pfik_ah_head), PFI_MTYPE, 613 M_DONTWAIT); 614 if (p->pfik_ah_head == NULL) { 615 free(p, PFI_MTYPE); 616 return (NULL); 617 } 618 bzero(p->pfik_ah_head, sizeof(*p->pfik_ah_head)); 619 #ifdef __NetBSD__ 620 p->pfik_ifaddrhooks = malloc(sizeof(*p->pfik_ifaddrhooks), PFI_MTYPE, 621 M_DONTWAIT); 622 if (p->pfik_ifaddrhooks == NULL) { 623 free(p->pfik_ah_head, PFI_MTYPE); 624 free(p, PFI_MTYPE); 625 return (NULL); 626 } 627 bzero(p->pfik_ifaddrhooks, sizeof(*p->pfik_ifaddrhooks)); 628 #endif 629 TAILQ_INIT(p->pfik_ah_head); 630 TAILQ_INIT(&p->pfik_grouphead); 631 #ifdef __NetBSD__ 632 TAILQ_INIT(p->pfik_ifaddrhooks); 633 #endif 634 strlcpy(p->pfik_name, name, sizeof(p->pfik_name)); 635 RB_INIT(&p->pfik_lan_ext); 636 RB_INIT(&p->pfik_ext_gwy); 637 p->pfik_flags = flags; 638 p->pfik_parent = q; 639 p->pfik_tzero = time_second; 640 641 RB_INSERT(pfi_ifhead, &pfi_ifs, p); 642 if (q != NULL) { 643 q->pfik_addcnt++; 644 TAILQ_INSERT_TAIL(&q->pfik_grouphead, p, pfik_instances); 645 } 646 pfi_ifcnt++; 647 return (p); 648 } 649 650 int 651 pfi_maybe_destroy(struct pfi_kif *p) 652 { 653 int i, j, k, s; 654 struct pfi_kif *q = p->pfik_parent; 655 656 if ((p->pfik_flags & (PFI_IFLAG_ATTACHED | PFI_IFLAG_GROUP)) || 657 p->pfik_rules > 0 || p->pfik_states > 0) 658 return (0); 659 660 s = splsoftnet(); 661 if (q != NULL) { 662 for (i = 0; i < 2; i++) 663 for (j = 0; j < 2; j++) 664 for (k = 0; k < 2; k++) { 665 q->pfik_bytes[i][j][k] += 666 p->pfik_bytes[i][j][k]; 667 q->pfik_packets[i][j][k] += 668 p->pfik_packets[i][j][k]; 669 } 670 q->pfik_delcnt++; 671 TAILQ_REMOVE(&q->pfik_grouphead, p, pfik_instances); 672 } 673 pfi_ifcnt--; 674 RB_REMOVE(pfi_ifhead, &pfi_ifs, p); 675 splx(s); 676 677 free(p->pfik_ah_head, PFI_MTYPE); 678 free(p, PFI_MTYPE); 679 return (1); 680 } 681 682 void 683 pfi_copy_group(char *p, const char *q, int m) 684 { 685 while (m > 1 && *q && !(*q >= '0' && *q <= '9')) { 686 *p++ = *q++; 687 m--; 688 } 689 if (m > 0) 690 *p++ = '\0'; 691 } 692 693 void 694 pfi_newgroup(const char *name, int flags) 695 { 696 struct pfi_kif *p; 697 698 p = pfi_lookup_if(name); 699 if (p == NULL) 700 p = pfi_if_create(name, pfi_self, PFI_IFLAG_GROUP); 701 if (p == NULL) { 702 printf("pfi_newgroup: cannot allocate '%s' group", name); 703 return; 704 } 705 p->pfik_flags |= flags; 706 } 707 708 void 709 pfi_fill_oldstatus(struct pf_status *pfs) 710 { 711 struct pfi_kif *p, key; 712 int i, j, k, s; 713 714 strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name)); 715 s = splsoftnet(); 716 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 717 if (p == NULL) { 718 splx(s); 719 return; 720 } 721 bzero(pfs->pcounters, sizeof(pfs->pcounters)); 722 bzero(pfs->bcounters, sizeof(pfs->bcounters)); 723 for (i = 0; i < 2; i++) 724 for (j = 0; j < 2; j++) 725 for (k = 0; k < 2; k++) { 726 pfs->pcounters[i][j][k] = 727 p->pfik_packets[i][j][k]; 728 pfs->bcounters[i][j] += 729 p->pfik_bytes[i][j][k]; 730 } 731 splx(s); 732 } 733 734 int 735 pfi_clr_istats(const char *name, int *nzero, int flags) 736 { 737 struct pfi_kif *p; 738 int n = 0, s; 739 long tzero = time_second; 740 741 s = splsoftnet(); 742 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 743 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 744 if (pfi_skip_if(name, p, flags)) 745 continue; 746 bzero(p->pfik_packets, sizeof(p->pfik_packets)); 747 bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 748 p->pfik_tzero = tzero; 749 n++; 750 } 751 splx(s); 752 if (nzero != NULL) 753 *nzero = n; 754 return (0); 755 } 756 757 int 758 pfi_get_ifaces(const char *name, struct pfi_if *buf, int *size, int flags) 759 { 760 struct pfi_kif *p; 761 int s, n = 0; 762 763 ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE); 764 s = splsoftnet(); 765 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 766 if (pfi_skip_if(name, p, flags)) 767 continue; 768 if (*size > n++) { 769 if (!p->pfik_tzero) 770 p->pfik_tzero = time_second; 771 if (copyout(p, buf++, sizeof(*buf))) { 772 splx(s); 773 return (EFAULT); 774 } 775 } 776 } 777 splx(s); 778 *size = n; 779 return (0); 780 } 781 782 struct pfi_kif * 783 pfi_lookup_if(const char *name) 784 { 785 struct pfi_kif *p, key; 786 787 strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 788 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 789 return (p); 790 } 791 792 int 793 pfi_skip_if(const char *filter, struct pfi_kif *p, int f) 794 { 795 int n; 796 797 if ((p->pfik_flags & PFI_IFLAG_GROUP) && !(f & PFI_FLAG_GROUP)) 798 return (1); 799 if ((p->pfik_flags & PFI_IFLAG_INSTANCE) && !(f & PFI_FLAG_INSTANCE)) 800 return (1); 801 if (filter == NULL || !*filter) 802 return (0); 803 if (!strcmp(p->pfik_name, filter)) 804 return (0); /* exact match */ 805 n = strlen(filter); 806 if (n < 1 || n >= IFNAMSIZ) 807 return (1); /* sanity check */ 808 if (filter[n-1] >= '0' && filter[n-1] <= '9') 809 return (1); /* only do exact match in that case */ 810 if (strncmp(p->pfik_name, filter, n)) 811 return (1); /* prefix doesn't match */ 812 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 813 } 814 815 /* from pf_print_state.c */ 816 int 817 pfi_unmask(void *addr) 818 { 819 struct pf_addr *m = addr; 820 int i = 31, j = 0, b = 0; 821 u_int32_t tmp; 822 823 while (j < 4 && m->addr32[j] == 0xffffffff) { 824 b += 32; 825 j++; 826 } 827 if (j < 4) { 828 tmp = ntohl(m->addr32[j]); 829 for (i = 31; tmp & (1 << i); --i) 830 b++; 831 } 832 return (b); 833 } 834 835 void 836 pfi_dohooks(struct pfi_kif *p) 837 { 838 for (; p != NULL; p = p->pfik_parent) 839 dohooks(p->pfik_ah_head, 0); 840 } 841 842 int 843 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 844 { 845 switch (af) { 846 #ifdef INET 847 case AF_INET: 848 switch (dyn->pfid_acnt4) { 849 case 0: 850 return (0); 851 case 1: 852 return (PF_MATCHA(0, &dyn->pfid_addr4, 853 &dyn->pfid_mask4, a, AF_INET)); 854 default: 855 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 856 } 857 break; 858 #endif /* INET */ 859 #ifdef INET6 860 case AF_INET6: 861 switch (dyn->pfid_acnt6) { 862 case 0: 863 return (0); 864 case 1: 865 return (PF_MATCHA(0, &dyn->pfid_addr6, 866 &dyn->pfid_mask6, a, AF_INET6)); 867 default: 868 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 869 } 870 break; 871 #endif /* INET6 */ 872 default: 873 return (0); 874 } 875 } 876 877 /* from openbsd/sys/kern/kern_subr.c */ 878 #ifdef __NetBSD__ 879 static void * 880 hook_establish(struct hook_desc_head *head, int tail, void (*fn)(void *), 881 void *arg) 882 { 883 struct hook_desc *hdp; 884 885 hdp = (struct hook_desc *)malloc(sizeof (*hdp), M_DEVBUF, M_NOWAIT); 886 if (hdp == NULL) 887 return (NULL); 888 889 hdp->hd_fn = fn; 890 hdp->hd_arg = arg; 891 if (tail) 892 TAILQ_INSERT_TAIL(head, hdp, hd_list); 893 else 894 TAILQ_INSERT_HEAD(head, hdp, hd_list); 895 896 return (hdp); 897 } 898 899 static void 900 hook_disestablish(struct hook_desc_head *head, void *vhook) 901 { 902 struct hook_desc *hdp; 903 904 #ifdef DIAGNOSTIC 905 for (hdp = TAILQ_FIRST(head); hdp != NULL; 906 hdp = TAILQ_NEXT(hdp, hd_list)) 907 if (hdp == vhook) 908 break; 909 if (hdp == NULL) 910 panic("hook_disestablish: hook not established"); 911 #endif 912 hdp = vhook; 913 TAILQ_REMOVE(head, hdp, hd_list); 914 free(hdp, M_DEVBUF); 915 } 916 917 static void 918 dohooks(struct hook_desc_head *head, int flags) 919 { 920 struct hook_desc *hdp; 921 922 if ((flags & HOOK_REMOVE) == 0) { 923 TAILQ_FOREACH(hdp, head, hd_list) { 924 (*hdp->hd_fn)(hdp->hd_arg); 925 } 926 } else { 927 while ((hdp = TAILQ_FIRST(head)) != NULL) { 928 TAILQ_REMOVE(head, hdp, hd_list); 929 (*hdp->hd_fn)(hdp->hd_arg); 930 if ((flags & HOOK_FREE) != 0) 931 free(hdp, M_DEVBUF); 932 } 933 } 934 } 935 #endif 936
Indexes created Tue Sep 23 23:09:58 GMT 2025