pf_ioctl.c revision 1.9.2.8
1 1.9.2.8 skrll /* $NetBSD: pf_ioctl.c,v 1.9.2.8 2005/01/17 19:32:11 skrll Exp $ */ 2 1.9.2.6 skrll /* $OpenBSD: pf_ioctl.c,v 1.130 2004/09/09 22:08:42 dhartmei Exp $ */ 3 1.9.2.2 skrll 4 1.9.2.2 skrll /* 5 1.9.2.2 skrll * Copyright (c) 2001 Daniel Hartmeier 6 1.9.2.2 skrll * Copyright (c) 2002,2003 Henning Brauer 7 1.9.2.2 skrll * All rights reserved. 8 1.9.2.2 skrll * 9 1.9.2.2 skrll * Redistribution and use in source and binary forms, with or without 10 1.9.2.2 skrll * modification, are permitted provided that the following conditions 11 1.9.2.2 skrll * are met: 12 1.9.2.2 skrll * 13 1.9.2.2 skrll * - Redistributions of source code must retain the above copyright 14 1.9.2.2 skrll * notice, this list of conditions and the following disclaimer. 15 1.9.2.2 skrll * - Redistributions in binary form must reproduce the above 16 1.9.2.2 skrll * copyright notice, this list of conditions and the following 17 1.9.2.2 skrll * disclaimer in the documentation and/or other materials provided 18 1.9.2.2 skrll * with the distribution. 19 1.9.2.2 skrll * 20 1.9.2.2 skrll * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 1.9.2.2 skrll * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 1.9.2.2 skrll * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 1.9.2.2 skrll * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 1.9.2.2 skrll * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 1.9.2.2 skrll * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 1.9.2.2 skrll * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 1.9.2.2 skrll * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 1.9.2.2 skrll * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 1.9.2.2 skrll * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 1.9.2.2 skrll * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 1.9.2.2 skrll * POSSIBILITY OF SUCH DAMAGE. 32 1.9.2.2 skrll * 33 1.9.2.2 skrll * Effort sponsored in part by the Defense Advanced Research Projects 34 1.9.2.2 skrll * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 1.9.2.2 skrll * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 1.9.2.2 skrll * 37 1.9.2.2 skrll */ 38 1.9.2.2 skrll 39 1.9.2.2 skrll #ifdef _KERNEL_OPT 40 1.9.2.2 skrll #include "opt_inet.h" 41 1.9.2.2 skrll #include "opt_altq.h" 42 1.9.2.2 skrll #include "opt_pfil_hooks.h" 43 1.9.2.2 skrll #endif 44 1.9.2.2 skrll 45 1.9.2.2 skrll #ifdef __OpenBSD__ 46 1.9.2.2 skrll #include "pfsync.h" 47 1.9.2.2 skrll #else 48 1.9.2.2 skrll #define NPFSYNC 0 49 1.9.2.2 skrll #endif 50 1.9.2.2 skrll 51 1.9.2.2 skrll #include <sys/param.h> 52 1.9.2.2 skrll #include <sys/systm.h> 53 1.9.2.2 skrll #include <sys/mbuf.h> 54 1.9.2.2 skrll #include <sys/filio.h> 55 1.9.2.2 skrll #include <sys/fcntl.h> 56 1.9.2.2 skrll #include <sys/socket.h> 57 1.9.2.2 skrll #include <sys/socketvar.h> 58 1.9.2.2 skrll #include <sys/kernel.h> 59 1.9.2.2 skrll #include <sys/time.h> 60 1.9.2.2 skrll #ifdef __OpenBSD__ 61 1.9.2.2 skrll #include <sys/timeout.h> 62 1.9.2.2 skrll #else 63 1.9.2.2 skrll #include <sys/callout.h> 64 1.9.2.2 skrll #endif 65 1.9.2.2 skrll #include <sys/pool.h> 66 1.9.2.2 skrll #include <sys/malloc.h> 67 1.9.2.2 skrll #ifdef __NetBSD__ 68 1.9.2.2 skrll #include <sys/conf.h> 69 1.9.2.2 skrll #endif 70 1.9.2.2 skrll 71 1.9.2.2 skrll #include <net/if.h> 72 1.9.2.2 skrll #include <net/if_types.h> 73 1.9.2.2 skrll #include <net/route.h> 74 1.9.2.2 skrll 75 1.9.2.2 skrll #include <netinet/in.h> 76 1.9.2.2 skrll #include <netinet/in_var.h> 77 1.9.2.2 skrll #include <netinet/in_systm.h> 78 1.9.2.2 skrll #include <netinet/ip.h> 79 1.9.2.2 skrll #include <netinet/ip_var.h> 80 1.9.2.2 skrll #include <netinet/ip_icmp.h> 81 1.9.2.2 skrll 82 1.9.2.2 skrll #ifdef __OpenBSD__ 83 1.9.2.2 skrll #include <dev/rndvar.h> 84 1.9.2.2 skrll #endif 85 1.9.2.2 skrll #include <net/pfvar.h> 86 1.9.2.2 skrll 87 1.9.2.2 skrll #if NPFSYNC > 0 88 1.9.2.2 skrll #include <net/if_pfsync.h> 89 1.9.2.2 skrll #endif /* NPFSYNC > 0 */ 90 1.9.2.2 skrll 91 1.9.2.2 skrll #ifdef INET6 92 1.9.2.2 skrll #include <netinet/ip6.h> 93 1.9.2.2 skrll #include <netinet/in_pcb.h> 94 1.9.2.2 skrll #endif /* INET6 */ 95 1.9.2.2 skrll 96 1.9.2.2 skrll #ifdef ALTQ 97 1.9.2.2 skrll #include <altq/altq.h> 98 1.9.2.2 skrll #endif 99 1.9.2.2 skrll 100 1.9.2.2 skrll void pfattach(int); 101 1.9.2.2 skrll #ifdef _LKM 102 1.9.2.2 skrll void pfdetach(void); 103 1.9.2.2 skrll #endif 104 1.9.2.5 skrll int pfopen(dev_t, int, int, struct lwp *); 105 1.9.2.5 skrll int pfclose(dev_t, int, int, struct lwp *); 106 1.9.2.6 skrll struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 107 1.9.2.6 skrll u_int8_t, u_int8_t, u_int8_t); 108 1.9.2.2 skrll int pf_get_ruleset_number(u_int8_t); 109 1.9.2.2 skrll void pf_init_ruleset(struct pf_ruleset *); 110 1.9.2.6 skrll int pf_anchor_setup(struct pf_rule *, 111 1.9.2.6 skrll const struct pf_ruleset *, const char *); 112 1.9.2.6 skrll int pf_anchor_copyout(const struct pf_ruleset *, 113 1.9.2.6 skrll const struct pf_rule *, struct pfioc_rule *); 114 1.9.2.6 skrll void pf_anchor_remove(struct pf_rule *); 115 1.9.2.6 skrll 116 1.9.2.2 skrll void pf_mv_pool(struct pf_palist *, struct pf_palist *); 117 1.9.2.2 skrll void pf_empty_pool(struct pf_palist *); 118 1.9.2.5 skrll int pfioctl(dev_t, u_long, caddr_t, int, struct lwp *); 119 1.9.2.2 skrll #ifdef ALTQ 120 1.9.2.2 skrll int pf_begin_altq(u_int32_t *); 121 1.9.2.2 skrll int pf_rollback_altq(u_int32_t); 122 1.9.2.2 skrll int pf_commit_altq(u_int32_t); 123 1.9.2.6 skrll int pf_enable_altq(struct pf_altq *); 124 1.9.2.6 skrll int pf_disable_altq(struct pf_altq *); 125 1.9.2.2 skrll #endif /* ALTQ */ 126 1.9.2.6 skrll int pf_begin_rules(u_int32_t *, int, const char *); 127 1.9.2.6 skrll int pf_rollback_rules(u_int32_t, int, char *); 128 1.9.2.6 skrll int pf_commit_rules(u_int32_t, int, char *); 129 1.9.2.2 skrll 130 1.9.2.2 skrll #ifdef __NetBSD__ 131 1.9.2.2 skrll const struct cdevsw pf_cdevsw = { 132 1.9.2.2 skrll pfopen, pfclose, noread, nowrite, pfioctl, 133 1.9.2.2 skrll nostop, notty, nopoll, nommap, nokqfilter, 134 1.9.2.2 skrll }; 135 1.9.2.2 skrll 136 1.9.2.2 skrll static int pf_pfil_attach(void); 137 1.9.2.2 skrll static int pf_pfil_detach(void); 138 1.9.2.2 skrll 139 1.9.2.2 skrll static int pf_pfil_attached = 0; 140 1.9.2.2 skrll #endif 141 1.9.2.2 skrll 142 1.9.2.2 skrll #ifdef __OpenBSD__ 143 1.9.2.2 skrll extern struct timeout pf_expire_to; 144 1.9.2.2 skrll #else 145 1.9.2.2 skrll extern struct callout pf_expire_to; 146 1.9.2.2 skrll #endif 147 1.9.2.2 skrll 148 1.9.2.2 skrll struct pf_rule pf_default_rule; 149 1.9.2.6 skrll #ifdef ALTQ 150 1.9.2.6 skrll static int pf_altq_running; 151 1.9.2.6 skrll #endif 152 1.9.2.2 skrll 153 1.9.2.2 skrll #define TAGID_MAX 50000 154 1.9.2.2 skrll TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 155 1.9.2.2 skrll pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 156 1.9.2.2 skrll 157 1.9.2.2 skrll #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 158 1.9.2.2 skrll #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 159 1.9.2.2 skrll #endif 160 1.9.2.2 skrll static u_int16_t tagname2tag(struct pf_tags *, char *); 161 1.9.2.2 skrll static void tag2tagname(struct pf_tags *, u_int16_t, char *); 162 1.9.2.2 skrll static void tag_unref(struct pf_tags *, u_int16_t); 163 1.9.2.2 skrll 164 1.9.2.2 skrll #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 165 1.9.2.2 skrll 166 1.9.2.2 skrll #ifdef __NetBSD__ 167 1.9.2.2 skrll extern struct pfil_head if_pfil; 168 1.9.2.2 skrll #endif 169 1.9.2.2 skrll 170 1.9.2.2 skrll void 171 1.9.2.2 skrll pfattach(int num) 172 1.9.2.2 skrll { 173 1.9.2.2 skrll u_int32_t *timeout = pf_default_rule.timeout; 174 1.9.2.2 skrll 175 1.9.2.2 skrll pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 176 1.9.2.2 skrll &pool_allocator_nointr); 177 1.9.2.2 skrll pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 178 1.9.2.2 skrll "pfsrctrpl", NULL); 179 1.9.2.2 skrll pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 180 1.9.2.2 skrll NULL); 181 1.9.2.2 skrll pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 182 1.9.2.6 skrll &pool_allocator_nointr); 183 1.9.2.2 skrll pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 184 1.9.2.6 skrll "pfpooladdrpl", &pool_allocator_nointr); 185 1.9.2.2 skrll pfr_initialize(); 186 1.9.2.2 skrll pfi_initialize(); 187 1.9.2.2 skrll pf_osfp_initialize(); 188 1.9.2.2 skrll 189 1.9.2.2 skrll pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 190 1.9.2.2 skrll pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 191 1.9.2.2 skrll 192 1.9.2.2 skrll RB_INIT(&tree_src_tracking); 193 1.9.2.6 skrll RB_INIT(&pf_anchors); 194 1.9.2.2 skrll pf_init_ruleset(&pf_main_ruleset); 195 1.9.2.2 skrll TAILQ_INIT(&pf_altqs[0]); 196 1.9.2.2 skrll TAILQ_INIT(&pf_altqs[1]); 197 1.9.2.2 skrll TAILQ_INIT(&pf_pabuf); 198 1.9.2.2 skrll pf_altqs_active = &pf_altqs[0]; 199 1.9.2.2 skrll pf_altqs_inactive = &pf_altqs[1]; 200 1.9.2.2 skrll TAILQ_INIT(&state_updates); 201 1.9.2.2 skrll 202 1.9.2.2 skrll /* default rule should never be garbage collected */ 203 1.9.2.2 skrll pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 204 1.9.2.2 skrll pf_default_rule.action = PF_PASS; 205 1.9.2.2 skrll pf_default_rule.nr = -1; 206 1.9.2.2 skrll 207 1.9.2.2 skrll /* initialize default timeouts */ 208 1.9.2.2 skrll timeout[PFTM_TCP_FIRST_PACKET] = 120; /* First TCP packet */ 209 1.9.2.2 skrll timeout[PFTM_TCP_OPENING] = 30; /* No response yet */ 210 1.9.2.2 skrll timeout[PFTM_TCP_ESTABLISHED] = 24*60*60; /* Established */ 211 1.9.2.2 skrll timeout[PFTM_TCP_CLOSING] = 15 * 60; /* Half closed */ 212 1.9.2.2 skrll timeout[PFTM_TCP_FIN_WAIT] = 45; /* Got both FINs */ 213 1.9.2.2 skrll timeout[PFTM_TCP_CLOSED] = 90; /* Got a RST */ 214 1.9.2.2 skrll timeout[PFTM_UDP_FIRST_PACKET] = 60; /* First UDP packet */ 215 1.9.2.2 skrll timeout[PFTM_UDP_SINGLE] = 30; /* Unidirectional */ 216 1.9.2.2 skrll timeout[PFTM_UDP_MULTIPLE] = 60; /* Bidirectional */ 217 1.9.2.2 skrll timeout[PFTM_ICMP_FIRST_PACKET] = 20; /* First ICMP packet */ 218 1.9.2.2 skrll timeout[PFTM_ICMP_ERROR_REPLY] = 10; /* Got error response */ 219 1.9.2.2 skrll timeout[PFTM_OTHER_FIRST_PACKET] = 60; /* First packet */ 220 1.9.2.2 skrll timeout[PFTM_OTHER_SINGLE] = 30; /* Unidirectional */ 221 1.9.2.2 skrll timeout[PFTM_OTHER_MULTIPLE] = 60; /* Bidirectional */ 222 1.9.2.2 skrll timeout[PFTM_FRAG] = 30; /* Fragment expire */ 223 1.9.2.2 skrll timeout[PFTM_INTERVAL] = 10; /* Expire interval */ 224 1.9.2.2 skrll timeout[PFTM_SRC_NODE] = 0; /* Source tracking */ 225 1.9.2.6 skrll timeout[PFTM_TS_DIFF] = 30; /* Allowed TS diff */ 226 1.9.2.2 skrll 227 1.9.2.2 skrll #ifdef __OpenBSD__ 228 1.9.2.2 skrll timeout_set(&pf_expire_to, pf_purge_timeout, &pf_expire_to); 229 1.9.2.2 skrll timeout_add(&pf_expire_to, timeout[PFTM_INTERVAL] * hz); 230 1.9.2.2 skrll #else 231 1.9.2.2 skrll callout_init(&pf_expire_to); 232 1.9.2.2 skrll callout_reset(&pf_expire_to, timeout[PFTM_INTERVAL] * hz, 233 1.9.2.2 skrll pf_purge_timeout, &pf_expire_to); 234 1.9.2.2 skrll #endif 235 1.9.2.2 skrll 236 1.9.2.2 skrll pf_normalize_init(); 237 1.9.2.2 skrll bzero(&pf_status, sizeof(pf_status)); 238 1.9.2.2 skrll pf_status.debug = PF_DEBUG_URGENT; 239 1.9.2.2 skrll 240 1.9.2.2 skrll /* XXX do our best to avoid a conflict */ 241 1.9.2.2 skrll pf_status.hostid = arc4random(); 242 1.9.2.2 skrll } 243 1.9.2.2 skrll 244 1.9.2.2 skrll #ifdef _LKM 245 1.9.2.2 skrll void 246 1.9.2.2 skrll pfdetach(void) 247 1.9.2.2 skrll { 248 1.9.2.7 skrll struct pf_anchor *anchor; 249 1.9.2.7 skrll struct pf_state *state; 250 1.9.2.7 skrll struct pf_src_node *node; 251 1.9.2.7 skrll struct pfioc_table pt; 252 1.9.2.7 skrll u_int32_t ticket; 253 1.9.2.7 skrll int i; 254 1.9.2.7 skrll char r = '\0'; 255 1.9.2.2 skrll 256 1.9.2.2 skrll (void)pf_pfil_detach(); 257 1.9.2.2 skrll 258 1.9.2.2 skrll callout_stop(&pf_expire_to); 259 1.9.2.7 skrll pf_status.running = 0; 260 1.9.2.7 skrll 261 1.9.2.7 skrll /* clear the rulesets */ 262 1.9.2.7 skrll for (i = 0; i < PF_RULESET_MAX; i++) 263 1.9.2.7 skrll if (pf_begin_rules(&ticket, i, &r) == 0) 264 1.9.2.7 skrll pf_commit_rules(ticket, i, &r); 265 1.9.2.7 skrll #ifdef ALTQ 266 1.9.2.7 skrll if (pf_begin_altq(&ticket) == 0) 267 1.9.2.7 skrll pf_commit_altq(ticket); 268 1.9.2.7 skrll #endif 269 1.9.2.2 skrll 270 1.9.2.7 skrll /* clear states */ 271 1.9.2.7 skrll RB_FOREACH(state, pf_state_tree_id, &tree_id) { 272 1.9.2.7 skrll state->timeout = PFTM_PURGE; 273 1.9.2.7 skrll #if NPFSYNC 274 1.9.2.7 skrll state->sync_flags = PFSTATE_NOSYNC; 275 1.9.2.7 skrll #endif 276 1.9.2.6 skrll } 277 1.9.2.7 skrll pf_purge_expired_states(); 278 1.9.2.7 skrll #if NPFSYNC 279 1.9.2.7 skrll pfsync_clear_states(pf_status.hostid, NULL); 280 1.9.2.7 skrll #endif 281 1.9.2.7 skrll 282 1.9.2.7 skrll /* clear source nodes */ 283 1.9.2.7 skrll RB_FOREACH(state, pf_state_tree_id, &tree_id) { 284 1.9.2.7 skrll state->src_node = NULL; 285 1.9.2.7 skrll state->nat_src_node = NULL; 286 1.9.2.7 skrll } 287 1.9.2.7 skrll RB_FOREACH(node, pf_src_tree, &tree_src_tracking) { 288 1.9.2.7 skrll node->expire = 1; 289 1.9.2.7 skrll node->states = 0; 290 1.9.2.7 skrll } 291 1.9.2.7 skrll pf_purge_expired_src_nodes(); 292 1.9.2.7 skrll 293 1.9.2.7 skrll /* clear tables */ 294 1.9.2.7 skrll memset(&pt, '\0', sizeof(pt)); 295 1.9.2.7 skrll pfr_clr_tables(&pt.pfrio_table, &pt.pfrio_ndel, pt.pfrio_flags); 296 1.9.2.7 skrll 297 1.9.2.7 skrll /* destroy anchors */ 298 1.9.2.7 skrll while ((anchor = RB_MIN(pf_anchor_global, &pf_anchors)) != NULL) { 299 1.9.2.7 skrll for (i = 0; i < PF_RULESET_MAX; i++) 300 1.9.2.7 skrll if (pf_begin_rules(&ticket, i, anchor->name) == 0) 301 1.9.2.7 skrll pf_commit_rules(ticket, i, anchor->name); 302 1.9.2.7 skrll } 303 1.9.2.7 skrll 304 1.9.2.7 skrll /* destroy main ruleset */ 305 1.9.2.7 skrll pf_remove_if_empty_ruleset(&pf_main_ruleset); 306 1.9.2.7 skrll 307 1.9.2.7 skrll /* destroy the pools */ 308 1.9.2.2 skrll pool_destroy(&pf_pooladdr_pl); 309 1.9.2.2 skrll pool_destroy(&pf_altq_pl); 310 1.9.2.2 skrll pool_destroy(&pf_state_pl); 311 1.9.2.2 skrll pool_destroy(&pf_rule_pl); 312 1.9.2.2 skrll pool_destroy(&pf_src_tree_pl); 313 1.9.2.7 skrll 314 1.9.2.7 skrll /* destroy subsystems */ 315 1.9.2.7 skrll pf_normalize_destroy(); 316 1.9.2.7 skrll pf_osfp_destroy(); 317 1.9.2.7 skrll pfr_destroy(); 318 1.9.2.7 skrll pfi_destroy(); 319 1.9.2.2 skrll } 320 1.9.2.2 skrll #endif 321 1.9.2.2 skrll 322 1.9.2.2 skrll int 323 1.9.2.5 skrll pfopen(dev_t dev, int flags, int fmt, struct lwp *l) 324 1.9.2.2 skrll { 325 1.9.2.2 skrll if (minor(dev) >= 1) 326 1.9.2.2 skrll return (ENXIO); 327 1.9.2.2 skrll return (0); 328 1.9.2.2 skrll } 329 1.9.2.2 skrll 330 1.9.2.2 skrll int 331 1.9.2.5 skrll pfclose(dev_t dev, int flags, int fmt, struct lwp *l) 332 1.9.2.2 skrll { 333 1.9.2.2 skrll if (minor(dev) >= 1) 334 1.9.2.2 skrll return (ENXIO); 335 1.9.2.2 skrll return (0); 336 1.9.2.2 skrll } 337 1.9.2.2 skrll 338 1.9.2.2 skrll struct pf_pool * 339 1.9.2.6 skrll pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 340 1.9.2.6 skrll u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 341 1.9.2.6 skrll u_int8_t check_ticket) 342 1.9.2.2 skrll { 343 1.9.2.2 skrll struct pf_ruleset *ruleset; 344 1.9.2.2 skrll struct pf_rule *rule; 345 1.9.2.2 skrll int rs_num; 346 1.9.2.2 skrll 347 1.9.2.6 skrll ruleset = pf_find_ruleset(anchor); 348 1.9.2.2 skrll if (ruleset == NULL) 349 1.9.2.2 skrll return (NULL); 350 1.9.2.2 skrll rs_num = pf_get_ruleset_number(rule_action); 351 1.9.2.2 skrll if (rs_num >= PF_RULESET_MAX) 352 1.9.2.2 skrll return (NULL); 353 1.9.2.2 skrll if (active) { 354 1.9.2.2 skrll if (check_ticket && ticket != 355 1.9.2.2 skrll ruleset->rules[rs_num].active.ticket) 356 1.9.2.2 skrll return (NULL); 357 1.9.2.2 skrll if (r_last) 358 1.9.2.2 skrll rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 359 1.9.2.2 skrll pf_rulequeue); 360 1.9.2.2 skrll else 361 1.9.2.2 skrll rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 362 1.9.2.2 skrll } else { 363 1.9.2.2 skrll if (check_ticket && ticket != 364 1.9.2.2 skrll ruleset->rules[rs_num].inactive.ticket) 365 1.9.2.2 skrll return (NULL); 366 1.9.2.2 skrll if (r_last) 367 1.9.2.2 skrll rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 368 1.9.2.2 skrll pf_rulequeue); 369 1.9.2.2 skrll else 370 1.9.2.2 skrll rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 371 1.9.2.2 skrll } 372 1.9.2.2 skrll if (!r_last) { 373 1.9.2.2 skrll while ((rule != NULL) && (rule->nr != rule_number)) 374 1.9.2.2 skrll rule = TAILQ_NEXT(rule, entries); 375 1.9.2.2 skrll } 376 1.9.2.2 skrll if (rule == NULL) 377 1.9.2.2 skrll return (NULL); 378 1.9.2.2 skrll 379 1.9.2.2 skrll return (&rule->rpool); 380 1.9.2.2 skrll } 381 1.9.2.2 skrll 382 1.9.2.2 skrll int 383 1.9.2.2 skrll pf_get_ruleset_number(u_int8_t action) 384 1.9.2.2 skrll { 385 1.9.2.2 skrll switch (action) { 386 1.9.2.2 skrll case PF_SCRUB: 387 1.9.2.2 skrll return (PF_RULESET_SCRUB); 388 1.9.2.2 skrll break; 389 1.9.2.2 skrll case PF_PASS: 390 1.9.2.2 skrll case PF_DROP: 391 1.9.2.2 skrll return (PF_RULESET_FILTER); 392 1.9.2.2 skrll break; 393 1.9.2.2 skrll case PF_NAT: 394 1.9.2.2 skrll case PF_NONAT: 395 1.9.2.2 skrll return (PF_RULESET_NAT); 396 1.9.2.2 skrll break; 397 1.9.2.2 skrll case PF_BINAT: 398 1.9.2.2 skrll case PF_NOBINAT: 399 1.9.2.2 skrll return (PF_RULESET_BINAT); 400 1.9.2.2 skrll break; 401 1.9.2.2 skrll case PF_RDR: 402 1.9.2.2 skrll case PF_NORDR: 403 1.9.2.2 skrll return (PF_RULESET_RDR); 404 1.9.2.2 skrll break; 405 1.9.2.2 skrll default: 406 1.9.2.2 skrll return (PF_RULESET_MAX); 407 1.9.2.2 skrll break; 408 1.9.2.2 skrll } 409 1.9.2.2 skrll } 410 1.9.2.2 skrll 411 1.9.2.2 skrll void 412 1.9.2.2 skrll pf_init_ruleset(struct pf_ruleset *ruleset) 413 1.9.2.2 skrll { 414 1.9.2.2 skrll int i; 415 1.9.2.2 skrll 416 1.9.2.2 skrll memset(ruleset, 0, sizeof(struct pf_ruleset)); 417 1.9.2.2 skrll for (i = 0; i < PF_RULESET_MAX; i++) { 418 1.9.2.2 skrll TAILQ_INIT(&ruleset->rules[i].queues[0]); 419 1.9.2.2 skrll TAILQ_INIT(&ruleset->rules[i].queues[1]); 420 1.9.2.2 skrll ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 421 1.9.2.2 skrll ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 422 1.9.2.2 skrll } 423 1.9.2.2 skrll } 424 1.9.2.2 skrll 425 1.9.2.2 skrll struct pf_anchor * 426 1.9.2.6 skrll pf_find_anchor(const char *path) 427 1.9.2.2 skrll { 428 1.9.2.6 skrll static struct pf_anchor key; 429 1.9.2.2 skrll 430 1.9.2.6 skrll memset(&key, 0, sizeof(key)); 431 1.9.2.6 skrll strlcpy(key.path, path, sizeof(key.path)); 432 1.9.2.6 skrll return (RB_FIND(pf_anchor_global, &pf_anchors, &key)); 433 1.9.2.2 skrll } 434 1.9.2.2 skrll 435 1.9.2.2 skrll struct pf_ruleset * 436 1.9.2.6 skrll pf_find_ruleset(const char *path) 437 1.9.2.2 skrll { 438 1.9.2.2 skrll struct pf_anchor *anchor; 439 1.9.2.2 skrll 440 1.9.2.6 skrll while (*path == '/') 441 1.9.2.6 skrll path++; 442 1.9.2.6 skrll if (!*path) 443 1.9.2.2 skrll return (&pf_main_ruleset); 444 1.9.2.6 skrll anchor = pf_find_anchor(path); 445 1.9.2.2 skrll if (anchor == NULL) 446 1.9.2.2 skrll return (NULL); 447 1.9.2.2 skrll else 448 1.9.2.6 skrll return (&anchor->ruleset); 449 1.9.2.2 skrll } 450 1.9.2.2 skrll 451 1.9.2.2 skrll struct pf_ruleset * 452 1.9.2.6 skrll pf_find_or_create_ruleset(const char *path) 453 1.9.2.2 skrll { 454 1.9.2.6 skrll static char p[MAXPATHLEN]; 455 1.9.2.6 skrll char *q, *r; 456 1.9.2.6 skrll struct pf_ruleset *ruleset; 457 1.9.2.6 skrll struct pf_anchor *anchor = NULL /* XXX gcc */, 458 1.9.2.6 skrll *dup, *parent = NULL; 459 1.9.2.2 skrll 460 1.9.2.6 skrll while (*path == '/') 461 1.9.2.6 skrll path++; 462 1.9.2.6 skrll ruleset = pf_find_ruleset(path); 463 1.9.2.6 skrll if (ruleset != NULL) 464 1.9.2.6 skrll return (ruleset); 465 1.9.2.6 skrll strlcpy(p, path, sizeof(p)); 466 1.9.2.6 skrll while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 467 1.9.2.6 skrll *q = 0; 468 1.9.2.6 skrll if ((ruleset = pf_find_ruleset(p)) != NULL) { 469 1.9.2.6 skrll parent = ruleset->anchor; 470 1.9.2.6 skrll break; 471 1.9.2.6 skrll } 472 1.9.2.6 skrll } 473 1.9.2.6 skrll if (q == NULL) 474 1.9.2.6 skrll q = p; 475 1.9.2.6 skrll else 476 1.9.2.6 skrll q++; 477 1.9.2.6 skrll strlcpy(p, path, sizeof(p)); 478 1.9.2.6 skrll if (!*q) 479 1.9.2.2 skrll return (NULL); 480 1.9.2.6 skrll while ((r = strchr(q, '/')) != NULL || *q) { 481 1.9.2.6 skrll if (r != NULL) 482 1.9.2.6 skrll *r = 0; 483 1.9.2.6 skrll if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 484 1.9.2.6 skrll (parent != NULL && strlen(parent->path) >= 485 1.9.2.6 skrll MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) 486 1.9.2.6 skrll return (NULL); 487 1.9.2.6 skrll anchor = (struct pf_anchor *)malloc(sizeof(*anchor), M_TEMP, 488 1.9.2.6 skrll M_NOWAIT); 489 1.9.2.2 skrll if (anchor == NULL) 490 1.9.2.2 skrll return (NULL); 491 1.9.2.6 skrll memset(anchor, 0, sizeof(*anchor)); 492 1.9.2.6 skrll RB_INIT(&anchor->children); 493 1.9.2.6 skrll strlcpy(anchor->name, q, sizeof(anchor->name)); 494 1.9.2.6 skrll if (parent != NULL) { 495 1.9.2.6 skrll strlcpy(anchor->path, parent->path, 496 1.9.2.6 skrll sizeof(anchor->path)); 497 1.9.2.6 skrll strlcat(anchor->path, "/", sizeof(anchor->path)); 498 1.9.2.6 skrll } 499 1.9.2.6 skrll strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 500 1.9.2.6 skrll if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != 501 1.9.2.6 skrll NULL) { 502 1.9.2.6 skrll printf("pf_find_or_create_ruleset: RB_INSERT1 " 503 1.9.2.6 skrll "'%s' '%s' collides with '%s' '%s'\n", 504 1.9.2.6 skrll anchor->path, anchor->name, dup->path, dup->name); 505 1.9.2.6 skrll free(anchor, M_TEMP); 506 1.9.2.6 skrll return (NULL); 507 1.9.2.6 skrll } 508 1.9.2.6 skrll if (parent != NULL) { 509 1.9.2.6 skrll anchor->parent = parent; 510 1.9.2.6 skrll if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 511 1.9.2.6 skrll anchor)) != NULL) { 512 1.9.2.6 skrll printf("pf_find_or_create_ruleset: " 513 1.9.2.6 skrll "RB_INSERT2 '%s' '%s' collides with " 514 1.9.2.6 skrll "'%s' '%s'\n", anchor->path, anchor->name, 515 1.9.2.6 skrll dup->path, dup->name); 516 1.9.2.6 skrll RB_REMOVE(pf_anchor_global, &pf_anchors, 517 1.9.2.6 skrll anchor); 518 1.9.2.6 skrll free(anchor, M_TEMP); 519 1.9.2.6 skrll return (NULL); 520 1.9.2.6 skrll } 521 1.9.2.6 skrll } 522 1.9.2.6 skrll pf_init_ruleset(&anchor->ruleset); 523 1.9.2.6 skrll anchor->ruleset.anchor = anchor; 524 1.9.2.6 skrll parent = anchor; 525 1.9.2.2 skrll if (r != NULL) 526 1.9.2.6 skrll q = r + 1; 527 1.9.2.2 skrll else 528 1.9.2.6 skrll *q = 0; 529 1.9.2.2 skrll } 530 1.9.2.6 skrll return (&anchor->ruleset); 531 1.9.2.2 skrll } 532 1.9.2.2 skrll 533 1.9.2.2 skrll void 534 1.9.2.2 skrll pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 535 1.9.2.2 skrll { 536 1.9.2.6 skrll struct pf_anchor *parent; 537 1.9.2.2 skrll int i; 538 1.9.2.2 skrll 539 1.9.2.6 skrll while (ruleset != NULL) { 540 1.9.2.6 skrll if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 541 1.9.2.6 skrll !RB_EMPTY(&ruleset->anchor->children) || 542 1.9.2.6 skrll ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 543 1.9.2.6 skrll ruleset->topen) 544 1.9.2.2 skrll return; 545 1.9.2.6 skrll for (i = 0; i < PF_RULESET_MAX; ++i) 546 1.9.2.6 skrll if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 547 1.9.2.6 skrll !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 548 1.9.2.6 skrll ruleset->rules[i].inactive.open) 549 1.9.2.6 skrll return; 550 1.9.2.6 skrll RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); 551 1.9.2.6 skrll if ((parent = ruleset->anchor->parent) != NULL) 552 1.9.2.6 skrll RB_REMOVE(pf_anchor_node, &parent->children, 553 1.9.2.6 skrll ruleset->anchor); 554 1.9.2.6 skrll free(ruleset->anchor, M_TEMP); 555 1.9.2.6 skrll if (parent == NULL) 556 1.9.2.6 skrll return; 557 1.9.2.6 skrll ruleset = &parent->ruleset; 558 1.9.2.6 skrll } 559 1.9.2.6 skrll } 560 1.9.2.6 skrll 561 1.9.2.6 skrll int 562 1.9.2.6 skrll pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 563 1.9.2.6 skrll const char *name) 564 1.9.2.6 skrll { 565 1.9.2.6 skrll static char *p, path[MAXPATHLEN]; 566 1.9.2.6 skrll struct pf_ruleset *ruleset; 567 1.9.2.6 skrll 568 1.9.2.6 skrll r->anchor = NULL; 569 1.9.2.6 skrll r->anchor_relative = 0; 570 1.9.2.6 skrll r->anchor_wildcard = 0; 571 1.9.2.6 skrll if (!name[0]) 572 1.9.2.6 skrll return (0); 573 1.9.2.6 skrll if (name[0] == '/') 574 1.9.2.6 skrll strlcpy(path, name + 1, sizeof(path)); 575 1.9.2.6 skrll else { 576 1.9.2.6 skrll /* relative path */ 577 1.9.2.6 skrll r->anchor_relative = 1; 578 1.9.2.6 skrll if (s->anchor == NULL || !s->anchor->path[0]) 579 1.9.2.6 skrll path[0] = 0; 580 1.9.2.6 skrll else 581 1.9.2.6 skrll strlcpy(path, s->anchor->path, sizeof(path)); 582 1.9.2.6 skrll while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 583 1.9.2.6 skrll if (!path[0]) { 584 1.9.2.6 skrll printf("pf_anchor_setup: .. beyond root\n"); 585 1.9.2.6 skrll return (1); 586 1.9.2.6 skrll } 587 1.9.2.6 skrll if ((p = strrchr(path, '/')) != NULL) 588 1.9.2.6 skrll *p = 0; 589 1.9.2.6 skrll else 590 1.9.2.6 skrll path[0] = 0; 591 1.9.2.6 skrll r->anchor_relative++; 592 1.9.2.6 skrll name += 3; 593 1.9.2.6 skrll } 594 1.9.2.6 skrll if (path[0]) 595 1.9.2.6 skrll strlcat(path, "/", sizeof(path)); 596 1.9.2.6 skrll strlcat(path, name, sizeof(path)); 597 1.9.2.6 skrll } 598 1.9.2.6 skrll if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 599 1.9.2.6 skrll r->anchor_wildcard = 1; 600 1.9.2.6 skrll *p = 0; 601 1.9.2.6 skrll } 602 1.9.2.6 skrll ruleset = pf_find_or_create_ruleset(path); 603 1.9.2.6 skrll if (ruleset == NULL || ruleset->anchor == NULL) { 604 1.9.2.6 skrll printf("pf_anchor_setup: ruleset\n"); 605 1.9.2.6 skrll return (1); 606 1.9.2.6 skrll } 607 1.9.2.6 skrll r->anchor = ruleset->anchor; 608 1.9.2.6 skrll r->anchor->refcnt++; 609 1.9.2.6 skrll return (0); 610 1.9.2.6 skrll } 611 1.9.2.6 skrll 612 1.9.2.6 skrll int 613 1.9.2.6 skrll pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, 614 1.9.2.6 skrll struct pfioc_rule *pr) 615 1.9.2.6 skrll { 616 1.9.2.6 skrll pr->anchor_call[0] = 0; 617 1.9.2.6 skrll if (r->anchor == NULL) 618 1.9.2.6 skrll return (0); 619 1.9.2.6 skrll if (!r->anchor_relative) { 620 1.9.2.6 skrll strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call)); 621 1.9.2.6 skrll strlcat(pr->anchor_call, r->anchor->path, 622 1.9.2.6 skrll sizeof(pr->anchor_call)); 623 1.9.2.6 skrll } else { 624 1.9.2.6 skrll char a[MAXPATHLEN], b[MAXPATHLEN], *p; 625 1.9.2.6 skrll int i; 626 1.9.2.6 skrll 627 1.9.2.6 skrll if (rs->anchor == NULL) 628 1.9.2.6 skrll a[0] = 0; 629 1.9.2.6 skrll else 630 1.9.2.6 skrll strlcpy(a, rs->anchor->path, sizeof(a)); 631 1.9.2.6 skrll strlcpy(b, r->anchor->path, sizeof(b)); 632 1.9.2.6 skrll for (i = 1; i < r->anchor_relative; ++i) { 633 1.9.2.6 skrll if ((p = strrchr(a, '/')) == NULL) 634 1.9.2.6 skrll p = a; 635 1.9.2.6 skrll *p = 0; 636 1.9.2.6 skrll strlcat(pr->anchor_call, "../", 637 1.9.2.6 skrll sizeof(pr->anchor_call)); 638 1.9.2.6 skrll } 639 1.9.2.6 skrll if (strncmp(a, b, strlen(a))) { 640 1.9.2.6 skrll printf("pf_anchor_copyout: '%s' '%s'\n", a, b); 641 1.9.2.6 skrll return (1); 642 1.9.2.6 skrll } 643 1.9.2.6 skrll if (strlen(b) > strlen(a)) 644 1.9.2.6 skrll strlcat(pr->anchor_call, b + (a[0] ? strlen(a) + 1 : 0), 645 1.9.2.6 skrll sizeof(pr->anchor_call)); 646 1.9.2.6 skrll } 647 1.9.2.6 skrll if (r->anchor_wildcard) 648 1.9.2.6 skrll strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*", 649 1.9.2.6 skrll sizeof(pr->anchor_call)); 650 1.9.2.6 skrll return (0); 651 1.9.2.6 skrll } 652 1.9.2.2 skrll 653 1.9.2.6 skrll void 654 1.9.2.6 skrll pf_anchor_remove(struct pf_rule *r) 655 1.9.2.6 skrll { 656 1.9.2.6 skrll if (r->anchor == NULL) 657 1.9.2.6 skrll return; 658 1.9.2.6 skrll if (r->anchor->refcnt <= 0) { 659 1.9.2.6 skrll printf("pf_anchor_remove: broken refcount"); 660 1.9.2.6 skrll r->anchor = NULL; 661 1.9.2.6 skrll return; 662 1.9.2.2 skrll } 663 1.9.2.6 skrll if (!--r->anchor->refcnt) 664 1.9.2.6 skrll pf_remove_if_empty_ruleset(&r->anchor->ruleset); 665 1.9.2.6 skrll r->anchor = NULL; 666 1.9.2.2 skrll } 667 1.9.2.2 skrll 668 1.9.2.2 skrll void 669 1.9.2.2 skrll pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 670 1.9.2.2 skrll { 671 1.9.2.2 skrll struct pf_pooladdr *mv_pool_pa; 672 1.9.2.2 skrll 673 1.9.2.2 skrll while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 674 1.9.2.2 skrll TAILQ_REMOVE(poola, mv_pool_pa, entries); 675 1.9.2.2 skrll TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 676 1.9.2.2 skrll } 677 1.9.2.2 skrll } 678 1.9.2.2 skrll 679 1.9.2.2 skrll void 680 1.9.2.2 skrll pf_empty_pool(struct pf_palist *poola) 681 1.9.2.2 skrll { 682 1.9.2.2 skrll struct pf_pooladdr *empty_pool_pa; 683 1.9.2.2 skrll 684 1.9.2.2 skrll while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 685 1.9.2.2 skrll pfi_dynaddr_remove(&empty_pool_pa->addr); 686 1.9.2.2 skrll pf_tbladdr_remove(&empty_pool_pa->addr); 687 1.9.2.2 skrll pfi_detach_rule(empty_pool_pa->kif); 688 1.9.2.2 skrll TAILQ_REMOVE(poola, empty_pool_pa, entries); 689 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, empty_pool_pa); 690 1.9.2.2 skrll } 691 1.9.2.2 skrll } 692 1.9.2.2 skrll 693 1.9.2.2 skrll void 694 1.9.2.2 skrll pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 695 1.9.2.2 skrll { 696 1.9.2.2 skrll if (rulequeue != NULL) { 697 1.9.2.2 skrll if (rule->states <= 0) { 698 1.9.2.2 skrll /* 699 1.9.2.2 skrll * XXX - we need to remove the table *before* detaching 700 1.9.2.2 skrll * the rule to make sure the table code does not delete 701 1.9.2.2 skrll * the anchor under our feet. 702 1.9.2.2 skrll */ 703 1.9.2.2 skrll pf_tbladdr_remove(&rule->src.addr); 704 1.9.2.2 skrll pf_tbladdr_remove(&rule->dst.addr); 705 1.9.2.2 skrll } 706 1.9.2.2 skrll TAILQ_REMOVE(rulequeue, rule, entries); 707 1.9.2.2 skrll rule->entries.tqe_prev = NULL; 708 1.9.2.2 skrll rule->nr = -1; 709 1.9.2.2 skrll } 710 1.9.2.2 skrll 711 1.9.2.2 skrll if (rule->states > 0 || rule->src_nodes > 0 || 712 1.9.2.2 skrll rule->entries.tqe_prev != NULL) 713 1.9.2.2 skrll return; 714 1.9.2.2 skrll pf_tag_unref(rule->tag); 715 1.9.2.2 skrll pf_tag_unref(rule->match_tag); 716 1.9.2.2 skrll #ifdef ALTQ 717 1.9.2.2 skrll if (rule->pqid != rule->qid) 718 1.9.2.2 skrll pf_qid_unref(rule->pqid); 719 1.9.2.2 skrll pf_qid_unref(rule->qid); 720 1.9.2.2 skrll #endif 721 1.9.2.2 skrll pfi_dynaddr_remove(&rule->src.addr); 722 1.9.2.2 skrll pfi_dynaddr_remove(&rule->dst.addr); 723 1.9.2.2 skrll if (rulequeue == NULL) { 724 1.9.2.2 skrll pf_tbladdr_remove(&rule->src.addr); 725 1.9.2.2 skrll pf_tbladdr_remove(&rule->dst.addr); 726 1.9.2.2 skrll } 727 1.9.2.2 skrll pfi_detach_rule(rule->kif); 728 1.9.2.6 skrll pf_anchor_remove(rule); 729 1.9.2.2 skrll pf_empty_pool(&rule->rpool.list); 730 1.9.2.2 skrll pool_put(&pf_rule_pl, rule); 731 1.9.2.2 skrll } 732 1.9.2.2 skrll 733 1.9.2.2 skrll static u_int16_t 734 1.9.2.2 skrll tagname2tag(struct pf_tags *head, char *tagname) 735 1.9.2.2 skrll { 736 1.9.2.2 skrll struct pf_tagname *tag, *p = NULL; 737 1.9.2.2 skrll u_int16_t new_tagid = 1; 738 1.9.2.2 skrll 739 1.9.2.2 skrll TAILQ_FOREACH(tag, head, entries) 740 1.9.2.2 skrll if (strcmp(tagname, tag->name) == 0) { 741 1.9.2.2 skrll tag->ref++; 742 1.9.2.2 skrll return (tag->tag); 743 1.9.2.2 skrll } 744 1.9.2.2 skrll 745 1.9.2.2 skrll /* 746 1.9.2.2 skrll * to avoid fragmentation, we do a linear search from the beginning 747 1.9.2.2 skrll * and take the first free slot we find. if there is none or the list 748 1.9.2.2 skrll * is empty, append a new entry at the end. 749 1.9.2.2 skrll */ 750 1.9.2.2 skrll 751 1.9.2.2 skrll /* new entry */ 752 1.9.2.2 skrll if (!TAILQ_EMPTY(head)) 753 1.9.2.2 skrll for (p = TAILQ_FIRST(head); p != NULL && 754 1.9.2.2 skrll p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 755 1.9.2.2 skrll new_tagid = p->tag + 1; 756 1.9.2.2 skrll 757 1.9.2.2 skrll if (new_tagid > TAGID_MAX) 758 1.9.2.2 skrll return (0); 759 1.9.2.2 skrll 760 1.9.2.2 skrll /* allocate and fill new struct pf_tagname */ 761 1.9.2.2 skrll tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 762 1.9.2.2 skrll M_TEMP, M_NOWAIT); 763 1.9.2.2 skrll if (tag == NULL) 764 1.9.2.2 skrll return (0); 765 1.9.2.2 skrll bzero(tag, sizeof(struct pf_tagname)); 766 1.9.2.2 skrll strlcpy(tag->name, tagname, sizeof(tag->name)); 767 1.9.2.2 skrll tag->tag = new_tagid; 768 1.9.2.2 skrll tag->ref++; 769 1.9.2.2 skrll 770 1.9.2.2 skrll if (p != NULL) /* insert new entry before p */ 771 1.9.2.2 skrll TAILQ_INSERT_BEFORE(p, tag, entries); 772 1.9.2.2 skrll else /* either list empty or no free slot in between */ 773 1.9.2.2 skrll TAILQ_INSERT_TAIL(head, tag, entries); 774 1.9.2.2 skrll 775 1.9.2.2 skrll return (tag->tag); 776 1.9.2.2 skrll } 777 1.9.2.2 skrll 778 1.9.2.2 skrll static void 779 1.9.2.2 skrll tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 780 1.9.2.2 skrll { 781 1.9.2.2 skrll struct pf_tagname *tag; 782 1.9.2.2 skrll 783 1.9.2.2 skrll TAILQ_FOREACH(tag, head, entries) 784 1.9.2.2 skrll if (tag->tag == tagid) { 785 1.9.2.2 skrll strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 786 1.9.2.2 skrll return; 787 1.9.2.2 skrll } 788 1.9.2.2 skrll } 789 1.9.2.2 skrll 790 1.9.2.2 skrll static void 791 1.9.2.2 skrll tag_unref(struct pf_tags *head, u_int16_t tag) 792 1.9.2.2 skrll { 793 1.9.2.2 skrll struct pf_tagname *p, *next; 794 1.9.2.2 skrll 795 1.9.2.2 skrll if (tag == 0) 796 1.9.2.2 skrll return; 797 1.9.2.2 skrll 798 1.9.2.2 skrll for (p = TAILQ_FIRST(head); p != NULL; p = next) { 799 1.9.2.2 skrll next = TAILQ_NEXT(p, entries); 800 1.9.2.2 skrll if (tag == p->tag) { 801 1.9.2.2 skrll if (--p->ref == 0) { 802 1.9.2.2 skrll TAILQ_REMOVE(head, p, entries); 803 1.9.2.2 skrll free(p, M_TEMP); 804 1.9.2.2 skrll } 805 1.9.2.2 skrll break; 806 1.9.2.2 skrll } 807 1.9.2.2 skrll } 808 1.9.2.2 skrll } 809 1.9.2.2 skrll 810 1.9.2.2 skrll u_int16_t 811 1.9.2.2 skrll pf_tagname2tag(char *tagname) 812 1.9.2.2 skrll { 813 1.9.2.2 skrll return (tagname2tag(&pf_tags, tagname)); 814 1.9.2.2 skrll } 815 1.9.2.2 skrll 816 1.9.2.2 skrll void 817 1.9.2.2 skrll pf_tag2tagname(u_int16_t tagid, char *p) 818 1.9.2.2 skrll { 819 1.9.2.2 skrll return (tag2tagname(&pf_tags, tagid, p)); 820 1.9.2.2 skrll } 821 1.9.2.2 skrll 822 1.9.2.2 skrll void 823 1.9.2.2 skrll pf_tag_unref(u_int16_t tag) 824 1.9.2.2 skrll { 825 1.9.2.2 skrll return (tag_unref(&pf_tags, tag)); 826 1.9.2.2 skrll } 827 1.9.2.2 skrll 828 1.9.2.2 skrll #ifdef ALTQ 829 1.9.2.2 skrll u_int32_t 830 1.9.2.2 skrll pf_qname2qid(char *qname) 831 1.9.2.2 skrll { 832 1.9.2.2 skrll return ((u_int32_t)tagname2tag(&pf_qids, qname)); 833 1.9.2.2 skrll } 834 1.9.2.2 skrll 835 1.9.2.2 skrll void 836 1.9.2.2 skrll pf_qid2qname(u_int32_t qid, char *p) 837 1.9.2.2 skrll { 838 1.9.2.2 skrll return (tag2tagname(&pf_qids, (u_int16_t)qid, p)); 839 1.9.2.2 skrll } 840 1.9.2.2 skrll 841 1.9.2.2 skrll void 842 1.9.2.2 skrll pf_qid_unref(u_int32_t qid) 843 1.9.2.2 skrll { 844 1.9.2.2 skrll return (tag_unref(&pf_qids, (u_int16_t)qid)); 845 1.9.2.2 skrll } 846 1.9.2.2 skrll 847 1.9.2.2 skrll int 848 1.9.2.2 skrll pf_begin_altq(u_int32_t *ticket) 849 1.9.2.2 skrll { 850 1.9.2.2 skrll struct pf_altq *altq; 851 1.9.2.2 skrll int error = 0; 852 1.9.2.2 skrll 853 1.9.2.2 skrll /* Purge the old altq list */ 854 1.9.2.2 skrll while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 855 1.9.2.2 skrll TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 856 1.9.2.2 skrll if (altq->qname[0] == 0) { 857 1.9.2.2 skrll /* detach and destroy the discipline */ 858 1.9.2.2 skrll error = altq_remove(altq); 859 1.9.2.2 skrll } else 860 1.9.2.2 skrll pf_qid_unref(altq->qid); 861 1.9.2.2 skrll pool_put(&pf_altq_pl, altq); 862 1.9.2.2 skrll } 863 1.9.2.2 skrll if (error) 864 1.9.2.2 skrll return (error); 865 1.9.2.2 skrll *ticket = ++ticket_altqs_inactive; 866 1.9.2.2 skrll altqs_inactive_open = 1; 867 1.9.2.2 skrll return (0); 868 1.9.2.2 skrll } 869 1.9.2.2 skrll 870 1.9.2.2 skrll int 871 1.9.2.2 skrll pf_rollback_altq(u_int32_t ticket) 872 1.9.2.2 skrll { 873 1.9.2.2 skrll struct pf_altq *altq; 874 1.9.2.2 skrll int error = 0; 875 1.9.2.2 skrll 876 1.9.2.2 skrll if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 877 1.9.2.2 skrll return (0); 878 1.9.2.2 skrll /* Purge the old altq list */ 879 1.9.2.2 skrll while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 880 1.9.2.2 skrll TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 881 1.9.2.2 skrll if (altq->qname[0] == 0) { 882 1.9.2.2 skrll /* detach and destroy the discipline */ 883 1.9.2.2 skrll error = altq_remove(altq); 884 1.9.2.2 skrll } else 885 1.9.2.2 skrll pf_qid_unref(altq->qid); 886 1.9.2.2 skrll pool_put(&pf_altq_pl, altq); 887 1.9.2.2 skrll } 888 1.9.2.2 skrll altqs_inactive_open = 0; 889 1.9.2.2 skrll return (error); 890 1.9.2.2 skrll } 891 1.9.2.2 skrll 892 1.9.2.2 skrll int 893 1.9.2.2 skrll pf_commit_altq(u_int32_t ticket) 894 1.9.2.2 skrll { 895 1.9.2.2 skrll struct pf_altqqueue *old_altqs; 896 1.9.2.2 skrll struct pf_altq *altq; 897 1.9.2.2 skrll int s, err, error = 0; 898 1.9.2.2 skrll 899 1.9.2.2 skrll if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 900 1.9.2.2 skrll return (EBUSY); 901 1.9.2.2 skrll 902 1.9.2.2 skrll /* swap altqs, keep the old. */ 903 1.9.2.2 skrll s = splsoftnet(); 904 1.9.2.2 skrll old_altqs = pf_altqs_active; 905 1.9.2.2 skrll pf_altqs_active = pf_altqs_inactive; 906 1.9.2.2 skrll pf_altqs_inactive = old_altqs; 907 1.9.2.2 skrll ticket_altqs_active = ticket_altqs_inactive; 908 1.9.2.2 skrll 909 1.9.2.2 skrll /* Attach new disciplines */ 910 1.9.2.2 skrll TAILQ_FOREACH(altq, pf_altqs_active, entries) { 911 1.9.2.2 skrll if (altq->qname[0] == 0) { 912 1.9.2.2 skrll /* attach the discipline */ 913 1.9.2.2 skrll error = altq_pfattach(altq); 914 1.9.2.6 skrll if (error == 0 && pf_altq_running) 915 1.9.2.6 skrll error = pf_enable_altq(altq); 916 1.9.2.6 skrll if (error != 0) { 917 1.9.2.2 skrll splx(s); 918 1.9.2.2 skrll return (error); 919 1.9.2.2 skrll } 920 1.9.2.2 skrll } 921 1.9.2.2 skrll } 922 1.9.2.2 skrll 923 1.9.2.2 skrll /* Purge the old altq list */ 924 1.9.2.2 skrll while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 925 1.9.2.2 skrll TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 926 1.9.2.2 skrll if (altq->qname[0] == 0) { 927 1.9.2.2 skrll /* detach and destroy the discipline */ 928 1.9.2.6 skrll if (pf_altq_running) 929 1.9.2.6 skrll error = pf_disable_altq(altq); 930 1.9.2.2 skrll err = altq_pfdetach(altq); 931 1.9.2.2 skrll if (err != 0 && error == 0) 932 1.9.2.2 skrll error = err; 933 1.9.2.2 skrll err = altq_remove(altq); 934 1.9.2.2 skrll if (err != 0 && error == 0) 935 1.9.2.2 skrll error = err; 936 1.9.2.2 skrll } else 937 1.9.2.2 skrll pf_qid_unref(altq->qid); 938 1.9.2.2 skrll pool_put(&pf_altq_pl, altq); 939 1.9.2.2 skrll } 940 1.9.2.2 skrll splx(s); 941 1.9.2.2 skrll 942 1.9.2.2 skrll altqs_inactive_open = 0; 943 1.9.2.2 skrll return (error); 944 1.9.2.2 skrll } 945 1.9.2.6 skrll 946 1.9.2.6 skrll int 947 1.9.2.6 skrll pf_enable_altq(struct pf_altq *altq) 948 1.9.2.6 skrll { 949 1.9.2.6 skrll struct ifnet *ifp; 950 1.9.2.6 skrll struct tb_profile tb; 951 1.9.2.6 skrll int s, error = 0; 952 1.9.2.6 skrll 953 1.9.2.6 skrll if ((ifp = ifunit(altq->ifname)) == NULL) 954 1.9.2.6 skrll return (EINVAL); 955 1.9.2.6 skrll 956 1.9.2.6 skrll if (ifp->if_snd.altq_type != ALTQT_NONE) 957 1.9.2.6 skrll error = altq_enable(&ifp->if_snd); 958 1.9.2.6 skrll 959 1.9.2.6 skrll /* set tokenbucket regulator */ 960 1.9.2.6 skrll if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 961 1.9.2.6 skrll tb.rate = altq->ifbandwidth; 962 1.9.2.6 skrll tb.depth = altq->tbrsize; 963 1.9.2.6 skrll s = splimp(); 964 1.9.2.6 skrll error = tbr_set(&ifp->if_snd, &tb); 965 1.9.2.6 skrll splx(s); 966 1.9.2.6 skrll } 967 1.9.2.6 skrll 968 1.9.2.6 skrll return (error); 969 1.9.2.6 skrll } 970 1.9.2.6 skrll 971 1.9.2.6 skrll int 972 1.9.2.6 skrll pf_disable_altq(struct pf_altq *altq) 973 1.9.2.6 skrll { 974 1.9.2.6 skrll struct ifnet *ifp; 975 1.9.2.6 skrll struct tb_profile tb; 976 1.9.2.6 skrll int s, error; 977 1.9.2.6 skrll 978 1.9.2.6 skrll if ((ifp = ifunit(altq->ifname)) == NULL) 979 1.9.2.6 skrll return (EINVAL); 980 1.9.2.6 skrll 981 1.9.2.6 skrll /* 982 1.9.2.6 skrll * when the discipline is no longer referenced, it was overridden 983 1.9.2.6 skrll * by a new one. if so, just return. 984 1.9.2.6 skrll */ 985 1.9.2.6 skrll if (altq->altq_disc != ifp->if_snd.altq_disc) 986 1.9.2.6 skrll return (0); 987 1.9.2.6 skrll 988 1.9.2.6 skrll error = altq_disable(&ifp->if_snd); 989 1.9.2.6 skrll 990 1.9.2.6 skrll if (error == 0) { 991 1.9.2.6 skrll /* clear tokenbucket regulator */ 992 1.9.2.6 skrll tb.rate = 0; 993 1.9.2.6 skrll s = splimp(); 994 1.9.2.6 skrll error = tbr_set(&ifp->if_snd, &tb); 995 1.9.2.6 skrll splx(s); 996 1.9.2.6 skrll } 997 1.9.2.6 skrll 998 1.9.2.6 skrll return (error); 999 1.9.2.6 skrll } 1000 1.9.2.2 skrll #endif /* ALTQ */ 1001 1.9.2.2 skrll 1002 1.9.2.2 skrll int 1003 1.9.2.6 skrll pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 1004 1.9.2.2 skrll { 1005 1.9.2.2 skrll struct pf_ruleset *rs; 1006 1.9.2.2 skrll struct pf_rule *rule; 1007 1.9.2.2 skrll 1008 1.9.2.2 skrll if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 1009 1.9.2.2 skrll return (EINVAL); 1010 1.9.2.6 skrll rs = pf_find_or_create_ruleset(anchor); 1011 1.9.2.2 skrll if (rs == NULL) 1012 1.9.2.2 skrll return (EINVAL); 1013 1.9.2.2 skrll while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 1014 1.9.2.2 skrll pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 1015 1.9.2.2 skrll *ticket = ++rs->rules[rs_num].inactive.ticket; 1016 1.9.2.2 skrll rs->rules[rs_num].inactive.open = 1; 1017 1.9.2.2 skrll return (0); 1018 1.9.2.2 skrll } 1019 1.9.2.2 skrll 1020 1.9.2.2 skrll int 1021 1.9.2.6 skrll pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 1022 1.9.2.2 skrll { 1023 1.9.2.2 skrll struct pf_ruleset *rs; 1024 1.9.2.2 skrll struct pf_rule *rule; 1025 1.9.2.2 skrll 1026 1.9.2.2 skrll if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 1027 1.9.2.2 skrll return (EINVAL); 1028 1.9.2.6 skrll rs = pf_find_ruleset(anchor); 1029 1.9.2.2 skrll if (rs == NULL || !rs->rules[rs_num].inactive.open || 1030 1.9.2.2 skrll rs->rules[rs_num].inactive.ticket != ticket) 1031 1.9.2.2 skrll return (0); 1032 1.9.2.2 skrll while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 1033 1.9.2.2 skrll pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 1034 1.9.2.2 skrll rs->rules[rs_num].inactive.open = 0; 1035 1.9.2.2 skrll return (0); 1036 1.9.2.2 skrll } 1037 1.9.2.2 skrll 1038 1.9.2.2 skrll int 1039 1.9.2.6 skrll pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 1040 1.9.2.2 skrll { 1041 1.9.2.2 skrll struct pf_ruleset *rs; 1042 1.9.2.2 skrll struct pf_rule *rule; 1043 1.9.2.2 skrll struct pf_rulequeue *old_rules; 1044 1.9.2.2 skrll int s; 1045 1.9.2.2 skrll 1046 1.9.2.2 skrll if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 1047 1.9.2.2 skrll return (EINVAL); 1048 1.9.2.6 skrll rs = pf_find_ruleset(anchor); 1049 1.9.2.2 skrll if (rs == NULL || !rs->rules[rs_num].inactive.open || 1050 1.9.2.2 skrll ticket != rs->rules[rs_num].inactive.ticket) 1051 1.9.2.2 skrll return (EBUSY); 1052 1.9.2.2 skrll 1053 1.9.2.2 skrll /* Swap rules, keep the old. */ 1054 1.9.2.2 skrll s = splsoftnet(); 1055 1.9.2.2 skrll old_rules = rs->rules[rs_num].active.ptr; 1056 1.9.2.2 skrll rs->rules[rs_num].active.ptr = 1057 1.9.2.2 skrll rs->rules[rs_num].inactive.ptr; 1058 1.9.2.2 skrll rs->rules[rs_num].inactive.ptr = old_rules; 1059 1.9.2.2 skrll rs->rules[rs_num].active.ticket = 1060 1.9.2.2 skrll rs->rules[rs_num].inactive.ticket; 1061 1.9.2.2 skrll pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 1062 1.9.2.2 skrll 1063 1.9.2.2 skrll /* Purge the old rule list. */ 1064 1.9.2.2 skrll while ((rule = TAILQ_FIRST(old_rules)) != NULL) 1065 1.9.2.2 skrll pf_rm_rule(old_rules, rule); 1066 1.9.2.2 skrll rs->rules[rs_num].inactive.open = 0; 1067 1.9.2.2 skrll pf_remove_if_empty_ruleset(rs); 1068 1.9.2.2 skrll splx(s); 1069 1.9.2.2 skrll return (0); 1070 1.9.2.2 skrll } 1071 1.9.2.2 skrll 1072 1.9.2.2 skrll int 1073 1.9.2.5 skrll pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct lwp *l) 1074 1.9.2.2 skrll { 1075 1.9.2.2 skrll struct pf_pooladdr *pa = NULL; 1076 1.9.2.2 skrll struct pf_pool *pool = NULL; 1077 1.9.2.2 skrll int s; 1078 1.9.2.2 skrll int error = 0; 1079 1.9.2.2 skrll 1080 1.9.2.2 skrll /* XXX keep in sync with switch() below */ 1081 1.9.2.2 skrll if (securelevel > 1) 1082 1.9.2.2 skrll switch (cmd) { 1083 1.9.2.2 skrll case DIOCGETRULES: 1084 1.9.2.2 skrll case DIOCGETRULE: 1085 1.9.2.2 skrll case DIOCGETADDRS: 1086 1.9.2.2 skrll case DIOCGETADDR: 1087 1.9.2.2 skrll case DIOCGETSTATE: 1088 1.9.2.2 skrll case DIOCSETSTATUSIF: 1089 1.9.2.2 skrll case DIOCGETSTATUS: 1090 1.9.2.2 skrll case DIOCCLRSTATUS: 1091 1.9.2.2 skrll case DIOCNATLOOK: 1092 1.9.2.2 skrll case DIOCSETDEBUG: 1093 1.9.2.2 skrll case DIOCGETSTATES: 1094 1.9.2.2 skrll case DIOCGETTIMEOUT: 1095 1.9.2.2 skrll case DIOCCLRRULECTRS: 1096 1.9.2.2 skrll case DIOCGETLIMIT: 1097 1.9.2.2 skrll case DIOCGETALTQS: 1098 1.9.2.2 skrll case DIOCGETALTQ: 1099 1.9.2.2 skrll case DIOCGETQSTATS: 1100 1.9.2.2 skrll case DIOCGETRULESETS: 1101 1.9.2.2 skrll case DIOCGETRULESET: 1102 1.9.2.2 skrll case DIOCRGETTABLES: 1103 1.9.2.2 skrll case DIOCRGETTSTATS: 1104 1.9.2.2 skrll case DIOCRCLRTSTATS: 1105 1.9.2.2 skrll case DIOCRCLRADDRS: 1106 1.9.2.2 skrll case DIOCRADDADDRS: 1107 1.9.2.2 skrll case DIOCRDELADDRS: 1108 1.9.2.2 skrll case DIOCRSETADDRS: 1109 1.9.2.2 skrll case DIOCRGETADDRS: 1110 1.9.2.2 skrll case DIOCRGETASTATS: 1111 1.9.2.2 skrll case DIOCRCLRASTATS: 1112 1.9.2.2 skrll case DIOCRTSTADDRS: 1113 1.9.2.2 skrll case DIOCOSFPGET: 1114 1.9.2.2 skrll case DIOCGETSRCNODES: 1115 1.9.2.2 skrll case DIOCCLRSRCNODES: 1116 1.9.2.2 skrll case DIOCIGETIFACES: 1117 1.9.2.2 skrll case DIOCICLRISTATS: 1118 1.9.2.2 skrll break; 1119 1.9.2.2 skrll case DIOCRCLRTABLES: 1120 1.9.2.2 skrll case DIOCRADDTABLES: 1121 1.9.2.2 skrll case DIOCRDELTABLES: 1122 1.9.2.2 skrll case DIOCRSETTFLAGS: 1123 1.9.2.2 skrll if (((struct pfioc_table *)addr)->pfrio_flags & 1124 1.9.2.2 skrll PFR_FLAG_DUMMY) 1125 1.9.2.2 skrll break; /* dummy operation ok */ 1126 1.9.2.2 skrll return (EPERM); 1127 1.9.2.2 skrll default: 1128 1.9.2.2 skrll return (EPERM); 1129 1.9.2.2 skrll } 1130 1.9.2.2 skrll 1131 1.9.2.2 skrll if (!(flags & FWRITE)) 1132 1.9.2.2 skrll switch (cmd) { 1133 1.9.2.2 skrll case DIOCGETRULES: 1134 1.9.2.2 skrll case DIOCGETRULE: 1135 1.9.2.2 skrll case DIOCGETADDRS: 1136 1.9.2.2 skrll case DIOCGETADDR: 1137 1.9.2.2 skrll case DIOCGETSTATE: 1138 1.9.2.2 skrll case DIOCGETSTATUS: 1139 1.9.2.2 skrll case DIOCGETSTATES: 1140 1.9.2.2 skrll case DIOCGETTIMEOUT: 1141 1.9.2.2 skrll case DIOCGETLIMIT: 1142 1.9.2.2 skrll case DIOCGETALTQS: 1143 1.9.2.2 skrll case DIOCGETALTQ: 1144 1.9.2.2 skrll case DIOCGETQSTATS: 1145 1.9.2.2 skrll case DIOCGETRULESETS: 1146 1.9.2.2 skrll case DIOCGETRULESET: 1147 1.9.2.2 skrll case DIOCRGETTABLES: 1148 1.9.2.2 skrll case DIOCRGETTSTATS: 1149 1.9.2.2 skrll case DIOCRGETADDRS: 1150 1.9.2.2 skrll case DIOCRGETASTATS: 1151 1.9.2.2 skrll case DIOCRTSTADDRS: 1152 1.9.2.2 skrll case DIOCOSFPGET: 1153 1.9.2.2 skrll case DIOCGETSRCNODES: 1154 1.9.2.2 skrll case DIOCIGETIFACES: 1155 1.9.2.2 skrll break; 1156 1.9.2.2 skrll case DIOCRCLRTABLES: 1157 1.9.2.2 skrll case DIOCRADDTABLES: 1158 1.9.2.2 skrll case DIOCRDELTABLES: 1159 1.9.2.2 skrll case DIOCRCLRTSTATS: 1160 1.9.2.2 skrll case DIOCRCLRADDRS: 1161 1.9.2.2 skrll case DIOCRADDADDRS: 1162 1.9.2.2 skrll case DIOCRDELADDRS: 1163 1.9.2.2 skrll case DIOCRSETADDRS: 1164 1.9.2.2 skrll case DIOCRSETTFLAGS: 1165 1.9.2.2 skrll if (((struct pfioc_table *)addr)->pfrio_flags & 1166 1.9.2.2 skrll PFR_FLAG_DUMMY) 1167 1.9.2.2 skrll break; /* dummy operation ok */ 1168 1.9.2.2 skrll return (EACCES); 1169 1.9.2.2 skrll default: 1170 1.9.2.2 skrll return (EACCES); 1171 1.9.2.2 skrll } 1172 1.9.2.2 skrll 1173 1.9.2.2 skrll switch (cmd) { 1174 1.9.2.2 skrll 1175 1.9.2.2 skrll case DIOCSTART: 1176 1.9.2.2 skrll if (pf_status.running) 1177 1.9.2.2 skrll error = EEXIST; 1178 1.9.2.2 skrll else { 1179 1.9.2.2 skrll #ifdef __NetBSD__ 1180 1.9.2.2 skrll error = pf_pfil_attach(); 1181 1.9.2.2 skrll if (error) 1182 1.9.2.2 skrll break; 1183 1.9.2.2 skrll #endif 1184 1.9.2.2 skrll pf_status.running = 1; 1185 1.9.2.6 skrll pf_status.since = time_second; 1186 1.9.2.2 skrll if (pf_status.stateid == 0) { 1187 1.9.2.6 skrll pf_status.stateid = time_second; 1188 1.9.2.2 skrll pf_status.stateid = pf_status.stateid << 32; 1189 1.9.2.2 skrll } 1190 1.9.2.2 skrll DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1191 1.9.2.2 skrll } 1192 1.9.2.2 skrll break; 1193 1.9.2.2 skrll 1194 1.9.2.2 skrll case DIOCSTOP: 1195 1.9.2.2 skrll if (!pf_status.running) 1196 1.9.2.2 skrll error = ENOENT; 1197 1.9.2.2 skrll else { 1198 1.9.2.2 skrll #ifdef __NetBSD__ 1199 1.9.2.2 skrll error = pf_pfil_detach(); 1200 1.9.2.2 skrll if (error) 1201 1.9.2.2 skrll break; 1202 1.9.2.2 skrll #endif 1203 1.9.2.2 skrll pf_status.running = 0; 1204 1.9.2.6 skrll pf_status.since = time_second; 1205 1.9.2.2 skrll DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1206 1.9.2.2 skrll } 1207 1.9.2.2 skrll break; 1208 1.9.2.2 skrll 1209 1.9.2.2 skrll case DIOCADDRULE: { 1210 1.9.2.2 skrll struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1211 1.9.2.2 skrll struct pf_ruleset *ruleset; 1212 1.9.2.2 skrll struct pf_rule *rule, *tail; 1213 1.9.2.2 skrll struct pf_pooladdr *pa; 1214 1.9.2.2 skrll int rs_num; 1215 1.9.2.2 skrll 1216 1.9.2.6 skrll pr->anchor[sizeof(pr->anchor) - 1] = 0; 1217 1.9.2.6 skrll ruleset = pf_find_ruleset(pr->anchor); 1218 1.9.2.2 skrll if (ruleset == NULL) { 1219 1.9.2.2 skrll error = EINVAL; 1220 1.9.2.2 skrll break; 1221 1.9.2.2 skrll } 1222 1.9.2.2 skrll rs_num = pf_get_ruleset_number(pr->rule.action); 1223 1.9.2.2 skrll if (rs_num >= PF_RULESET_MAX) { 1224 1.9.2.2 skrll error = EINVAL; 1225 1.9.2.2 skrll break; 1226 1.9.2.2 skrll } 1227 1.9.2.2 skrll if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1228 1.9.2.2 skrll error = EINVAL; 1229 1.9.2.2 skrll break; 1230 1.9.2.2 skrll } 1231 1.9.2.2 skrll if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1232 1.9.2.2 skrll error = EBUSY; 1233 1.9.2.2 skrll break; 1234 1.9.2.2 skrll } 1235 1.9.2.2 skrll if (pr->pool_ticket != ticket_pabuf) { 1236 1.9.2.2 skrll error = EBUSY; 1237 1.9.2.2 skrll break; 1238 1.9.2.2 skrll } 1239 1.9.2.2 skrll rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1240 1.9.2.2 skrll if (rule == NULL) { 1241 1.9.2.2 skrll error = ENOMEM; 1242 1.9.2.2 skrll break; 1243 1.9.2.2 skrll } 1244 1.9.2.2 skrll bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1245 1.9.2.2 skrll rule->anchor = NULL; 1246 1.9.2.2 skrll rule->kif = NULL; 1247 1.9.2.2 skrll TAILQ_INIT(&rule->rpool.list); 1248 1.9.2.2 skrll /* initialize refcounting */ 1249 1.9.2.2 skrll rule->states = 0; 1250 1.9.2.2 skrll rule->src_nodes = 0; 1251 1.9.2.2 skrll rule->entries.tqe_prev = NULL; 1252 1.9.2.2 skrll #ifndef INET 1253 1.9.2.2 skrll if (rule->af == AF_INET) { 1254 1.9.2.2 skrll pool_put(&pf_rule_pl, rule); 1255 1.9.2.2 skrll error = EAFNOSUPPORT; 1256 1.9.2.2 skrll break; 1257 1.9.2.2 skrll } 1258 1.9.2.2 skrll #endif /* INET */ 1259 1.9.2.2 skrll #ifndef INET6 1260 1.9.2.2 skrll if (rule->af == AF_INET6) { 1261 1.9.2.2 skrll pool_put(&pf_rule_pl, rule); 1262 1.9.2.2 skrll error = EAFNOSUPPORT; 1263 1.9.2.2 skrll break; 1264 1.9.2.2 skrll } 1265 1.9.2.2 skrll #endif /* INET6 */ 1266 1.9.2.2 skrll tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1267 1.9.2.2 skrll pf_rulequeue); 1268 1.9.2.2 skrll if (tail) 1269 1.9.2.2 skrll rule->nr = tail->nr + 1; 1270 1.9.2.2 skrll else 1271 1.9.2.2 skrll rule->nr = 0; 1272 1.9.2.2 skrll if (rule->ifname[0]) { 1273 1.9.2.2 skrll rule->kif = pfi_attach_rule(rule->ifname); 1274 1.9.2.2 skrll if (rule->kif == NULL) { 1275 1.9.2.2 skrll pool_put(&pf_rule_pl, rule); 1276 1.9.2.2 skrll error = EINVAL; 1277 1.9.2.2 skrll break; 1278 1.9.2.2 skrll } 1279 1.9.2.2 skrll } 1280 1.9.2.2 skrll 1281 1.9.2.2 skrll #ifdef ALTQ 1282 1.9.2.2 skrll /* set queue IDs */ 1283 1.9.2.2 skrll if (rule->qname[0] != 0) { 1284 1.9.2.2 skrll if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1285 1.9.2.2 skrll error = EBUSY; 1286 1.9.2.2 skrll else if (rule->pqname[0] != 0) { 1287 1.9.2.2 skrll if ((rule->pqid = 1288 1.9.2.2 skrll pf_qname2qid(rule->pqname)) == 0) 1289 1.9.2.2 skrll error = EBUSY; 1290 1.9.2.2 skrll } else 1291 1.9.2.2 skrll rule->pqid = rule->qid; 1292 1.9.2.2 skrll } 1293 1.9.2.2 skrll #endif 1294 1.9.2.2 skrll if (rule->tagname[0]) 1295 1.9.2.2 skrll if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1296 1.9.2.2 skrll error = EBUSY; 1297 1.9.2.2 skrll if (rule->match_tagname[0]) 1298 1.9.2.2 skrll if ((rule->match_tag = 1299 1.9.2.2 skrll pf_tagname2tag(rule->match_tagname)) == 0) 1300 1.9.2.2 skrll error = EBUSY; 1301 1.9.2.2 skrll if (rule->rt && !rule->direction) 1302 1.9.2.2 skrll error = EINVAL; 1303 1.9.2.2 skrll if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1304 1.9.2.2 skrll error = EINVAL; 1305 1.9.2.2 skrll if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1306 1.9.2.2 skrll error = EINVAL; 1307 1.9.2.2 skrll if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1308 1.9.2.2 skrll error = EINVAL; 1309 1.9.2.2 skrll if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1310 1.9.2.2 skrll error = EINVAL; 1311 1.9.2.6 skrll if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1312 1.9.2.6 skrll error = EINVAL; 1313 1.9.2.2 skrll TAILQ_FOREACH(pa, &pf_pabuf, entries) 1314 1.9.2.2 skrll if (pf_tbladdr_setup(ruleset, &pa->addr)) 1315 1.9.2.2 skrll error = EINVAL; 1316 1.9.2.2 skrll 1317 1.9.2.2 skrll pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1318 1.9.2.2 skrll if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1319 1.9.2.6 skrll (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1320 1.9.2.2 skrll (rule->rt > PF_FASTROUTE)) && 1321 1.9.2.2 skrll (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1322 1.9.2.2 skrll error = EINVAL; 1323 1.9.2.2 skrll 1324 1.9.2.2 skrll if (error) { 1325 1.9.2.2 skrll pf_rm_rule(NULL, rule); 1326 1.9.2.2 skrll break; 1327 1.9.2.2 skrll } 1328 1.9.2.2 skrll rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1329 1.9.2.2 skrll rule->evaluations = rule->packets = rule->bytes = 0; 1330 1.9.2.2 skrll TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1331 1.9.2.2 skrll rule, entries); 1332 1.9.2.2 skrll break; 1333 1.9.2.2 skrll } 1334 1.9.2.2 skrll 1335 1.9.2.2 skrll case DIOCGETRULES: { 1336 1.9.2.2 skrll struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1337 1.9.2.2 skrll struct pf_ruleset *ruleset; 1338 1.9.2.2 skrll struct pf_rule *tail; 1339 1.9.2.2 skrll int rs_num; 1340 1.9.2.2 skrll 1341 1.9.2.6 skrll pr->anchor[sizeof(pr->anchor) - 1] = 0; 1342 1.9.2.6 skrll ruleset = pf_find_ruleset(pr->anchor); 1343 1.9.2.2 skrll if (ruleset == NULL) { 1344 1.9.2.2 skrll error = EINVAL; 1345 1.9.2.2 skrll break; 1346 1.9.2.2 skrll } 1347 1.9.2.2 skrll rs_num = pf_get_ruleset_number(pr->rule.action); 1348 1.9.2.2 skrll if (rs_num >= PF_RULESET_MAX) { 1349 1.9.2.2 skrll error = EINVAL; 1350 1.9.2.2 skrll break; 1351 1.9.2.2 skrll } 1352 1.9.2.2 skrll s = splsoftnet(); 1353 1.9.2.2 skrll tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1354 1.9.2.2 skrll pf_rulequeue); 1355 1.9.2.2 skrll if (tail) 1356 1.9.2.2 skrll pr->nr = tail->nr + 1; 1357 1.9.2.2 skrll else 1358 1.9.2.2 skrll pr->nr = 0; 1359 1.9.2.2 skrll pr->ticket = ruleset->rules[rs_num].active.ticket; 1360 1.9.2.2 skrll splx(s); 1361 1.9.2.2 skrll break; 1362 1.9.2.2 skrll } 1363 1.9.2.2 skrll 1364 1.9.2.2 skrll case DIOCGETRULE: { 1365 1.9.2.2 skrll struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1366 1.9.2.2 skrll struct pf_ruleset *ruleset; 1367 1.9.2.2 skrll struct pf_rule *rule; 1368 1.9.2.2 skrll int rs_num, i; 1369 1.9.2.2 skrll 1370 1.9.2.6 skrll pr->anchor[sizeof(pr->anchor) - 1] = 0; 1371 1.9.2.6 skrll ruleset = pf_find_ruleset(pr->anchor); 1372 1.9.2.2 skrll if (ruleset == NULL) { 1373 1.9.2.2 skrll error = EINVAL; 1374 1.9.2.2 skrll break; 1375 1.9.2.2 skrll } 1376 1.9.2.2 skrll rs_num = pf_get_ruleset_number(pr->rule.action); 1377 1.9.2.2 skrll if (rs_num >= PF_RULESET_MAX) { 1378 1.9.2.2 skrll error = EINVAL; 1379 1.9.2.2 skrll break; 1380 1.9.2.2 skrll } 1381 1.9.2.2 skrll if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1382 1.9.2.2 skrll error = EBUSY; 1383 1.9.2.2 skrll break; 1384 1.9.2.2 skrll } 1385 1.9.2.2 skrll s = splsoftnet(); 1386 1.9.2.2 skrll rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1387 1.9.2.2 skrll while ((rule != NULL) && (rule->nr != pr->nr)) 1388 1.9.2.2 skrll rule = TAILQ_NEXT(rule, entries); 1389 1.9.2.2 skrll if (rule == NULL) { 1390 1.9.2.2 skrll error = EBUSY; 1391 1.9.2.2 skrll splx(s); 1392 1.9.2.2 skrll break; 1393 1.9.2.2 skrll } 1394 1.9.2.2 skrll bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1395 1.9.2.6 skrll if (pf_anchor_copyout(ruleset, rule, pr)) { 1396 1.9.2.6 skrll error = EBUSY; 1397 1.9.2.6 skrll splx(s); 1398 1.9.2.6 skrll break; 1399 1.9.2.6 skrll } 1400 1.9.2.2 skrll pfi_dynaddr_copyout(&pr->rule.src.addr); 1401 1.9.2.2 skrll pfi_dynaddr_copyout(&pr->rule.dst.addr); 1402 1.9.2.2 skrll pf_tbladdr_copyout(&pr->rule.src.addr); 1403 1.9.2.2 skrll pf_tbladdr_copyout(&pr->rule.dst.addr); 1404 1.9.2.2 skrll for (i = 0; i < PF_SKIP_COUNT; ++i) 1405 1.9.2.2 skrll if (rule->skip[i].ptr == NULL) 1406 1.9.2.2 skrll pr->rule.skip[i].nr = -1; 1407 1.9.2.2 skrll else 1408 1.9.2.2 skrll pr->rule.skip[i].nr = 1409 1.9.2.2 skrll rule->skip[i].ptr->nr; 1410 1.9.2.2 skrll splx(s); 1411 1.9.2.2 skrll break; 1412 1.9.2.2 skrll } 1413 1.9.2.2 skrll 1414 1.9.2.2 skrll case DIOCCHANGERULE: { 1415 1.9.2.2 skrll struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1416 1.9.2.2 skrll struct pf_ruleset *ruleset; 1417 1.9.2.2 skrll struct pf_rule *oldrule = NULL, *newrule = NULL; 1418 1.9.2.2 skrll u_int32_t nr = 0; 1419 1.9.2.2 skrll int rs_num; 1420 1.9.2.2 skrll 1421 1.9.2.2 skrll if (!(pcr->action == PF_CHANGE_REMOVE || 1422 1.9.2.2 skrll pcr->action == PF_CHANGE_GET_TICKET) && 1423 1.9.2.2 skrll pcr->pool_ticket != ticket_pabuf) { 1424 1.9.2.2 skrll error = EBUSY; 1425 1.9.2.2 skrll break; 1426 1.9.2.2 skrll } 1427 1.9.2.2 skrll 1428 1.9.2.2 skrll if (pcr->action < PF_CHANGE_ADD_HEAD || 1429 1.9.2.2 skrll pcr->action > PF_CHANGE_GET_TICKET) { 1430 1.9.2.2 skrll error = EINVAL; 1431 1.9.2.2 skrll break; 1432 1.9.2.2 skrll } 1433 1.9.2.6 skrll ruleset = pf_find_ruleset(pcr->anchor); 1434 1.9.2.2 skrll if (ruleset == NULL) { 1435 1.9.2.2 skrll error = EINVAL; 1436 1.9.2.2 skrll break; 1437 1.9.2.2 skrll } 1438 1.9.2.2 skrll rs_num = pf_get_ruleset_number(pcr->rule.action); 1439 1.9.2.2 skrll if (rs_num >= PF_RULESET_MAX) { 1440 1.9.2.2 skrll error = EINVAL; 1441 1.9.2.2 skrll break; 1442 1.9.2.2 skrll } 1443 1.9.2.2 skrll 1444 1.9.2.2 skrll if (pcr->action == PF_CHANGE_GET_TICKET) { 1445 1.9.2.2 skrll pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1446 1.9.2.2 skrll break; 1447 1.9.2.2 skrll } else { 1448 1.9.2.2 skrll if (pcr->ticket != 1449 1.9.2.2 skrll ruleset->rules[rs_num].active.ticket) { 1450 1.9.2.2 skrll error = EINVAL; 1451 1.9.2.2 skrll break; 1452 1.9.2.2 skrll } 1453 1.9.2.2 skrll if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1454 1.9.2.2 skrll error = EINVAL; 1455 1.9.2.2 skrll break; 1456 1.9.2.2 skrll } 1457 1.9.2.2 skrll } 1458 1.9.2.2 skrll 1459 1.9.2.2 skrll if (pcr->action != PF_CHANGE_REMOVE) { 1460 1.9.2.2 skrll newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1461 1.9.2.2 skrll if (newrule == NULL) { 1462 1.9.2.2 skrll error = ENOMEM; 1463 1.9.2.2 skrll break; 1464 1.9.2.2 skrll } 1465 1.9.2.2 skrll bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1466 1.9.2.2 skrll TAILQ_INIT(&newrule->rpool.list); 1467 1.9.2.2 skrll /* initialize refcounting */ 1468 1.9.2.2 skrll newrule->states = 0; 1469 1.9.2.2 skrll newrule->entries.tqe_prev = NULL; 1470 1.9.2.2 skrll #ifndef INET 1471 1.9.2.2 skrll if (newrule->af == AF_INET) { 1472 1.9.2.2 skrll pool_put(&pf_rule_pl, newrule); 1473 1.9.2.2 skrll error = EAFNOSUPPORT; 1474 1.9.2.2 skrll break; 1475 1.9.2.2 skrll } 1476 1.9.2.2 skrll #endif /* INET */ 1477 1.9.2.2 skrll #ifndef INET6 1478 1.9.2.2 skrll if (newrule->af == AF_INET6) { 1479 1.9.2.2 skrll pool_put(&pf_rule_pl, newrule); 1480 1.9.2.2 skrll error = EAFNOSUPPORT; 1481 1.9.2.2 skrll break; 1482 1.9.2.2 skrll } 1483 1.9.2.2 skrll #endif /* INET6 */ 1484 1.9.2.2 skrll if (newrule->ifname[0]) { 1485 1.9.2.2 skrll newrule->kif = pfi_attach_rule(newrule->ifname); 1486 1.9.2.2 skrll if (newrule->kif == NULL) { 1487 1.9.2.2 skrll pool_put(&pf_rule_pl, newrule); 1488 1.9.2.2 skrll error = EINVAL; 1489 1.9.2.2 skrll break; 1490 1.9.2.2 skrll } 1491 1.9.2.2 skrll } else 1492 1.9.2.2 skrll newrule->kif = NULL; 1493 1.9.2.2 skrll 1494 1.9.2.2 skrll #ifdef ALTQ 1495 1.9.2.2 skrll /* set queue IDs */ 1496 1.9.2.2 skrll if (newrule->qname[0] != 0) { 1497 1.9.2.2 skrll if ((newrule->qid = 1498 1.9.2.2 skrll pf_qname2qid(newrule->qname)) == 0) 1499 1.9.2.2 skrll error = EBUSY; 1500 1.9.2.2 skrll else if (newrule->pqname[0] != 0) { 1501 1.9.2.2 skrll if ((newrule->pqid = 1502 1.9.2.2 skrll pf_qname2qid(newrule->pqname)) == 0) 1503 1.9.2.2 skrll error = EBUSY; 1504 1.9.2.2 skrll } else 1505 1.9.2.2 skrll newrule->pqid = newrule->qid; 1506 1.9.2.2 skrll } 1507 1.9.2.6 skrll #endif /* ALTQ */ 1508 1.9.2.2 skrll if (newrule->tagname[0]) 1509 1.9.2.2 skrll if ((newrule->tag = 1510 1.9.2.2 skrll pf_tagname2tag(newrule->tagname)) == 0) 1511 1.9.2.2 skrll error = EBUSY; 1512 1.9.2.2 skrll if (newrule->match_tagname[0]) 1513 1.9.2.2 skrll if ((newrule->match_tag = pf_tagname2tag( 1514 1.9.2.2 skrll newrule->match_tagname)) == 0) 1515 1.9.2.2 skrll error = EBUSY; 1516 1.9.2.2 skrll 1517 1.9.2.2 skrll if (newrule->rt && !newrule->direction) 1518 1.9.2.2 skrll error = EINVAL; 1519 1.9.2.2 skrll if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1520 1.9.2.2 skrll error = EINVAL; 1521 1.9.2.2 skrll if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1522 1.9.2.2 skrll error = EINVAL; 1523 1.9.2.2 skrll if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1524 1.9.2.2 skrll error = EINVAL; 1525 1.9.2.2 skrll if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1526 1.9.2.2 skrll error = EINVAL; 1527 1.9.2.6 skrll if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1528 1.9.2.6 skrll error = EINVAL; 1529 1.9.2.2 skrll 1530 1.9.2.2 skrll pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1531 1.9.2.2 skrll if (((((newrule->action == PF_NAT) || 1532 1.9.2.2 skrll (newrule->action == PF_RDR) || 1533 1.9.2.2 skrll (newrule->action == PF_BINAT) || 1534 1.9.2.2 skrll (newrule->rt > PF_FASTROUTE)) && 1535 1.9.2.6 skrll !pcr->anchor[0])) && 1536 1.9.2.2 skrll (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1537 1.9.2.2 skrll error = EINVAL; 1538 1.9.2.2 skrll 1539 1.9.2.2 skrll if (error) { 1540 1.9.2.2 skrll pf_rm_rule(NULL, newrule); 1541 1.9.2.2 skrll break; 1542 1.9.2.2 skrll } 1543 1.9.2.2 skrll newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1544 1.9.2.2 skrll newrule->evaluations = newrule->packets = 0; 1545 1.9.2.2 skrll newrule->bytes = 0; 1546 1.9.2.2 skrll } 1547 1.9.2.2 skrll pf_empty_pool(&pf_pabuf); 1548 1.9.2.2 skrll 1549 1.9.2.2 skrll s = splsoftnet(); 1550 1.9.2.2 skrll 1551 1.9.2.2 skrll if (pcr->action == PF_CHANGE_ADD_HEAD) 1552 1.9.2.2 skrll oldrule = TAILQ_FIRST( 1553 1.9.2.2 skrll ruleset->rules[rs_num].active.ptr); 1554 1.9.2.2 skrll else if (pcr->action == PF_CHANGE_ADD_TAIL) 1555 1.9.2.2 skrll oldrule = TAILQ_LAST( 1556 1.9.2.2 skrll ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1557 1.9.2.2 skrll else { 1558 1.9.2.2 skrll oldrule = TAILQ_FIRST( 1559 1.9.2.2 skrll ruleset->rules[rs_num].active.ptr); 1560 1.9.2.2 skrll while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1561 1.9.2.2 skrll oldrule = TAILQ_NEXT(oldrule, entries); 1562 1.9.2.2 skrll if (oldrule == NULL) { 1563 1.9.2.6 skrll if (newrule != NULL) 1564 1.9.2.6 skrll pf_rm_rule(NULL, newrule); 1565 1.9.2.2 skrll error = EINVAL; 1566 1.9.2.2 skrll splx(s); 1567 1.9.2.2 skrll break; 1568 1.9.2.2 skrll } 1569 1.9.2.2 skrll } 1570 1.9.2.2 skrll 1571 1.9.2.2 skrll if (pcr->action == PF_CHANGE_REMOVE) 1572 1.9.2.2 skrll pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1573 1.9.2.2 skrll else { 1574 1.9.2.2 skrll if (oldrule == NULL) 1575 1.9.2.2 skrll TAILQ_INSERT_TAIL( 1576 1.9.2.2 skrll ruleset->rules[rs_num].active.ptr, 1577 1.9.2.2 skrll newrule, entries); 1578 1.9.2.2 skrll else if (pcr->action == PF_CHANGE_ADD_HEAD || 1579 1.9.2.2 skrll pcr->action == PF_CHANGE_ADD_BEFORE) 1580 1.9.2.2 skrll TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1581 1.9.2.2 skrll else 1582 1.9.2.2 skrll TAILQ_INSERT_AFTER( 1583 1.9.2.2 skrll ruleset->rules[rs_num].active.ptr, 1584 1.9.2.2 skrll oldrule, newrule, entries); 1585 1.9.2.2 skrll } 1586 1.9.2.2 skrll 1587 1.9.2.2 skrll nr = 0; 1588 1.9.2.2 skrll TAILQ_FOREACH(oldrule, 1589 1.9.2.2 skrll ruleset->rules[rs_num].active.ptr, entries) 1590 1.9.2.2 skrll oldrule->nr = nr++; 1591 1.9.2.2 skrll 1592 1.9.2.6 skrll ruleset->rules[rs_num].active.ticket++; 1593 1.9.2.6 skrll 1594 1.9.2.2 skrll pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1595 1.9.2.2 skrll pf_remove_if_empty_ruleset(ruleset); 1596 1.9.2.2 skrll 1597 1.9.2.2 skrll splx(s); 1598 1.9.2.2 skrll break; 1599 1.9.2.2 skrll } 1600 1.9.2.2 skrll 1601 1.9.2.2 skrll case DIOCCLRSTATES: { 1602 1.9.2.2 skrll struct pf_state *state; 1603 1.9.2.2 skrll struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1604 1.9.2.2 skrll int killed = 0; 1605 1.9.2.2 skrll 1606 1.9.2.2 skrll s = splsoftnet(); 1607 1.9.2.2 skrll RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1608 1.9.2.2 skrll if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1609 1.9.2.2 skrll state->u.s.kif->pfik_name)) { 1610 1.9.2.2 skrll state->timeout = PFTM_PURGE; 1611 1.9.2.2 skrll #if NPFSYNC 1612 1.9.2.2 skrll /* don't send out individual delete messages */ 1613 1.9.2.2 skrll state->sync_flags = PFSTATE_NOSYNC; 1614 1.9.2.2 skrll #endif 1615 1.9.2.2 skrll killed++; 1616 1.9.2.2 skrll } 1617 1.9.2.2 skrll } 1618 1.9.2.2 skrll pf_purge_expired_states(); 1619 1.9.2.2 skrll pf_status.states = 0; 1620 1.9.2.2 skrll psk->psk_af = killed; 1621 1.9.2.2 skrll #if NPFSYNC 1622 1.9.2.2 skrll pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1623 1.9.2.2 skrll #endif 1624 1.9.2.2 skrll splx(s); 1625 1.9.2.2 skrll break; 1626 1.9.2.2 skrll } 1627 1.9.2.2 skrll 1628 1.9.2.2 skrll case DIOCKILLSTATES: { 1629 1.9.2.2 skrll struct pf_state *state; 1630 1.9.2.2 skrll struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1631 1.9.2.2 skrll int killed = 0; 1632 1.9.2.2 skrll 1633 1.9.2.2 skrll s = splsoftnet(); 1634 1.9.2.2 skrll RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1635 1.9.2.2 skrll if ((!psk->psk_af || state->af == psk->psk_af) 1636 1.9.2.2 skrll && (!psk->psk_proto || psk->psk_proto == 1637 1.9.2.2 skrll state->proto) && 1638 1.9.2.6 skrll PF_MATCHA(psk->psk_src.neg, 1639 1.9.2.2 skrll &psk->psk_src.addr.v.a.addr, 1640 1.9.2.2 skrll &psk->psk_src.addr.v.a.mask, 1641 1.9.2.2 skrll &state->lan.addr, state->af) && 1642 1.9.2.6 skrll PF_MATCHA(psk->psk_dst.neg, 1643 1.9.2.2 skrll &psk->psk_dst.addr.v.a.addr, 1644 1.9.2.2 skrll &psk->psk_dst.addr.v.a.mask, 1645 1.9.2.2 skrll &state->ext.addr, state->af) && 1646 1.9.2.2 skrll (psk->psk_src.port_op == 0 || 1647 1.9.2.2 skrll pf_match_port(psk->psk_src.port_op, 1648 1.9.2.2 skrll psk->psk_src.port[0], psk->psk_src.port[1], 1649 1.9.2.2 skrll state->lan.port)) && 1650 1.9.2.2 skrll (psk->psk_dst.port_op == 0 || 1651 1.9.2.2 skrll pf_match_port(psk->psk_dst.port_op, 1652 1.9.2.2 skrll psk->psk_dst.port[0], psk->psk_dst.port[1], 1653 1.9.2.2 skrll state->ext.port)) && 1654 1.9.2.2 skrll (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1655 1.9.2.2 skrll state->u.s.kif->pfik_name))) { 1656 1.9.2.2 skrll state->timeout = PFTM_PURGE; 1657 1.9.2.2 skrll killed++; 1658 1.9.2.2 skrll } 1659 1.9.2.2 skrll } 1660 1.9.2.2 skrll pf_purge_expired_states(); 1661 1.9.2.2 skrll splx(s); 1662 1.9.2.2 skrll psk->psk_af = killed; 1663 1.9.2.2 skrll break; 1664 1.9.2.2 skrll } 1665 1.9.2.2 skrll 1666 1.9.2.2 skrll case DIOCADDSTATE: { 1667 1.9.2.2 skrll struct pfioc_state *ps = (struct pfioc_state *)addr; 1668 1.9.2.2 skrll struct pf_state *state; 1669 1.9.2.2 skrll struct pfi_kif *kif; 1670 1.9.2.2 skrll 1671 1.9.2.2 skrll if (ps->state.timeout >= PFTM_MAX && 1672 1.9.2.2 skrll ps->state.timeout != PFTM_UNTIL_PACKET) { 1673 1.9.2.2 skrll error = EINVAL; 1674 1.9.2.2 skrll break; 1675 1.9.2.2 skrll } 1676 1.9.2.2 skrll state = pool_get(&pf_state_pl, PR_NOWAIT); 1677 1.9.2.2 skrll if (state == NULL) { 1678 1.9.2.2 skrll error = ENOMEM; 1679 1.9.2.2 skrll break; 1680 1.9.2.2 skrll } 1681 1.9.2.2 skrll s = splsoftnet(); 1682 1.9.2.2 skrll kif = pfi_lookup_create(ps->state.u.ifname); 1683 1.9.2.2 skrll if (kif == NULL) { 1684 1.9.2.2 skrll pool_put(&pf_state_pl, state); 1685 1.9.2.2 skrll error = ENOENT; 1686 1.9.2.2 skrll splx(s); 1687 1.9.2.2 skrll break; 1688 1.9.2.2 skrll } 1689 1.9.2.2 skrll bcopy(&ps->state, state, sizeof(struct pf_state)); 1690 1.9.2.2 skrll bzero(&state->u, sizeof(state->u)); 1691 1.9.2.2 skrll state->rule.ptr = &pf_default_rule; 1692 1.9.2.2 skrll state->nat_rule.ptr = NULL; 1693 1.9.2.2 skrll state->anchor.ptr = NULL; 1694 1.9.2.2 skrll state->rt_kif = NULL; 1695 1.9.2.6 skrll state->creation = time_second; 1696 1.9.2.2 skrll state->pfsync_time = 0; 1697 1.9.2.2 skrll state->packets[0] = state->packets[1] = 0; 1698 1.9.2.2 skrll state->bytes[0] = state->bytes[1] = 0; 1699 1.9.2.2 skrll 1700 1.9.2.2 skrll if (pf_insert_state(kif, state)) { 1701 1.9.2.2 skrll pfi_maybe_destroy(kif); 1702 1.9.2.2 skrll pool_put(&pf_state_pl, state); 1703 1.9.2.2 skrll error = ENOMEM; 1704 1.9.2.2 skrll } 1705 1.9.2.2 skrll splx(s); 1706 1.9.2.2 skrll break; 1707 1.9.2.2 skrll } 1708 1.9.2.2 skrll 1709 1.9.2.2 skrll case DIOCGETSTATE: { 1710 1.9.2.2 skrll struct pfioc_state *ps = (struct pfioc_state *)addr; 1711 1.9.2.2 skrll struct pf_state *state; 1712 1.9.2.2 skrll u_int32_t nr; 1713 1.9.2.2 skrll 1714 1.9.2.2 skrll nr = 0; 1715 1.9.2.2 skrll s = splsoftnet(); 1716 1.9.2.2 skrll RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1717 1.9.2.2 skrll if (nr >= ps->nr) 1718 1.9.2.2 skrll break; 1719 1.9.2.2 skrll nr++; 1720 1.9.2.2 skrll } 1721 1.9.2.2 skrll if (state == NULL) { 1722 1.9.2.2 skrll error = EBUSY; 1723 1.9.2.2 skrll splx(s); 1724 1.9.2.2 skrll break; 1725 1.9.2.2 skrll } 1726 1.9.2.2 skrll bcopy(state, &ps->state, sizeof(struct pf_state)); 1727 1.9.2.2 skrll ps->state.rule.nr = state->rule.ptr->nr; 1728 1.9.2.2 skrll ps->state.nat_rule.nr = (state->nat_rule.ptr == NULL) ? 1729 1.9.2.2 skrll -1 : state->nat_rule.ptr->nr; 1730 1.9.2.2 skrll ps->state.anchor.nr = (state->anchor.ptr == NULL) ? 1731 1.9.2.2 skrll -1 : state->anchor.ptr->nr; 1732 1.9.2.2 skrll splx(s); 1733 1.9.2.2 skrll ps->state.expire = pf_state_expires(state); 1734 1.9.2.6 skrll if (ps->state.expire > time_second) 1735 1.9.2.6 skrll ps->state.expire -= time_second; 1736 1.9.2.2 skrll else 1737 1.9.2.2 skrll ps->state.expire = 0; 1738 1.9.2.2 skrll break; 1739 1.9.2.2 skrll } 1740 1.9.2.2 skrll 1741 1.9.2.2 skrll case DIOCGETSTATES: { 1742 1.9.2.2 skrll struct pfioc_states *ps = (struct pfioc_states *)addr; 1743 1.9.2.2 skrll struct pf_state *state; 1744 1.9.2.2 skrll struct pf_state *p, pstore; 1745 1.9.2.2 skrll struct pfi_kif *kif; 1746 1.9.2.2 skrll u_int32_t nr = 0; 1747 1.9.2.2 skrll int space = ps->ps_len; 1748 1.9.2.2 skrll 1749 1.9.2.2 skrll if (space == 0) { 1750 1.9.2.2 skrll s = splsoftnet(); 1751 1.9.2.2 skrll TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1752 1.9.2.2 skrll nr += kif->pfik_states; 1753 1.9.2.2 skrll splx(s); 1754 1.9.2.2 skrll ps->ps_len = sizeof(struct pf_state) * nr; 1755 1.9.2.2 skrll return (0); 1756 1.9.2.2 skrll } 1757 1.9.2.2 skrll 1758 1.9.2.2 skrll s = splsoftnet(); 1759 1.9.2.2 skrll p = ps->ps_states; 1760 1.9.2.2 skrll TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1761 1.9.2.2 skrll RB_FOREACH(state, pf_state_tree_ext_gwy, 1762 1.9.2.2 skrll &kif->pfik_ext_gwy) { 1763 1.9.2.6 skrll int secs = time_second; 1764 1.9.2.2 skrll 1765 1.9.2.2 skrll if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1766 1.9.2.2 skrll break; 1767 1.9.2.2 skrll 1768 1.9.2.2 skrll bcopy(state, &pstore, sizeof(pstore)); 1769 1.9.2.2 skrll strlcpy(pstore.u.ifname, kif->pfik_name, 1770 1.9.2.2 skrll sizeof(pstore.u.ifname)); 1771 1.9.2.2 skrll pstore.rule.nr = state->rule.ptr->nr; 1772 1.9.2.2 skrll pstore.nat_rule.nr = (state->nat_rule.ptr == 1773 1.9.2.2 skrll NULL) ? -1 : state->nat_rule.ptr->nr; 1774 1.9.2.2 skrll pstore.anchor.nr = (state->anchor.ptr == 1775 1.9.2.2 skrll NULL) ? -1 : state->anchor.ptr->nr; 1776 1.9.2.2 skrll pstore.creation = secs - pstore.creation; 1777 1.9.2.2 skrll pstore.expire = pf_state_expires(state); 1778 1.9.2.2 skrll if (pstore.expire > secs) 1779 1.9.2.2 skrll pstore.expire -= secs; 1780 1.9.2.2 skrll else 1781 1.9.2.2 skrll pstore.expire = 0; 1782 1.9.2.2 skrll error = copyout(&pstore, p, sizeof(*p)); 1783 1.9.2.2 skrll if (error) { 1784 1.9.2.2 skrll splx(s); 1785 1.9.2.2 skrll goto fail; 1786 1.9.2.2 skrll } 1787 1.9.2.2 skrll p++; 1788 1.9.2.2 skrll nr++; 1789 1.9.2.2 skrll } 1790 1.9.2.2 skrll ps->ps_len = sizeof(struct pf_state) * nr; 1791 1.9.2.2 skrll splx(s); 1792 1.9.2.2 skrll break; 1793 1.9.2.2 skrll } 1794 1.9.2.2 skrll 1795 1.9.2.2 skrll case DIOCGETSTATUS: { 1796 1.9.2.2 skrll struct pf_status *s = (struct pf_status *)addr; 1797 1.9.2.2 skrll bcopy(&pf_status, s, sizeof(struct pf_status)); 1798 1.9.2.2 skrll pfi_fill_oldstatus(s); 1799 1.9.2.2 skrll break; 1800 1.9.2.2 skrll } 1801 1.9.2.2 skrll 1802 1.9.2.2 skrll case DIOCSETSTATUSIF: { 1803 1.9.2.2 skrll struct pfioc_if *pi = (struct pfioc_if *)addr; 1804 1.9.2.2 skrll 1805 1.9.2.2 skrll if (pi->ifname[0] == 0) { 1806 1.9.2.2 skrll bzero(pf_status.ifname, IFNAMSIZ); 1807 1.9.2.2 skrll break; 1808 1.9.2.2 skrll } 1809 1.9.2.2 skrll if (ifunit(pi->ifname) == NULL) { 1810 1.9.2.2 skrll error = EINVAL; 1811 1.9.2.2 skrll break; 1812 1.9.2.2 skrll } 1813 1.9.2.2 skrll strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 1814 1.9.2.2 skrll break; 1815 1.9.2.2 skrll } 1816 1.9.2.2 skrll 1817 1.9.2.2 skrll case DIOCCLRSTATUS: { 1818 1.9.2.2 skrll bzero(pf_status.counters, sizeof(pf_status.counters)); 1819 1.9.2.2 skrll bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 1820 1.9.2.2 skrll bzero(pf_status.scounters, sizeof(pf_status.scounters)); 1821 1.9.2.2 skrll if (*pf_status.ifname) 1822 1.9.2.2 skrll pfi_clr_istats(pf_status.ifname, NULL, 1823 1.9.2.2 skrll PFI_FLAG_INSTANCE); 1824 1.9.2.2 skrll break; 1825 1.9.2.2 skrll } 1826 1.9.2.2 skrll 1827 1.9.2.2 skrll case DIOCNATLOOK: { 1828 1.9.2.2 skrll struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1829 1.9.2.2 skrll struct pf_state *state; 1830 1.9.2.2 skrll struct pf_state key; 1831 1.9.2.2 skrll int m = 0, direction = pnl->direction; 1832 1.9.2.2 skrll 1833 1.9.2.2 skrll key.af = pnl->af; 1834 1.9.2.2 skrll key.proto = pnl->proto; 1835 1.9.2.2 skrll 1836 1.9.2.2 skrll if (!pnl->proto || 1837 1.9.2.2 skrll PF_AZERO(&pnl->saddr, pnl->af) || 1838 1.9.2.2 skrll PF_AZERO(&pnl->daddr, pnl->af) || 1839 1.9.2.2 skrll !pnl->dport || !pnl->sport) 1840 1.9.2.2 skrll error = EINVAL; 1841 1.9.2.2 skrll else { 1842 1.9.2.2 skrll s = splsoftnet(); 1843 1.9.2.2 skrll 1844 1.9.2.2 skrll /* 1845 1.9.2.2 skrll * userland gives us source and dest of connection, 1846 1.9.2.2 skrll * reverse the lookup so we ask for what happens with 1847 1.9.2.2 skrll * the return traffic, enabling us to find it in the 1848 1.9.2.2 skrll * state tree. 1849 1.9.2.2 skrll */ 1850 1.9.2.2 skrll if (direction == PF_IN) { 1851 1.9.2.2 skrll PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 1852 1.9.2.2 skrll key.ext.port = pnl->dport; 1853 1.9.2.2 skrll PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 1854 1.9.2.2 skrll key.gwy.port = pnl->sport; 1855 1.9.2.2 skrll state = pf_find_state_all(&key, PF_EXT_GWY, &m); 1856 1.9.2.2 skrll } else { 1857 1.9.2.2 skrll PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 1858 1.9.2.2 skrll key.lan.port = pnl->dport; 1859 1.9.2.2 skrll PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 1860 1.9.2.2 skrll key.ext.port = pnl->sport; 1861 1.9.2.2 skrll state = pf_find_state_all(&key, PF_LAN_EXT, &m); 1862 1.9.2.2 skrll } 1863 1.9.2.2 skrll if (m > 1) 1864 1.9.2.2 skrll error = E2BIG; /* more than one state */ 1865 1.9.2.2 skrll else if (state != NULL) { 1866 1.9.2.2 skrll if (direction == PF_IN) { 1867 1.9.2.2 skrll PF_ACPY(&pnl->rsaddr, &state->lan.addr, 1868 1.9.2.2 skrll state->af); 1869 1.9.2.2 skrll pnl->rsport = state->lan.port; 1870 1.9.2.2 skrll PF_ACPY(&pnl->rdaddr, &pnl->daddr, 1871 1.9.2.2 skrll pnl->af); 1872 1.9.2.2 skrll pnl->rdport = pnl->dport; 1873 1.9.2.2 skrll } else { 1874 1.9.2.2 skrll PF_ACPY(&pnl->rdaddr, &state->gwy.addr, 1875 1.9.2.2 skrll state->af); 1876 1.9.2.2 skrll pnl->rdport = state->gwy.port; 1877 1.9.2.2 skrll PF_ACPY(&pnl->rsaddr, &pnl->saddr, 1878 1.9.2.2 skrll pnl->af); 1879 1.9.2.2 skrll pnl->rsport = pnl->sport; 1880 1.9.2.2 skrll } 1881 1.9.2.2 skrll } else 1882 1.9.2.2 skrll error = ENOENT; 1883 1.9.2.2 skrll splx(s); 1884 1.9.2.2 skrll } 1885 1.9.2.2 skrll break; 1886 1.9.2.2 skrll } 1887 1.9.2.2 skrll 1888 1.9.2.2 skrll case DIOCSETTIMEOUT: { 1889 1.9.2.2 skrll struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1890 1.9.2.2 skrll int old; 1891 1.9.2.2 skrll 1892 1.9.2.2 skrll if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1893 1.9.2.2 skrll pt->seconds < 0) { 1894 1.9.2.2 skrll error = EINVAL; 1895 1.9.2.2 skrll goto fail; 1896 1.9.2.2 skrll } 1897 1.9.2.2 skrll old = pf_default_rule.timeout[pt->timeout]; 1898 1.9.2.2 skrll pf_default_rule.timeout[pt->timeout] = pt->seconds; 1899 1.9.2.2 skrll pt->seconds = old; 1900 1.9.2.2 skrll break; 1901 1.9.2.2 skrll } 1902 1.9.2.2 skrll 1903 1.9.2.2 skrll case DIOCGETTIMEOUT: { 1904 1.9.2.2 skrll struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1905 1.9.2.2 skrll 1906 1.9.2.2 skrll if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1907 1.9.2.2 skrll error = EINVAL; 1908 1.9.2.2 skrll goto fail; 1909 1.9.2.2 skrll } 1910 1.9.2.2 skrll pt->seconds = pf_default_rule.timeout[pt->timeout]; 1911 1.9.2.2 skrll break; 1912 1.9.2.2 skrll } 1913 1.9.2.2 skrll 1914 1.9.2.2 skrll case DIOCGETLIMIT: { 1915 1.9.2.2 skrll struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1916 1.9.2.2 skrll 1917 1.9.2.2 skrll if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1918 1.9.2.2 skrll error = EINVAL; 1919 1.9.2.2 skrll goto fail; 1920 1.9.2.2 skrll } 1921 1.9.2.2 skrll pl->limit = pf_pool_limits[pl->index].limit; 1922 1.9.2.2 skrll break; 1923 1.9.2.2 skrll } 1924 1.9.2.2 skrll 1925 1.9.2.2 skrll case DIOCSETLIMIT: { 1926 1.9.2.2 skrll struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1927 1.9.2.2 skrll int old_limit; 1928 1.9.2.2 skrll 1929 1.9.2.2 skrll if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1930 1.9.2.2 skrll pf_pool_limits[pl->index].pp == NULL) { 1931 1.9.2.2 skrll error = EINVAL; 1932 1.9.2.2 skrll goto fail; 1933 1.9.2.2 skrll } 1934 1.9.2.2 skrll #ifdef __OpenBSD__ 1935 1.9.2.2 skrll if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 1936 1.9.2.2 skrll pl->limit, NULL, 0) != 0) { 1937 1.9.2.2 skrll error = EBUSY; 1938 1.9.2.2 skrll goto fail; 1939 1.9.2.2 skrll } 1940 1.9.2.2 skrll #else 1941 1.9.2.2 skrll pool_sethardlimit(pf_pool_limits[pl->index].pp, 1942 1.9.2.2 skrll pl->limit, NULL, 0); 1943 1.9.2.2 skrll #endif 1944 1.9.2.2 skrll old_limit = pf_pool_limits[pl->index].limit; 1945 1.9.2.2 skrll pf_pool_limits[pl->index].limit = pl->limit; 1946 1.9.2.2 skrll pl->limit = old_limit; 1947 1.9.2.2 skrll break; 1948 1.9.2.2 skrll } 1949 1.9.2.2 skrll 1950 1.9.2.2 skrll case DIOCSETDEBUG: { 1951 1.9.2.2 skrll u_int32_t *level = (u_int32_t *)addr; 1952 1.9.2.2 skrll 1953 1.9.2.2 skrll pf_status.debug = *level; 1954 1.9.2.2 skrll break; 1955 1.9.2.2 skrll } 1956 1.9.2.2 skrll 1957 1.9.2.2 skrll case DIOCCLRRULECTRS: { 1958 1.9.2.2 skrll struct pf_ruleset *ruleset = &pf_main_ruleset; 1959 1.9.2.2 skrll struct pf_rule *rule; 1960 1.9.2.2 skrll 1961 1.9.2.2 skrll s = splsoftnet(); 1962 1.9.2.2 skrll TAILQ_FOREACH(rule, 1963 1.9.2.2 skrll ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) 1964 1.9.2.2 skrll rule->evaluations = rule->packets = 1965 1.9.2.2 skrll rule->bytes = 0; 1966 1.9.2.2 skrll splx(s); 1967 1.9.2.2 skrll break; 1968 1.9.2.2 skrll } 1969 1.9.2.2 skrll 1970 1.9.2.2 skrll #ifdef ALTQ 1971 1.9.2.2 skrll case DIOCSTARTALTQ: { 1972 1.9.2.2 skrll struct pf_altq *altq; 1973 1.9.2.2 skrll 1974 1.9.2.2 skrll /* enable all altq interfaces on active list */ 1975 1.9.2.2 skrll s = splsoftnet(); 1976 1.9.2.2 skrll TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1977 1.9.2.2 skrll if (altq->qname[0] == 0) { 1978 1.9.2.6 skrll error = pf_enable_altq(altq); 1979 1.9.2.2 skrll if (error != 0) 1980 1.9.2.2 skrll break; 1981 1.9.2.2 skrll } 1982 1.9.2.2 skrll } 1983 1.9.2.2 skrll if (error == 0) 1984 1.9.2.6 skrll pf_altq_running = 1; 1985 1.9.2.2 skrll splx(s); 1986 1.9.2.2 skrll DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 1987 1.9.2.2 skrll break; 1988 1.9.2.2 skrll } 1989 1.9.2.2 skrll 1990 1.9.2.2 skrll case DIOCSTOPALTQ: { 1991 1.9.2.2 skrll struct pf_altq *altq; 1992 1.9.2.2 skrll 1993 1.9.2.2 skrll /* disable all altq interfaces on active list */ 1994 1.9.2.2 skrll s = splsoftnet(); 1995 1.9.2.2 skrll TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1996 1.9.2.2 skrll if (altq->qname[0] == 0) { 1997 1.9.2.6 skrll error = pf_disable_altq(altq); 1998 1.9.2.6 skrll if (error != 0) 1999 1.9.2.2 skrll break; 2000 1.9.2.2 skrll } 2001 1.9.2.2 skrll } 2002 1.9.2.2 skrll if (error == 0) 2003 1.9.2.6 skrll pf_altq_running = 0; 2004 1.9.2.2 skrll splx(s); 2005 1.9.2.2 skrll DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 2006 1.9.2.2 skrll break; 2007 1.9.2.2 skrll } 2008 1.9.2.2 skrll 2009 1.9.2.2 skrll case DIOCADDALTQ: { 2010 1.9.2.2 skrll struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2011 1.9.2.2 skrll struct pf_altq *altq, *a; 2012 1.9.2.2 skrll 2013 1.9.2.2 skrll if (pa->ticket != ticket_altqs_inactive) { 2014 1.9.2.2 skrll error = EBUSY; 2015 1.9.2.2 skrll break; 2016 1.9.2.2 skrll } 2017 1.9.2.2 skrll altq = pool_get(&pf_altq_pl, PR_NOWAIT); 2018 1.9.2.2 skrll if (altq == NULL) { 2019 1.9.2.2 skrll error = ENOMEM; 2020 1.9.2.2 skrll break; 2021 1.9.2.2 skrll } 2022 1.9.2.2 skrll bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 2023 1.9.2.2 skrll 2024 1.9.2.2 skrll /* 2025 1.9.2.2 skrll * if this is for a queue, find the discipline and 2026 1.9.2.2 skrll * copy the necessary fields 2027 1.9.2.2 skrll */ 2028 1.9.2.2 skrll if (altq->qname[0] != 0) { 2029 1.9.2.2 skrll if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 2030 1.9.2.2 skrll error = EBUSY; 2031 1.9.2.2 skrll pool_put(&pf_altq_pl, altq); 2032 1.9.2.2 skrll break; 2033 1.9.2.2 skrll } 2034 1.9.2.2 skrll TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 2035 1.9.2.2 skrll if (strncmp(a->ifname, altq->ifname, 2036 1.9.2.2 skrll IFNAMSIZ) == 0 && a->qname[0] == 0) { 2037 1.9.2.2 skrll altq->altq_disc = a->altq_disc; 2038 1.9.2.2 skrll break; 2039 1.9.2.2 skrll } 2040 1.9.2.2 skrll } 2041 1.9.2.2 skrll } 2042 1.9.2.2 skrll 2043 1.9.2.2 skrll error = altq_add(altq); 2044 1.9.2.2 skrll if (error) { 2045 1.9.2.2 skrll pool_put(&pf_altq_pl, altq); 2046 1.9.2.2 skrll break; 2047 1.9.2.2 skrll } 2048 1.9.2.2 skrll 2049 1.9.2.2 skrll TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 2050 1.9.2.2 skrll bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2051 1.9.2.2 skrll break; 2052 1.9.2.2 skrll } 2053 1.9.2.2 skrll 2054 1.9.2.2 skrll case DIOCGETALTQS: { 2055 1.9.2.2 skrll struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2056 1.9.2.2 skrll struct pf_altq *altq; 2057 1.9.2.2 skrll 2058 1.9.2.2 skrll pa->nr = 0; 2059 1.9.2.2 skrll s = splsoftnet(); 2060 1.9.2.2 skrll TAILQ_FOREACH(altq, pf_altqs_active, entries) 2061 1.9.2.2 skrll pa->nr++; 2062 1.9.2.2 skrll pa->ticket = ticket_altqs_active; 2063 1.9.2.2 skrll splx(s); 2064 1.9.2.2 skrll break; 2065 1.9.2.2 skrll } 2066 1.9.2.2 skrll 2067 1.9.2.2 skrll case DIOCGETALTQ: { 2068 1.9.2.2 skrll struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2069 1.9.2.2 skrll struct pf_altq *altq; 2070 1.9.2.2 skrll u_int32_t nr; 2071 1.9.2.2 skrll 2072 1.9.2.2 skrll if (pa->ticket != ticket_altqs_active) { 2073 1.9.2.2 skrll error = EBUSY; 2074 1.9.2.2 skrll break; 2075 1.9.2.2 skrll } 2076 1.9.2.2 skrll nr = 0; 2077 1.9.2.2 skrll s = splsoftnet(); 2078 1.9.2.2 skrll altq = TAILQ_FIRST(pf_altqs_active); 2079 1.9.2.2 skrll while ((altq != NULL) && (nr < pa->nr)) { 2080 1.9.2.2 skrll altq = TAILQ_NEXT(altq, entries); 2081 1.9.2.2 skrll nr++; 2082 1.9.2.2 skrll } 2083 1.9.2.2 skrll if (altq == NULL) { 2084 1.9.2.2 skrll error = EBUSY; 2085 1.9.2.2 skrll splx(s); 2086 1.9.2.2 skrll break; 2087 1.9.2.2 skrll } 2088 1.9.2.2 skrll bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2089 1.9.2.2 skrll splx(s); 2090 1.9.2.2 skrll break; 2091 1.9.2.2 skrll } 2092 1.9.2.2 skrll 2093 1.9.2.2 skrll case DIOCCHANGEALTQ: 2094 1.9.2.2 skrll /* CHANGEALTQ not supported yet! */ 2095 1.9.2.2 skrll error = ENODEV; 2096 1.9.2.2 skrll break; 2097 1.9.2.2 skrll 2098 1.9.2.2 skrll case DIOCGETQSTATS: { 2099 1.9.2.2 skrll struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 2100 1.9.2.2 skrll struct pf_altq *altq; 2101 1.9.2.2 skrll u_int32_t nr; 2102 1.9.2.2 skrll int nbytes; 2103 1.9.2.2 skrll 2104 1.9.2.2 skrll if (pq->ticket != ticket_altqs_active) { 2105 1.9.2.2 skrll error = EBUSY; 2106 1.9.2.2 skrll break; 2107 1.9.2.2 skrll } 2108 1.9.2.2 skrll nbytes = pq->nbytes; 2109 1.9.2.2 skrll nr = 0; 2110 1.9.2.2 skrll s = splsoftnet(); 2111 1.9.2.2 skrll altq = TAILQ_FIRST(pf_altqs_active); 2112 1.9.2.2 skrll while ((altq != NULL) && (nr < pq->nr)) { 2113 1.9.2.2 skrll altq = TAILQ_NEXT(altq, entries); 2114 1.9.2.2 skrll nr++; 2115 1.9.2.2 skrll } 2116 1.9.2.2 skrll if (altq == NULL) { 2117 1.9.2.2 skrll error = EBUSY; 2118 1.9.2.2 skrll splx(s); 2119 1.9.2.2 skrll break; 2120 1.9.2.2 skrll } 2121 1.9.2.2 skrll error = altq_getqstats(altq, pq->buf, &nbytes); 2122 1.9.2.2 skrll splx(s); 2123 1.9.2.2 skrll if (error == 0) { 2124 1.9.2.2 skrll pq->scheduler = altq->scheduler; 2125 1.9.2.2 skrll pq->nbytes = nbytes; 2126 1.9.2.2 skrll } 2127 1.9.2.2 skrll break; 2128 1.9.2.2 skrll } 2129 1.9.2.2 skrll #endif /* ALTQ */ 2130 1.9.2.2 skrll 2131 1.9.2.2 skrll case DIOCBEGINADDRS: { 2132 1.9.2.2 skrll struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2133 1.9.2.2 skrll 2134 1.9.2.2 skrll pf_empty_pool(&pf_pabuf); 2135 1.9.2.2 skrll pp->ticket = ++ticket_pabuf; 2136 1.9.2.2 skrll break; 2137 1.9.2.2 skrll } 2138 1.9.2.2 skrll 2139 1.9.2.2 skrll case DIOCADDADDR: { 2140 1.9.2.2 skrll struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2141 1.9.2.2 skrll 2142 1.9.2.2 skrll #ifndef INET 2143 1.9.2.2 skrll if (pp->af == AF_INET) { 2144 1.9.2.2 skrll error = EAFNOSUPPORT; 2145 1.9.2.2 skrll break; 2146 1.9.2.2 skrll } 2147 1.9.2.2 skrll #endif /* INET */ 2148 1.9.2.2 skrll #ifndef INET6 2149 1.9.2.2 skrll if (pp->af == AF_INET6) { 2150 1.9.2.2 skrll error = EAFNOSUPPORT; 2151 1.9.2.2 skrll break; 2152 1.9.2.2 skrll } 2153 1.9.2.2 skrll #endif /* INET6 */ 2154 1.9.2.2 skrll if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2155 1.9.2.2 skrll pp->addr.addr.type != PF_ADDR_DYNIFTL && 2156 1.9.2.2 skrll pp->addr.addr.type != PF_ADDR_TABLE) { 2157 1.9.2.2 skrll error = EINVAL; 2158 1.9.2.2 skrll break; 2159 1.9.2.2 skrll } 2160 1.9.2.2 skrll pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2161 1.9.2.2 skrll if (pa == NULL) { 2162 1.9.2.2 skrll error = ENOMEM; 2163 1.9.2.2 skrll break; 2164 1.9.2.2 skrll } 2165 1.9.2.2 skrll bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2166 1.9.2.2 skrll if (pa->ifname[0]) { 2167 1.9.2.2 skrll pa->kif = pfi_attach_rule(pa->ifname); 2168 1.9.2.2 skrll if (pa->kif == NULL) { 2169 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, pa); 2170 1.9.2.2 skrll error = EINVAL; 2171 1.9.2.2 skrll break; 2172 1.9.2.2 skrll } 2173 1.9.2.2 skrll } 2174 1.9.2.2 skrll if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 2175 1.9.2.2 skrll pfi_dynaddr_remove(&pa->addr); 2176 1.9.2.2 skrll pfi_detach_rule(pa->kif); 2177 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, pa); 2178 1.9.2.2 skrll error = EINVAL; 2179 1.9.2.2 skrll break; 2180 1.9.2.2 skrll } 2181 1.9.2.2 skrll TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 2182 1.9.2.2 skrll break; 2183 1.9.2.2 skrll } 2184 1.9.2.2 skrll 2185 1.9.2.2 skrll case DIOCGETADDRS: { 2186 1.9.2.2 skrll struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2187 1.9.2.2 skrll 2188 1.9.2.2 skrll pp->nr = 0; 2189 1.9.2.2 skrll s = splsoftnet(); 2190 1.9.2.6 skrll pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2191 1.9.2.6 skrll pp->r_num, 0, 1, 0); 2192 1.9.2.2 skrll if (pool == NULL) { 2193 1.9.2.2 skrll error = EBUSY; 2194 1.9.2.2 skrll splx(s); 2195 1.9.2.2 skrll break; 2196 1.9.2.2 skrll } 2197 1.9.2.2 skrll TAILQ_FOREACH(pa, &pool->list, entries) 2198 1.9.2.2 skrll pp->nr++; 2199 1.9.2.2 skrll splx(s); 2200 1.9.2.2 skrll break; 2201 1.9.2.2 skrll } 2202 1.9.2.2 skrll 2203 1.9.2.2 skrll case DIOCGETADDR: { 2204 1.9.2.2 skrll struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2205 1.9.2.2 skrll u_int32_t nr = 0; 2206 1.9.2.2 skrll 2207 1.9.2.2 skrll s = splsoftnet(); 2208 1.9.2.6 skrll pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2209 1.9.2.6 skrll pp->r_num, 0, 1, 1); 2210 1.9.2.2 skrll if (pool == NULL) { 2211 1.9.2.2 skrll error = EBUSY; 2212 1.9.2.2 skrll splx(s); 2213 1.9.2.2 skrll break; 2214 1.9.2.2 skrll } 2215 1.9.2.2 skrll pa = TAILQ_FIRST(&pool->list); 2216 1.9.2.2 skrll while ((pa != NULL) && (nr < pp->nr)) { 2217 1.9.2.2 skrll pa = TAILQ_NEXT(pa, entries); 2218 1.9.2.2 skrll nr++; 2219 1.9.2.2 skrll } 2220 1.9.2.2 skrll if (pa == NULL) { 2221 1.9.2.2 skrll error = EBUSY; 2222 1.9.2.2 skrll splx(s); 2223 1.9.2.2 skrll break; 2224 1.9.2.2 skrll } 2225 1.9.2.2 skrll bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2226 1.9.2.2 skrll pfi_dynaddr_copyout(&pp->addr.addr); 2227 1.9.2.2 skrll pf_tbladdr_copyout(&pp->addr.addr); 2228 1.9.2.2 skrll splx(s); 2229 1.9.2.2 skrll break; 2230 1.9.2.2 skrll } 2231 1.9.2.2 skrll 2232 1.9.2.2 skrll case DIOCCHANGEADDR: { 2233 1.9.2.2 skrll struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2234 1.9.2.2 skrll struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2235 1.9.2.2 skrll struct pf_ruleset *ruleset; 2236 1.9.2.2 skrll 2237 1.9.2.2 skrll if (pca->action < PF_CHANGE_ADD_HEAD || 2238 1.9.2.2 skrll pca->action > PF_CHANGE_REMOVE) { 2239 1.9.2.2 skrll error = EINVAL; 2240 1.9.2.2 skrll break; 2241 1.9.2.2 skrll } 2242 1.9.2.2 skrll if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2243 1.9.2.2 skrll pca->addr.addr.type != PF_ADDR_DYNIFTL && 2244 1.9.2.2 skrll pca->addr.addr.type != PF_ADDR_TABLE) { 2245 1.9.2.2 skrll error = EINVAL; 2246 1.9.2.2 skrll break; 2247 1.9.2.2 skrll } 2248 1.9.2.2 skrll 2249 1.9.2.6 skrll ruleset = pf_find_ruleset(pca->anchor); 2250 1.9.2.2 skrll if (ruleset == NULL) { 2251 1.9.2.2 skrll error = EBUSY; 2252 1.9.2.2 skrll break; 2253 1.9.2.2 skrll } 2254 1.9.2.6 skrll pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2255 1.9.2.6 skrll pca->r_num, pca->r_last, 1, 1); 2256 1.9.2.2 skrll if (pool == NULL) { 2257 1.9.2.2 skrll error = EBUSY; 2258 1.9.2.2 skrll break; 2259 1.9.2.2 skrll } 2260 1.9.2.2 skrll if (pca->action != PF_CHANGE_REMOVE) { 2261 1.9.2.2 skrll newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2262 1.9.2.2 skrll if (newpa == NULL) { 2263 1.9.2.2 skrll error = ENOMEM; 2264 1.9.2.2 skrll break; 2265 1.9.2.2 skrll } 2266 1.9.2.2 skrll bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2267 1.9.2.2 skrll #ifndef INET 2268 1.9.2.2 skrll if (pca->af == AF_INET) { 2269 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, newpa); 2270 1.9.2.2 skrll error = EAFNOSUPPORT; 2271 1.9.2.2 skrll break; 2272 1.9.2.2 skrll } 2273 1.9.2.2 skrll #endif /* INET */ 2274 1.9.2.2 skrll #ifndef INET6 2275 1.9.2.2 skrll if (pca->af == AF_INET6) { 2276 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, newpa); 2277 1.9.2.2 skrll error = EAFNOSUPPORT; 2278 1.9.2.2 skrll break; 2279 1.9.2.2 skrll } 2280 1.9.2.2 skrll #endif /* INET6 */ 2281 1.9.2.2 skrll if (newpa->ifname[0]) { 2282 1.9.2.2 skrll newpa->kif = pfi_attach_rule(newpa->ifname); 2283 1.9.2.2 skrll if (newpa->kif == NULL) { 2284 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, newpa); 2285 1.9.2.2 skrll error = EINVAL; 2286 1.9.2.2 skrll break; 2287 1.9.2.2 skrll } 2288 1.9.2.2 skrll } else 2289 1.9.2.2 skrll newpa->kif = NULL; 2290 1.9.2.2 skrll if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2291 1.9.2.2 skrll pf_tbladdr_setup(ruleset, &newpa->addr)) { 2292 1.9.2.2 skrll pfi_dynaddr_remove(&newpa->addr); 2293 1.9.2.2 skrll pfi_detach_rule(newpa->kif); 2294 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, newpa); 2295 1.9.2.2 skrll error = EINVAL; 2296 1.9.2.2 skrll break; 2297 1.9.2.2 skrll } 2298 1.9.2.2 skrll } 2299 1.9.2.2 skrll 2300 1.9.2.2 skrll s = splsoftnet(); 2301 1.9.2.2 skrll 2302 1.9.2.2 skrll if (pca->action == PF_CHANGE_ADD_HEAD) 2303 1.9.2.2 skrll oldpa = TAILQ_FIRST(&pool->list); 2304 1.9.2.2 skrll else if (pca->action == PF_CHANGE_ADD_TAIL) 2305 1.9.2.2 skrll oldpa = TAILQ_LAST(&pool->list, pf_palist); 2306 1.9.2.2 skrll else { 2307 1.9.2.2 skrll int i = 0; 2308 1.9.2.2 skrll 2309 1.9.2.2 skrll oldpa = TAILQ_FIRST(&pool->list); 2310 1.9.2.2 skrll while ((oldpa != NULL) && (i < pca->nr)) { 2311 1.9.2.2 skrll oldpa = TAILQ_NEXT(oldpa, entries); 2312 1.9.2.2 skrll i++; 2313 1.9.2.2 skrll } 2314 1.9.2.2 skrll if (oldpa == NULL) { 2315 1.9.2.2 skrll error = EINVAL; 2316 1.9.2.2 skrll splx(s); 2317 1.9.2.2 skrll break; 2318 1.9.2.2 skrll } 2319 1.9.2.2 skrll } 2320 1.9.2.2 skrll 2321 1.9.2.2 skrll if (pca->action == PF_CHANGE_REMOVE) { 2322 1.9.2.2 skrll TAILQ_REMOVE(&pool->list, oldpa, entries); 2323 1.9.2.2 skrll pfi_dynaddr_remove(&oldpa->addr); 2324 1.9.2.2 skrll pf_tbladdr_remove(&oldpa->addr); 2325 1.9.2.2 skrll pfi_detach_rule(oldpa->kif); 2326 1.9.2.2 skrll pool_put(&pf_pooladdr_pl, oldpa); 2327 1.9.2.2 skrll } else { 2328 1.9.2.2 skrll if (oldpa == NULL) 2329 1.9.2.2 skrll TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2330 1.9.2.2 skrll else if (pca->action == PF_CHANGE_ADD_HEAD || 2331 1.9.2.2 skrll pca->action == PF_CHANGE_ADD_BEFORE) 2332 1.9.2.2 skrll TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2333 1.9.2.2 skrll else 2334 1.9.2.2 skrll TAILQ_INSERT_AFTER(&pool->list, oldpa, 2335 1.9.2.2 skrll newpa, entries); 2336 1.9.2.2 skrll } 2337 1.9.2.2 skrll 2338 1.9.2.2 skrll pool->cur = TAILQ_FIRST(&pool->list); 2339 1.9.2.2 skrll PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2340 1.9.2.2 skrll pca->af); 2341 1.9.2.2 skrll splx(s); 2342 1.9.2.2 skrll break; 2343 1.9.2.2 skrll } 2344 1.9.2.2 skrll 2345 1.9.2.2 skrll case DIOCGETRULESETS: { 2346 1.9.2.2 skrll struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2347 1.9.2.2 skrll struct pf_ruleset *ruleset; 2348 1.9.2.6 skrll struct pf_anchor *anchor; 2349 1.9.2.2 skrll 2350 1.9.2.6 skrll pr->path[sizeof(pr->path) - 1] = 0; 2351 1.9.2.6 skrll if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2352 1.9.2.2 skrll error = EINVAL; 2353 1.9.2.2 skrll break; 2354 1.9.2.2 skrll } 2355 1.9.2.2 skrll pr->nr = 0; 2356 1.9.2.6 skrll if (ruleset->anchor == NULL) { 2357 1.9.2.6 skrll /* XXX kludge for pf_main_ruleset */ 2358 1.9.2.6 skrll RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2359 1.9.2.6 skrll if (anchor->parent == NULL) 2360 1.9.2.6 skrll pr->nr++; 2361 1.9.2.6 skrll } else { 2362 1.9.2.6 skrll RB_FOREACH(anchor, pf_anchor_node, 2363 1.9.2.6 skrll &ruleset->anchor->children) 2364 1.9.2.6 skrll pr->nr++; 2365 1.9.2.6 skrll } 2366 1.9.2.2 skrll break; 2367 1.9.2.2 skrll } 2368 1.9.2.2 skrll 2369 1.9.2.2 skrll case DIOCGETRULESET: { 2370 1.9.2.2 skrll struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2371 1.9.2.2 skrll struct pf_ruleset *ruleset; 2372 1.9.2.6 skrll struct pf_anchor *anchor; 2373 1.9.2.2 skrll u_int32_t nr = 0; 2374 1.9.2.2 skrll 2375 1.9.2.6 skrll pr->path[sizeof(pr->path) - 1] = 0; 2376 1.9.2.6 skrll if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2377 1.9.2.2 skrll error = EINVAL; 2378 1.9.2.2 skrll break; 2379 1.9.2.2 skrll } 2380 1.9.2.6 skrll pr->name[0] = 0; 2381 1.9.2.6 skrll if (ruleset->anchor == NULL) { 2382 1.9.2.6 skrll /* XXX kludge for pf_main_ruleset */ 2383 1.9.2.6 skrll RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2384 1.9.2.6 skrll if (anchor->parent == NULL && nr++ == pr->nr) { 2385 1.9.2.6 skrll strlcpy(pr->name, anchor->name, 2386 1.9.2.6 skrll sizeof(pr->name)); 2387 1.9.2.6 skrll break; 2388 1.9.2.6 skrll } 2389 1.9.2.6 skrll } else { 2390 1.9.2.6 skrll RB_FOREACH(anchor, pf_anchor_node, 2391 1.9.2.6 skrll &ruleset->anchor->children) 2392 1.9.2.6 skrll if (nr++ == pr->nr) { 2393 1.9.2.6 skrll strlcpy(pr->name, anchor->name, 2394 1.9.2.6 skrll sizeof(pr->name)); 2395 1.9.2.6 skrll break; 2396 1.9.2.6 skrll } 2397 1.9.2.2 skrll } 2398 1.9.2.6 skrll if (!pr->name[0]) 2399 1.9.2.2 skrll error = EBUSY; 2400 1.9.2.2 skrll break; 2401 1.9.2.2 skrll } 2402 1.9.2.2 skrll 2403 1.9.2.2 skrll case DIOCRCLRTABLES: { 2404 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2405 1.9.2.2 skrll 2406 1.9.2.2 skrll if (io->pfrio_esize != 0) { 2407 1.9.2.2 skrll error = ENODEV; 2408 1.9.2.2 skrll break; 2409 1.9.2.2 skrll } 2410 1.9.2.2 skrll error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2411 1.9.2.2 skrll io->pfrio_flags | PFR_FLAG_USERIOCTL); 2412 1.9.2.2 skrll break; 2413 1.9.2.2 skrll } 2414 1.9.2.2 skrll 2415 1.9.2.2 skrll case DIOCRADDTABLES: { 2416 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2417 1.9.2.2 skrll 2418 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_table)) { 2419 1.9.2.2 skrll error = ENODEV; 2420 1.9.2.2 skrll break; 2421 1.9.2.2 skrll } 2422 1.9.2.2 skrll error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2423 1.9.2.2 skrll &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2424 1.9.2.2 skrll break; 2425 1.9.2.2 skrll } 2426 1.9.2.2 skrll 2427 1.9.2.2 skrll case DIOCRDELTABLES: { 2428 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2429 1.9.2.2 skrll 2430 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_table)) { 2431 1.9.2.2 skrll error = ENODEV; 2432 1.9.2.2 skrll break; 2433 1.9.2.2 skrll } 2434 1.9.2.2 skrll error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2435 1.9.2.2 skrll &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2436 1.9.2.2 skrll break; 2437 1.9.2.2 skrll } 2438 1.9.2.2 skrll 2439 1.9.2.2 skrll case DIOCRGETTABLES: { 2440 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2441 1.9.2.2 skrll 2442 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_table)) { 2443 1.9.2.2 skrll error = ENODEV; 2444 1.9.2.2 skrll break; 2445 1.9.2.2 skrll } 2446 1.9.2.2 skrll error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2447 1.9.2.2 skrll &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2448 1.9.2.2 skrll break; 2449 1.9.2.2 skrll } 2450 1.9.2.2 skrll 2451 1.9.2.2 skrll case DIOCRGETTSTATS: { 2452 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2453 1.9.2.2 skrll 2454 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2455 1.9.2.2 skrll error = ENODEV; 2456 1.9.2.2 skrll break; 2457 1.9.2.2 skrll } 2458 1.9.2.2 skrll error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2459 1.9.2.2 skrll &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2460 1.9.2.2 skrll break; 2461 1.9.2.2 skrll } 2462 1.9.2.2 skrll 2463 1.9.2.2 skrll case DIOCRCLRTSTATS: { 2464 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2465 1.9.2.2 skrll 2466 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_table)) { 2467 1.9.2.2 skrll error = ENODEV; 2468 1.9.2.2 skrll break; 2469 1.9.2.2 skrll } 2470 1.9.2.2 skrll error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2471 1.9.2.2 skrll &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2472 1.9.2.2 skrll break; 2473 1.9.2.2 skrll } 2474 1.9.2.2 skrll 2475 1.9.2.2 skrll case DIOCRSETTFLAGS: { 2476 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2477 1.9.2.2 skrll 2478 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_table)) { 2479 1.9.2.2 skrll error = ENODEV; 2480 1.9.2.2 skrll break; 2481 1.9.2.2 skrll } 2482 1.9.2.2 skrll error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2483 1.9.2.2 skrll io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2484 1.9.2.2 skrll &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2485 1.9.2.2 skrll break; 2486 1.9.2.2 skrll } 2487 1.9.2.2 skrll 2488 1.9.2.2 skrll case DIOCRCLRADDRS: { 2489 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2490 1.9.2.2 skrll 2491 1.9.2.2 skrll if (io->pfrio_esize != 0) { 2492 1.9.2.2 skrll error = ENODEV; 2493 1.9.2.2 skrll break; 2494 1.9.2.2 skrll } 2495 1.9.2.2 skrll error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2496 1.9.2.2 skrll io->pfrio_flags | PFR_FLAG_USERIOCTL); 2497 1.9.2.2 skrll break; 2498 1.9.2.2 skrll } 2499 1.9.2.2 skrll 2500 1.9.2.2 skrll case DIOCRADDADDRS: { 2501 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2502 1.9.2.2 skrll 2503 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2504 1.9.2.2 skrll error = ENODEV; 2505 1.9.2.2 skrll break; 2506 1.9.2.2 skrll } 2507 1.9.2.2 skrll error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2508 1.9.2.2 skrll io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2509 1.9.2.2 skrll PFR_FLAG_USERIOCTL); 2510 1.9.2.2 skrll break; 2511 1.9.2.2 skrll } 2512 1.9.2.2 skrll 2513 1.9.2.2 skrll case DIOCRDELADDRS: { 2514 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2515 1.9.2.2 skrll 2516 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2517 1.9.2.2 skrll error = ENODEV; 2518 1.9.2.2 skrll break; 2519 1.9.2.2 skrll } 2520 1.9.2.2 skrll error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2521 1.9.2.2 skrll io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2522 1.9.2.2 skrll PFR_FLAG_USERIOCTL); 2523 1.9.2.2 skrll break; 2524 1.9.2.2 skrll } 2525 1.9.2.2 skrll 2526 1.9.2.2 skrll case DIOCRSETADDRS: { 2527 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2528 1.9.2.2 skrll 2529 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2530 1.9.2.2 skrll error = ENODEV; 2531 1.9.2.2 skrll break; 2532 1.9.2.2 skrll } 2533 1.9.2.2 skrll error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2534 1.9.2.2 skrll io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2535 1.9.2.2 skrll &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2536 1.9.2.2 skrll PFR_FLAG_USERIOCTL); 2537 1.9.2.2 skrll break; 2538 1.9.2.2 skrll } 2539 1.9.2.2 skrll 2540 1.9.2.2 skrll case DIOCRGETADDRS: { 2541 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2542 1.9.2.2 skrll 2543 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2544 1.9.2.2 skrll error = ENODEV; 2545 1.9.2.2 skrll break; 2546 1.9.2.2 skrll } 2547 1.9.2.2 skrll error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2548 1.9.2.2 skrll &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2549 1.9.2.2 skrll break; 2550 1.9.2.2 skrll } 2551 1.9.2.2 skrll 2552 1.9.2.2 skrll case DIOCRGETASTATS: { 2553 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2554 1.9.2.2 skrll 2555 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2556 1.9.2.2 skrll error = ENODEV; 2557 1.9.2.2 skrll break; 2558 1.9.2.2 skrll } 2559 1.9.2.2 skrll error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2560 1.9.2.2 skrll &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2561 1.9.2.2 skrll break; 2562 1.9.2.2 skrll } 2563 1.9.2.2 skrll 2564 1.9.2.2 skrll case DIOCRCLRASTATS: { 2565 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2566 1.9.2.2 skrll 2567 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2568 1.9.2.2 skrll error = ENODEV; 2569 1.9.2.2 skrll break; 2570 1.9.2.2 skrll } 2571 1.9.2.2 skrll error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2572 1.9.2.2 skrll io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2573 1.9.2.2 skrll PFR_FLAG_USERIOCTL); 2574 1.9.2.2 skrll break; 2575 1.9.2.2 skrll } 2576 1.9.2.2 skrll 2577 1.9.2.2 skrll case DIOCRTSTADDRS: { 2578 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2579 1.9.2.2 skrll 2580 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2581 1.9.2.2 skrll error = ENODEV; 2582 1.9.2.2 skrll break; 2583 1.9.2.2 skrll } 2584 1.9.2.2 skrll error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2585 1.9.2.2 skrll io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2586 1.9.2.2 skrll PFR_FLAG_USERIOCTL); 2587 1.9.2.2 skrll break; 2588 1.9.2.2 skrll } 2589 1.9.2.2 skrll 2590 1.9.2.2 skrll case DIOCRINADEFINE: { 2591 1.9.2.2 skrll struct pfioc_table *io = (struct pfioc_table *)addr; 2592 1.9.2.2 skrll 2593 1.9.2.2 skrll if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2594 1.9.2.2 skrll error = ENODEV; 2595 1.9.2.2 skrll break; 2596 1.9.2.2 skrll } 2597 1.9.2.2 skrll error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2598 1.9.2.2 skrll io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2599 1.9.2.2 skrll io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2600 1.9.2.2 skrll break; 2601 1.9.2.2 skrll } 2602 1.9.2.2 skrll 2603 1.9.2.2 skrll case DIOCOSFPADD: { 2604 1.9.2.2 skrll struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2605 1.9.2.2 skrll s = splsoftnet(); 2606 1.9.2.2 skrll error = pf_osfp_add(io); 2607 1.9.2.2 skrll splx(s); 2608 1.9.2.2 skrll break; 2609 1.9.2.2 skrll } 2610 1.9.2.2 skrll 2611 1.9.2.2 skrll case DIOCOSFPGET: { 2612 1.9.2.2 skrll struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2613 1.9.2.2 skrll s = splsoftnet(); 2614 1.9.2.2 skrll error = pf_osfp_get(io); 2615 1.9.2.2 skrll splx(s); 2616 1.9.2.2 skrll break; 2617 1.9.2.2 skrll } 2618 1.9.2.2 skrll 2619 1.9.2.2 skrll case DIOCXBEGIN: { 2620 1.9.2.6 skrll struct pfioc_trans *io = (struct pfioc_trans *) 2621 1.9.2.6 skrll addr; 2622 1.9.2.6 skrll static struct pfioc_trans_e ioe; 2623 1.9.2.6 skrll static struct pfr_table table; 2624 1.9.2.6 skrll int i; 2625 1.9.2.2 skrll 2626 1.9.2.2 skrll if (io->esize != sizeof(ioe)) { 2627 1.9.2.2 skrll error = ENODEV; 2628 1.9.2.2 skrll goto fail; 2629 1.9.2.2 skrll } 2630 1.9.2.2 skrll for (i = 0; i < io->size; i++) { 2631 1.9.2.2 skrll if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2632 1.9.2.2 skrll error = EFAULT; 2633 1.9.2.2 skrll goto fail; 2634 1.9.2.2 skrll } 2635 1.9.2.2 skrll switch (ioe.rs_num) { 2636 1.9.2.2 skrll #ifdef ALTQ 2637 1.9.2.2 skrll case PF_RULESET_ALTQ: 2638 1.9.2.6 skrll if (ioe.anchor[0]) { 2639 1.9.2.2 skrll error = EINVAL; 2640 1.9.2.2 skrll goto fail; 2641 1.9.2.2 skrll } 2642 1.9.2.2 skrll if ((error = pf_begin_altq(&ioe.ticket))) 2643 1.9.2.2 skrll goto fail; 2644 1.9.2.2 skrll break; 2645 1.9.2.2 skrll #endif /* ALTQ */ 2646 1.9.2.2 skrll case PF_RULESET_TABLE: 2647 1.9.2.2 skrll bzero(&table, sizeof(table)); 2648 1.9.2.2 skrll strlcpy(table.pfrt_anchor, ioe.anchor, 2649 1.9.2.2 skrll sizeof(table.pfrt_anchor)); 2650 1.9.2.2 skrll if ((error = pfr_ina_begin(&table, 2651 1.9.2.2 skrll &ioe.ticket, NULL, 0))) 2652 1.9.2.2 skrll goto fail; 2653 1.9.2.2 skrll break; 2654 1.9.2.2 skrll default: 2655 1.9.2.2 skrll if ((error = pf_begin_rules(&ioe.ticket, 2656 1.9.2.6 skrll ioe.rs_num, ioe.anchor))) 2657 1.9.2.2 skrll goto fail; 2658 1.9.2.2 skrll break; 2659 1.9.2.2 skrll } 2660 1.9.2.2 skrll if (copyout(&ioe, io->array+i, sizeof(io->array[i]))) { 2661 1.9.2.2 skrll error = EFAULT; 2662 1.9.2.2 skrll goto fail; 2663 1.9.2.2 skrll } 2664 1.9.2.2 skrll } 2665 1.9.2.2 skrll break; 2666 1.9.2.2 skrll } 2667 1.9.2.2 skrll 2668 1.9.2.2 skrll case DIOCXROLLBACK: { 2669 1.9.2.6 skrll struct pfioc_trans *io = (struct pfioc_trans *) 2670 1.9.2.6 skrll addr; 2671 1.9.2.6 skrll static struct pfioc_trans_e ioe; 2672 1.9.2.6 skrll static struct pfr_table table; 2673 1.9.2.6 skrll int i; 2674 1.9.2.2 skrll 2675 1.9.2.2 skrll if (io->esize != sizeof(ioe)) { 2676 1.9.2.2 skrll error = ENODEV; 2677 1.9.2.2 skrll goto fail; 2678 1.9.2.2 skrll } 2679 1.9.2.2 skrll for (i = 0; i < io->size; i++) { 2680 1.9.2.2 skrll if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2681 1.9.2.2 skrll error = EFAULT; 2682 1.9.2.2 skrll goto fail; 2683 1.9.2.2 skrll } 2684 1.9.2.2 skrll switch (ioe.rs_num) { 2685 1.9.2.2 skrll #ifdef ALTQ 2686 1.9.2.2 skrll case PF_RULESET_ALTQ: 2687 1.9.2.6 skrll if (ioe.anchor[0]) { 2688 1.9.2.2 skrll error = EINVAL; 2689 1.9.2.2 skrll goto fail; 2690 1.9.2.2 skrll } 2691 1.9.2.2 skrll if ((error = pf_rollback_altq(ioe.ticket))) 2692 1.9.2.2 skrll goto fail; /* really bad */ 2693 1.9.2.2 skrll break; 2694 1.9.2.2 skrll #endif /* ALTQ */ 2695 1.9.2.2 skrll case PF_RULESET_TABLE: 2696 1.9.2.2 skrll bzero(&table, sizeof(table)); 2697 1.9.2.2 skrll strlcpy(table.pfrt_anchor, ioe.anchor, 2698 1.9.2.2 skrll sizeof(table.pfrt_anchor)); 2699 1.9.2.2 skrll if ((error = pfr_ina_rollback(&table, 2700 1.9.2.2 skrll ioe.ticket, NULL, 0))) 2701 1.9.2.2 skrll goto fail; /* really bad */ 2702 1.9.2.2 skrll break; 2703 1.9.2.2 skrll default: 2704 1.9.2.2 skrll if ((error = pf_rollback_rules(ioe.ticket, 2705 1.9.2.6 skrll ioe.rs_num, ioe.anchor))) 2706 1.9.2.2 skrll goto fail; /* really bad */ 2707 1.9.2.2 skrll break; 2708 1.9.2.2 skrll } 2709 1.9.2.2 skrll } 2710 1.9.2.2 skrll break; 2711 1.9.2.2 skrll } 2712 1.9.2.2 skrll 2713 1.9.2.2 skrll case DIOCXCOMMIT: { 2714 1.9.2.6 skrll struct pfioc_trans *io = (struct pfioc_trans *) 2715 1.9.2.6 skrll addr; 2716 1.9.2.6 skrll static struct pfioc_trans_e ioe; 2717 1.9.2.6 skrll static struct pfr_table table; 2718 1.9.2.6 skrll struct pf_ruleset *rs; 2719 1.9.2.6 skrll int i; 2720 1.9.2.2 skrll 2721 1.9.2.2 skrll if (io->esize != sizeof(ioe)) { 2722 1.9.2.2 skrll error = ENODEV; 2723 1.9.2.2 skrll goto fail; 2724 1.9.2.2 skrll } 2725 1.9.2.2 skrll /* first makes sure everything will succeed */ 2726 1.9.2.2 skrll for (i = 0; i < io->size; i++) { 2727 1.9.2.2 skrll if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2728 1.9.2.2 skrll error = EFAULT; 2729 1.9.2.2 skrll goto fail; 2730 1.9.2.2 skrll } 2731 1.9.2.2 skrll switch (ioe.rs_num) { 2732 1.9.2.2 skrll #ifdef ALTQ 2733 1.9.2.2 skrll case PF_RULESET_ALTQ: 2734 1.9.2.6 skrll if (ioe.anchor[0]) { 2735 1.9.2.2 skrll error = EINVAL; 2736 1.9.2.2 skrll goto fail; 2737 1.9.2.2 skrll } 2738 1.9.2.2 skrll if (!altqs_inactive_open || ioe.ticket != 2739 1.9.2.2 skrll ticket_altqs_inactive) { 2740 1.9.2.2 skrll error = EBUSY; 2741 1.9.2.2 skrll goto fail; 2742 1.9.2.2 skrll } 2743 1.9.2.2 skrll break; 2744 1.9.2.2 skrll #endif /* ALTQ */ 2745 1.9.2.2 skrll case PF_RULESET_TABLE: 2746 1.9.2.6 skrll rs = pf_find_ruleset(ioe.anchor); 2747 1.9.2.2 skrll if (rs == NULL || !rs->topen || ioe.ticket != 2748 1.9.2.2 skrll rs->tticket) { 2749 1.9.2.2 skrll error = EBUSY; 2750 1.9.2.2 skrll goto fail; 2751 1.9.2.2 skrll } 2752 1.9.2.2 skrll break; 2753 1.9.2.2 skrll default: 2754 1.9.2.2 skrll if (ioe.rs_num < 0 || ioe.rs_num >= 2755 1.9.2.2 skrll PF_RULESET_MAX) { 2756 1.9.2.2 skrll error = EINVAL; 2757 1.9.2.2 skrll goto fail; 2758 1.9.2.2 skrll } 2759 1.9.2.6 skrll rs = pf_find_ruleset(ioe.anchor); 2760 1.9.2.2 skrll if (rs == NULL || 2761 1.9.2.2 skrll !rs->rules[ioe.rs_num].inactive.open || 2762 1.9.2.2 skrll rs->rules[ioe.rs_num].inactive.ticket != 2763 1.9.2.2 skrll ioe.ticket) { 2764 1.9.2.2 skrll error = EBUSY; 2765 1.9.2.2 skrll goto fail; 2766 1.9.2.2 skrll } 2767 1.9.2.2 skrll break; 2768 1.9.2.2 skrll } 2769 1.9.2.2 skrll } 2770 1.9.2.2 skrll /* now do the commit - no errors should happen here */ 2771 1.9.2.2 skrll for (i = 0; i < io->size; i++) { 2772 1.9.2.2 skrll if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2773 1.9.2.2 skrll error = EFAULT; 2774 1.9.2.2 skrll goto fail; 2775 1.9.2.2 skrll } 2776 1.9.2.2 skrll switch (ioe.rs_num) { 2777 1.9.2.2 skrll #ifdef ALTQ 2778 1.9.2.2 skrll case PF_RULESET_ALTQ: 2779 1.9.2.2 skrll if ((error = pf_commit_altq(ioe.ticket))) 2780 1.9.2.2 skrll goto fail; /* really bad */ 2781 1.9.2.2 skrll break; 2782 1.9.2.2 skrll #endif /* ALTQ */ 2783 1.9.2.2 skrll case PF_RULESET_TABLE: 2784 1.9.2.2 skrll bzero(&table, sizeof(table)); 2785 1.9.2.2 skrll strlcpy(table.pfrt_anchor, ioe.anchor, 2786 1.9.2.2 skrll sizeof(table.pfrt_anchor)); 2787 1.9.2.2 skrll if ((error = pfr_ina_commit(&table, ioe.ticket, 2788 1.9.2.2 skrll NULL, NULL, 0))) 2789 1.9.2.2 skrll goto fail; /* really bad */ 2790 1.9.2.2 skrll break; 2791 1.9.2.2 skrll default: 2792 1.9.2.2 skrll if ((error = pf_commit_rules(ioe.ticket, 2793 1.9.2.6 skrll ioe.rs_num, ioe.anchor))) 2794 1.9.2.2 skrll goto fail; /* really bad */ 2795 1.9.2.2 skrll break; 2796 1.9.2.2 skrll } 2797 1.9.2.2 skrll } 2798 1.9.2.2 skrll break; 2799 1.9.2.2 skrll } 2800 1.9.2.2 skrll 2801 1.9.2.2 skrll case DIOCGETSRCNODES: { 2802 1.9.2.2 skrll struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 2803 1.9.2.2 skrll struct pf_src_node *n; 2804 1.9.2.2 skrll struct pf_src_node *p, pstore; 2805 1.9.2.2 skrll u_int32_t nr = 0; 2806 1.9.2.2 skrll int space = psn->psn_len; 2807 1.9.2.2 skrll 2808 1.9.2.2 skrll if (space == 0) { 2809 1.9.2.2 skrll s = splsoftnet(); 2810 1.9.2.2 skrll RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 2811 1.9.2.2 skrll nr++; 2812 1.9.2.2 skrll splx(s); 2813 1.9.2.2 skrll psn->psn_len = sizeof(struct pf_src_node) * nr; 2814 1.9.2.2 skrll return (0); 2815 1.9.2.2 skrll } 2816 1.9.2.2 skrll 2817 1.9.2.2 skrll s = splsoftnet(); 2818 1.9.2.2 skrll p = psn->psn_src_nodes; 2819 1.9.2.2 skrll RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2820 1.9.2.6 skrll int secs = time_second; 2821 1.9.2.2 skrll 2822 1.9.2.2 skrll if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 2823 1.9.2.2 skrll break; 2824 1.9.2.2 skrll 2825 1.9.2.2 skrll bcopy(n, &pstore, sizeof(pstore)); 2826 1.9.2.2 skrll if (n->rule.ptr != NULL) 2827 1.9.2.2 skrll pstore.rule.nr = n->rule.ptr->nr; 2828 1.9.2.2 skrll pstore.creation = secs - pstore.creation; 2829 1.9.2.2 skrll if (pstore.expire > secs) 2830 1.9.2.2 skrll pstore.expire -= secs; 2831 1.9.2.2 skrll else 2832 1.9.2.2 skrll pstore.expire = 0; 2833 1.9.2.2 skrll error = copyout(&pstore, p, sizeof(*p)); 2834 1.9.2.2 skrll if (error) { 2835 1.9.2.2 skrll splx(s); 2836 1.9.2.2 skrll goto fail; 2837 1.9.2.2 skrll } 2838 1.9.2.2 skrll p++; 2839 1.9.2.2 skrll nr++; 2840 1.9.2.2 skrll } 2841 1.9.2.2 skrll psn->psn_len = sizeof(struct pf_src_node) * nr; 2842 1.9.2.2 skrll splx(s); 2843 1.9.2.2 skrll break; 2844 1.9.2.2 skrll } 2845 1.9.2.2 skrll 2846 1.9.2.2 skrll case DIOCCLRSRCNODES: { 2847 1.9.2.2 skrll struct pf_src_node *n; 2848 1.9.2.2 skrll struct pf_state *state; 2849 1.9.2.2 skrll 2850 1.9.2.2 skrll s = splsoftnet(); 2851 1.9.2.2 skrll RB_FOREACH(state, pf_state_tree_id, &tree_id) { 2852 1.9.2.2 skrll state->src_node = NULL; 2853 1.9.2.2 skrll state->nat_src_node = NULL; 2854 1.9.2.2 skrll } 2855 1.9.2.2 skrll RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2856 1.9.2.2 skrll n->expire = 1; 2857 1.9.2.2 skrll n->states = 0; 2858 1.9.2.2 skrll } 2859 1.9.2.2 skrll pf_purge_expired_src_nodes(); 2860 1.9.2.2 skrll pf_status.src_nodes = 0; 2861 1.9.2.2 skrll splx(s); 2862 1.9.2.2 skrll break; 2863 1.9.2.2 skrll } 2864 1.9.2.2 skrll 2865 1.9.2.2 skrll case DIOCSETHOSTID: { 2866 1.9.2.2 skrll u_int32_t *hostid = (u_int32_t *)addr; 2867 1.9.2.2 skrll 2868 1.9.2.2 skrll if (*hostid == 0) { 2869 1.9.2.2 skrll error = EINVAL; 2870 1.9.2.2 skrll goto fail; 2871 1.9.2.2 skrll } 2872 1.9.2.2 skrll pf_status.hostid = *hostid; 2873 1.9.2.2 skrll break; 2874 1.9.2.2 skrll } 2875 1.9.2.2 skrll 2876 1.9.2.2 skrll case DIOCOSFPFLUSH: 2877 1.9.2.2 skrll s = splsoftnet(); 2878 1.9.2.2 skrll pf_osfp_flush(); 2879 1.9.2.2 skrll splx(s); 2880 1.9.2.2 skrll break; 2881 1.9.2.2 skrll 2882 1.9.2.2 skrll case DIOCIGETIFACES: { 2883 1.9.2.2 skrll struct pfioc_iface *io = (struct pfioc_iface *)addr; 2884 1.9.2.2 skrll 2885 1.9.2.2 skrll if (io->pfiio_esize != sizeof(struct pfi_if)) { 2886 1.9.2.2 skrll error = ENODEV; 2887 1.9.2.2 skrll break; 2888 1.9.2.2 skrll } 2889 1.9.2.2 skrll error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 2890 1.9.2.2 skrll &io->pfiio_size, io->pfiio_flags); 2891 1.9.2.2 skrll break; 2892 1.9.2.2 skrll } 2893 1.9.2.2 skrll 2894 1.9.2.2 skrll case DIOCICLRISTATS: { 2895 1.9.2.2 skrll struct pfioc_iface *io = (struct pfioc_iface *)addr; 2896 1.9.2.2 skrll 2897 1.9.2.2 skrll error = pfi_clr_istats(io->pfiio_name, &io->pfiio_nzero, 2898 1.9.2.2 skrll io->pfiio_flags); 2899 1.9.2.2 skrll break; 2900 1.9.2.2 skrll } 2901 1.9.2.2 skrll 2902 1.9.2.2 skrll default: 2903 1.9.2.2 skrll error = ENODEV; 2904 1.9.2.2 skrll break; 2905 1.9.2.2 skrll } 2906 1.9.2.2 skrll fail: 2907 1.9.2.2 skrll 2908 1.9.2.2 skrll return (error); 2909 1.9.2.2 skrll } 2910 1.9.2.2 skrll 2911 1.9.2.2 skrll #ifdef __NetBSD__ 2912 1.9.2.2 skrll int 2913 1.9.2.2 skrll pfil4_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2914 1.9.2.2 skrll { 2915 1.9.2.4 skrll int error; 2916 1.9.2.4 skrll 2917 1.9.2.4 skrll /* 2918 1.9.2.4 skrll * ensure that mbufs are writable beforehand 2919 1.9.2.4 skrll * as it's assumed by pf code. 2920 1.9.2.4 skrll * ip hdr (60 bytes) + tcp hdr (60 bytes) should be enough. 2921 1.9.2.4 skrll * XXX inefficient 2922 1.9.2.4 skrll */ 2923 1.9.2.4 skrll error = m_makewritable(mp, 0, 60 + 60, M_DONTWAIT); 2924 1.9.2.4 skrll if (error) { 2925 1.9.2.4 skrll m_freem(*mp); 2926 1.9.2.4 skrll *mp = NULL; 2927 1.9.2.4 skrll return error; 2928 1.9.2.4 skrll } 2929 1.9.2.2 skrll 2930 1.9.2.2 skrll /* 2931 1.9.2.2 skrll * If the packet is out-bound, we can't delay checksums 2932 1.9.2.2 skrll * here. For in-bound, the checksum has already been 2933 1.9.2.2 skrll * validated. 2934 1.9.2.2 skrll */ 2935 1.9.2.2 skrll if (dir == PFIL_OUT) { 2936 1.9.2.2 skrll if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 2937 1.9.2.2 skrll in_delayed_cksum(*mp); 2938 1.9.2.2 skrll (*mp)->m_pkthdr.csum_flags &= 2939 1.9.2.2 skrll ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 2940 1.9.2.2 skrll } 2941 1.9.2.2 skrll } 2942 1.9.2.2 skrll 2943 1.9.2.6 skrll if (pf_test(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 2944 1.9.2.6 skrll != PF_PASS) { 2945 1.9.2.2 skrll m_freem(*mp); 2946 1.9.2.2 skrll *mp = NULL; 2947 1.9.2.2 skrll return EHOSTUNREACH; 2948 1.9.2.8 skrll } 2949 1.9.2.8 skrll 2950 1.9.2.8 skrll /* 2951 1.9.2.8 skrll * we're not compatible with fast-forward. 2952 1.9.2.8 skrll */ 2953 1.9.2.8 skrll 2954 1.9.2.8 skrll if (dir == PFIL_IN) { 2955 1.9.2.8 skrll (*mp)->m_flags &= ~M_CANFASTFWD; 2956 1.9.2.8 skrll } 2957 1.9.2.8 skrll 2958 1.9.2.8 skrll return (0); 2959 1.9.2.2 skrll } 2960 1.9.2.2 skrll 2961 1.9.2.2 skrll #ifdef INET6 2962 1.9.2.2 skrll int 2963 1.9.2.2 skrll pfil6_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2964 1.9.2.2 skrll { 2965 1.9.2.4 skrll int error; 2966 1.9.2.4 skrll 2967 1.9.2.4 skrll /* 2968 1.9.2.4 skrll * ensure that mbufs are writable beforehand 2969 1.9.2.4 skrll * as it's assumed by pf code. 2970 1.9.2.4 skrll * XXX inefficient 2971 1.9.2.4 skrll */ 2972 1.9.2.4 skrll error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 2973 1.9.2.4 skrll if (error) { 2974 1.9.2.4 skrll m_freem(*mp); 2975 1.9.2.4 skrll *mp = NULL; 2976 1.9.2.4 skrll return error; 2977 1.9.2.4 skrll } 2978 1.9.2.2 skrll 2979 1.9.2.6 skrll if (pf_test6(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 2980 1.9.2.6 skrll != PF_PASS) { 2981 1.9.2.2 skrll m_freem(*mp); 2982 1.9.2.2 skrll *mp = NULL; 2983 1.9.2.2 skrll return EHOSTUNREACH; 2984 1.9.2.2 skrll } else 2985 1.9.2.2 skrll return (0); 2986 1.9.2.2 skrll } 2987 1.9.2.2 skrll #endif 2988 1.9.2.2 skrll 2989 1.9.2.2 skrll int 2990 1.9.2.2 skrll pfil_ifnet_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2991 1.9.2.2 skrll { 2992 1.9.2.2 skrll u_long cmd = (u_long)mp; 2993 1.9.2.2 skrll 2994 1.9.2.2 skrll switch (cmd) { 2995 1.9.2.2 skrll case PFIL_IFNET_ATTACH: 2996 1.9.2.2 skrll pfi_attach_ifnet(ifp); 2997 1.9.2.2 skrll break; 2998 1.9.2.2 skrll case PFIL_IFNET_DETACH: 2999 1.9.2.2 skrll pfi_detach_ifnet(ifp); 3000 1.9.2.2 skrll break; 3001 1.9.2.2 skrll } 3002 1.9.2.2 skrll 3003 1.9.2.2 skrll return (0); 3004 1.9.2.2 skrll } 3005 1.9.2.2 skrll 3006 1.9.2.2 skrll int 3007 1.9.2.2 skrll pfil_ifaddr_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3008 1.9.2.2 skrll { 3009 1.9.2.2 skrll extern void pfi_kifaddr_update_if(struct ifnet *); 3010 1.9.2.2 skrll 3011 1.9.2.2 skrll u_long cmd = (u_long)mp; 3012 1.9.2.2 skrll 3013 1.9.2.2 skrll switch (cmd) { 3014 1.9.2.2 skrll case SIOCSIFADDR: 3015 1.9.2.2 skrll case SIOCAIFADDR: 3016 1.9.2.2 skrll case SIOCDIFADDR: 3017 1.9.2.2 skrll #ifdef INET6 3018 1.9.2.2 skrll case SIOCAIFADDR_IN6: 3019 1.9.2.2 skrll case SIOCDIFADDR_IN6: 3020 1.9.2.2 skrll #endif 3021 1.9.2.2 skrll pfi_kifaddr_update_if(ifp); 3022 1.9.2.2 skrll break; 3023 1.9.2.2 skrll default: 3024 1.9.2.2 skrll panic("unexpected ioctl"); 3025 1.9.2.2 skrll } 3026 1.9.2.2 skrll 3027 1.9.2.2 skrll return (0); 3028 1.9.2.2 skrll } 3029 1.9.2.2 skrll 3030 1.9.2.2 skrll static int 3031 1.9.2.2 skrll pf_pfil_attach(void) 3032 1.9.2.2 skrll { 3033 1.9.2.2 skrll struct pfil_head *ph_inet; 3034 1.9.2.2 skrll #ifdef INET6 3035 1.9.2.2 skrll struct pfil_head *ph_inet6; 3036 1.9.2.2 skrll #endif 3037 1.9.2.2 skrll int error; 3038 1.9.2.2 skrll int i; 3039 1.9.2.2 skrll 3040 1.9.2.2 skrll if (pf_pfil_attached) 3041 1.9.2.2 skrll return (0); 3042 1.9.2.2 skrll 3043 1.9.2.2 skrll error = pfil_add_hook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, &if_pfil); 3044 1.9.2.2 skrll if (error) 3045 1.9.2.2 skrll goto bad1; 3046 1.9.2.2 skrll error = pfil_add_hook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, &if_pfil); 3047 1.9.2.2 skrll if (error) 3048 1.9.2.2 skrll goto bad2; 3049 1.9.2.2 skrll 3050 1.9.2.2 skrll ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3051 1.9.2.2 skrll if (ph_inet) 3052 1.9.2.2 skrll error = pfil_add_hook((void *)pfil4_wrapper, NULL, 3053 1.9.2.2 skrll PFIL_IN|PFIL_OUT, ph_inet); 3054 1.9.2.2 skrll else 3055 1.9.2.2 skrll error = ENOENT; 3056 1.9.2.2 skrll if (error) 3057 1.9.2.2 skrll goto bad3; 3058 1.9.2.2 skrll 3059 1.9.2.2 skrll #ifdef INET6 3060 1.9.2.2 skrll ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3061 1.9.2.2 skrll if (ph_inet6) 3062 1.9.2.2 skrll error = pfil_add_hook((void *)pfil6_wrapper, NULL, 3063 1.9.2.2 skrll PFIL_IN|PFIL_OUT, ph_inet6); 3064 1.9.2.2 skrll else 3065 1.9.2.2 skrll error = ENOENT; 3066 1.9.2.2 skrll if (error) 3067 1.9.2.2 skrll goto bad4; 3068 1.9.2.2 skrll #endif 3069 1.9.2.2 skrll 3070 1.9.2.2 skrll for (i = 0; i < if_indexlim; i++) 3071 1.9.2.2 skrll if (ifindex2ifnet[i]) 3072 1.9.2.2 skrll pfi_attach_ifnet(ifindex2ifnet[i]); 3073 1.9.2.2 skrll pf_pfil_attached = 1; 3074 1.9.2.2 skrll 3075 1.9.2.2 skrll return (0); 3076 1.9.2.2 skrll 3077 1.9.2.2 skrll #ifdef INET6 3078 1.9.2.2 skrll bad4: 3079 1.9.2.2 skrll pfil_remove_hook(pfil4_wrapper, NULL, PFIL_IN|PFIL_OUT, ph_inet); 3080 1.9.2.2 skrll #endif 3081 1.9.2.2 skrll bad3: 3082 1.9.2.2 skrll pfil_remove_hook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, &if_pfil); 3083 1.9.2.2 skrll bad2: 3084 1.9.2.2 skrll pfil_remove_hook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, &if_pfil); 3085 1.9.2.2 skrll bad1: 3086 1.9.2.2 skrll return (error); 3087 1.9.2.2 skrll } 3088 1.9.2.2 skrll 3089 1.9.2.2 skrll static int 3090 1.9.2.2 skrll pf_pfil_detach(void) 3091 1.9.2.2 skrll { 3092 1.9.2.2 skrll struct pfil_head *ph_inet; 3093 1.9.2.2 skrll #ifdef INET6 3094 1.9.2.2 skrll struct pfil_head *ph_inet6; 3095 1.9.2.2 skrll #endif 3096 1.9.2.2 skrll int i; 3097 1.9.2.2 skrll 3098 1.9.2.2 skrll if (pf_pfil_attached == 0) 3099 1.9.2.2 skrll return (0); 3100 1.9.2.2 skrll 3101 1.9.2.2 skrll for (i = 0; i < if_indexlim; i++) 3102 1.9.2.2 skrll if (pfi_index2kif[i]) 3103 1.9.2.2 skrll pfi_detach_ifnet(ifindex2ifnet[i]); 3104 1.9.2.2 skrll 3105 1.9.2.2 skrll pfil_remove_hook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, &if_pfil); 3106 1.9.2.2 skrll pfil_remove_hook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, &if_pfil); 3107 1.9.2.2 skrll 3108 1.9.2.2 skrll ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3109 1.9.2.2 skrll if (ph_inet) 3110 1.9.2.2 skrll pfil_remove_hook((void *)pfil4_wrapper, NULL, 3111 1.9.2.2 skrll PFIL_IN|PFIL_OUT, ph_inet); 3112 1.9.2.2 skrll #ifdef INET6 3113 1.9.2.2 skrll ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3114 1.9.2.2 skrll if (ph_inet6) 3115 1.9.2.2 skrll pfil_remove_hook((void *)pfil6_wrapper, NULL, 3116 1.9.2.2 skrll PFIL_IN|PFIL_OUT, ph_inet6); 3117 1.9.2.2 skrll #endif 3118 1.9.2.2 skrll pf_pfil_attached = 0; 3119 1.9.2.2 skrll 3120 1.9.2.2 skrll return (0); 3121 1.9.2.2 skrll } 3122 1.9.2.2 skrll #endif 3123
Indexes created Thu Oct 02 14:10:14 GMT 2025