pf_ioctl.c revision 1.1.1.2
1 /* $OpenBSD: pf_ioctl.c,v 1.130 2004/09/09 22:08:42 dhartmei Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include "pfsync.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/mbuf.h> 43 #include <sys/filio.h> 44 #include <sys/fcntl.h> 45 #include <sys/socket.h> 46 #include <sys/socketvar.h> 47 #include <sys/kernel.h> 48 #include <sys/time.h> 49 #include <sys/timeout.h> 50 #include <sys/pool.h> 51 #include <sys/malloc.h> 52 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/route.h> 56 57 #include <netinet/in.h> 58 #include <netinet/in_var.h> 59 #include <netinet/in_systm.h> 60 #include <netinet/ip.h> 61 #include <netinet/ip_var.h> 62 #include <netinet/ip_icmp.h> 63 64 #include <dev/rndvar.h> 65 #include <net/pfvar.h> 66 67 #if NPFSYNC > 0 68 #include <net/if_pfsync.h> 69 #endif /* NPFSYNC > 0 */ 70 71 #ifdef INET6 72 #include <netinet/ip6.h> 73 #include <netinet/in_pcb.h> 74 #endif /* INET6 */ 75 76 #ifdef ALTQ 77 #include <altq/altq.h> 78 #endif 79 80 void pfattach(int); 81 int pfopen(dev_t, int, int, struct proc *); 82 int pfclose(dev_t, int, int, struct proc *); 83 struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 84 u_int8_t, u_int8_t, u_int8_t); 85 int pf_get_ruleset_number(u_int8_t); 86 void pf_init_ruleset(struct pf_ruleset *); 87 int pf_anchor_setup(struct pf_rule *, 88 const struct pf_ruleset *, const char *); 89 int pf_anchor_copyout(const struct pf_ruleset *, 90 const struct pf_rule *, struct pfioc_rule *); 91 void pf_anchor_remove(struct pf_rule *); 92 93 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 94 void pf_empty_pool(struct pf_palist *); 95 int pfioctl(dev_t, u_long, caddr_t, int, struct proc *); 96 #ifdef ALTQ 97 int pf_begin_altq(u_int32_t *); 98 int pf_rollback_altq(u_int32_t); 99 int pf_commit_altq(u_int32_t); 100 int pf_enable_altq(struct pf_altq *); 101 int pf_disable_altq(struct pf_altq *); 102 #endif /* ALTQ */ 103 int pf_begin_rules(u_int32_t *, int, const char *); 104 int pf_rollback_rules(u_int32_t, int, char *); 105 int pf_commit_rules(u_int32_t, int, char *); 106 107 extern struct timeout pf_expire_to; 108 109 struct pf_rule pf_default_rule; 110 #ifdef ALTQ 111 static int pf_altq_running; 112 #endif 113 114 #define TAGID_MAX 50000 115 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 116 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 117 118 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 119 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 120 #endif 121 static u_int16_t tagname2tag(struct pf_tags *, char *); 122 static void tag2tagname(struct pf_tags *, u_int16_t, char *); 123 static void tag_unref(struct pf_tags *, u_int16_t); 124 125 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 126 127 void 128 pfattach(int num) 129 { 130 u_int32_t *timeout = pf_default_rule.timeout; 131 132 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 133 &pool_allocator_nointr); 134 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 135 "pfsrctrpl", NULL); 136 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 137 NULL); 138 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 139 &pool_allocator_nointr); 140 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 141 "pfpooladdrpl", &pool_allocator_nointr); 142 pfr_initialize(); 143 pfi_initialize(); 144 pf_osfp_initialize(); 145 146 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 147 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 148 149 RB_INIT(&tree_src_tracking); 150 RB_INIT(&pf_anchors); 151 pf_init_ruleset(&pf_main_ruleset); 152 TAILQ_INIT(&pf_altqs[0]); 153 TAILQ_INIT(&pf_altqs[1]); 154 TAILQ_INIT(&pf_pabuf); 155 pf_altqs_active = &pf_altqs[0]; 156 pf_altqs_inactive = &pf_altqs[1]; 157 TAILQ_INIT(&state_updates); 158 159 /* default rule should never be garbage collected */ 160 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 161 pf_default_rule.action = PF_PASS; 162 pf_default_rule.nr = -1; 163 164 /* initialize default timeouts */ 165 timeout[PFTM_TCP_FIRST_PACKET] = 120; /* First TCP packet */ 166 timeout[PFTM_TCP_OPENING] = 30; /* No response yet */ 167 timeout[PFTM_TCP_ESTABLISHED] = 24*60*60; /* Established */ 168 timeout[PFTM_TCP_CLOSING] = 15 * 60; /* Half closed */ 169 timeout[PFTM_TCP_FIN_WAIT] = 45; /* Got both FINs */ 170 timeout[PFTM_TCP_CLOSED] = 90; /* Got a RST */ 171 timeout[PFTM_UDP_FIRST_PACKET] = 60; /* First UDP packet */ 172 timeout[PFTM_UDP_SINGLE] = 30; /* Unidirectional */ 173 timeout[PFTM_UDP_MULTIPLE] = 60; /* Bidirectional */ 174 timeout[PFTM_ICMP_FIRST_PACKET] = 20; /* First ICMP packet */ 175 timeout[PFTM_ICMP_ERROR_REPLY] = 10; /* Got error response */ 176 timeout[PFTM_OTHER_FIRST_PACKET] = 60; /* First packet */ 177 timeout[PFTM_OTHER_SINGLE] = 30; /* Unidirectional */ 178 timeout[PFTM_OTHER_MULTIPLE] = 60; /* Bidirectional */ 179 timeout[PFTM_FRAG] = 30; /* Fragment expire */ 180 timeout[PFTM_INTERVAL] = 10; /* Expire interval */ 181 timeout[PFTM_SRC_NODE] = 0; /* Source tracking */ 182 timeout[PFTM_TS_DIFF] = 30; /* Allowed TS diff */ 183 184 timeout_set(&pf_expire_to, pf_purge_timeout, &pf_expire_to); 185 timeout_add(&pf_expire_to, timeout[PFTM_INTERVAL] * hz); 186 187 pf_normalize_init(); 188 bzero(&pf_status, sizeof(pf_status)); 189 pf_status.debug = PF_DEBUG_URGENT; 190 191 /* XXX do our best to avoid a conflict */ 192 pf_status.hostid = arc4random(); 193 } 194 195 int 196 pfopen(dev_t dev, int flags, int fmt, struct proc *p) 197 { 198 if (minor(dev) >= 1) 199 return (ENXIO); 200 return (0); 201 } 202 203 int 204 pfclose(dev_t dev, int flags, int fmt, struct proc *p) 205 { 206 if (minor(dev) >= 1) 207 return (ENXIO); 208 return (0); 209 } 210 211 struct pf_pool * 212 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 213 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 214 u_int8_t check_ticket) 215 { 216 struct pf_ruleset *ruleset; 217 struct pf_rule *rule; 218 int rs_num; 219 220 ruleset = pf_find_ruleset(anchor); 221 if (ruleset == NULL) 222 return (NULL); 223 rs_num = pf_get_ruleset_number(rule_action); 224 if (rs_num >= PF_RULESET_MAX) 225 return (NULL); 226 if (active) { 227 if (check_ticket && ticket != 228 ruleset->rules[rs_num].active.ticket) 229 return (NULL); 230 if (r_last) 231 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 232 pf_rulequeue); 233 else 234 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 235 } else { 236 if (check_ticket && ticket != 237 ruleset->rules[rs_num].inactive.ticket) 238 return (NULL); 239 if (r_last) 240 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 241 pf_rulequeue); 242 else 243 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 244 } 245 if (!r_last) { 246 while ((rule != NULL) && (rule->nr != rule_number)) 247 rule = TAILQ_NEXT(rule, entries); 248 } 249 if (rule == NULL) 250 return (NULL); 251 252 return (&rule->rpool); 253 } 254 255 int 256 pf_get_ruleset_number(u_int8_t action) 257 { 258 switch (action) { 259 case PF_SCRUB: 260 return (PF_RULESET_SCRUB); 261 break; 262 case PF_PASS: 263 case PF_DROP: 264 return (PF_RULESET_FILTER); 265 break; 266 case PF_NAT: 267 case PF_NONAT: 268 return (PF_RULESET_NAT); 269 break; 270 case PF_BINAT: 271 case PF_NOBINAT: 272 return (PF_RULESET_BINAT); 273 break; 274 case PF_RDR: 275 case PF_NORDR: 276 return (PF_RULESET_RDR); 277 break; 278 default: 279 return (PF_RULESET_MAX); 280 break; 281 } 282 } 283 284 void 285 pf_init_ruleset(struct pf_ruleset *ruleset) 286 { 287 int i; 288 289 memset(ruleset, 0, sizeof(struct pf_ruleset)); 290 for (i = 0; i < PF_RULESET_MAX; i++) { 291 TAILQ_INIT(&ruleset->rules[i].queues[0]); 292 TAILQ_INIT(&ruleset->rules[i].queues[1]); 293 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 294 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 295 } 296 } 297 298 struct pf_anchor * 299 pf_find_anchor(const char *path) 300 { 301 static struct pf_anchor key; 302 303 memset(&key, 0, sizeof(key)); 304 strlcpy(key.path, path, sizeof(key.path)); 305 return (RB_FIND(pf_anchor_global, &pf_anchors, &key)); 306 } 307 308 struct pf_ruleset * 309 pf_find_ruleset(const char *path) 310 { 311 struct pf_anchor *anchor; 312 313 while (*path == '/') 314 path++; 315 if (!*path) 316 return (&pf_main_ruleset); 317 anchor = pf_find_anchor(path); 318 if (anchor == NULL) 319 return (NULL); 320 else 321 return (&anchor->ruleset); 322 } 323 324 struct pf_ruleset * 325 pf_find_or_create_ruleset(const char *path) 326 { 327 static char p[MAXPATHLEN]; 328 char *q, *r; 329 struct pf_ruleset *ruleset; 330 struct pf_anchor *anchor, *dup, *parent = NULL; 331 332 while (*path == '/') 333 path++; 334 ruleset = pf_find_ruleset(path); 335 if (ruleset != NULL) 336 return (ruleset); 337 strlcpy(p, path, sizeof(p)); 338 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 339 *q = 0; 340 if ((ruleset = pf_find_ruleset(p)) != NULL) { 341 parent = ruleset->anchor; 342 break; 343 } 344 } 345 if (q == NULL) 346 q = p; 347 else 348 q++; 349 strlcpy(p, path, sizeof(p)); 350 if (!*q) 351 return (NULL); 352 while ((r = strchr(q, '/')) != NULL || *q) { 353 if (r != NULL) 354 *r = 0; 355 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 356 (parent != NULL && strlen(parent->path) >= 357 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) 358 return (NULL); 359 anchor = (struct pf_anchor *)malloc(sizeof(*anchor), M_TEMP, 360 M_NOWAIT); 361 if (anchor == NULL) 362 return (NULL); 363 memset(anchor, 0, sizeof(*anchor)); 364 RB_INIT(&anchor->children); 365 strlcpy(anchor->name, q, sizeof(anchor->name)); 366 if (parent != NULL) { 367 strlcpy(anchor->path, parent->path, 368 sizeof(anchor->path)); 369 strlcat(anchor->path, "/", sizeof(anchor->path)); 370 } 371 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 372 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != 373 NULL) { 374 printf("pf_find_or_create_ruleset: RB_INSERT1 " 375 "'%s' '%s' collides with '%s' '%s'\n", 376 anchor->path, anchor->name, dup->path, dup->name); 377 free(anchor, M_TEMP); 378 return (NULL); 379 } 380 if (parent != NULL) { 381 anchor->parent = parent; 382 if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 383 anchor)) != NULL) { 384 printf("pf_find_or_create_ruleset: " 385 "RB_INSERT2 '%s' '%s' collides with " 386 "'%s' '%s'\n", anchor->path, anchor->name, 387 dup->path, dup->name); 388 RB_REMOVE(pf_anchor_global, &pf_anchors, 389 anchor); 390 free(anchor, M_TEMP); 391 return (NULL); 392 } 393 } 394 pf_init_ruleset(&anchor->ruleset); 395 anchor->ruleset.anchor = anchor; 396 parent = anchor; 397 if (r != NULL) 398 q = r + 1; 399 else 400 *q = 0; 401 } 402 return (&anchor->ruleset); 403 } 404 405 void 406 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 407 { 408 struct pf_anchor *parent; 409 int i; 410 411 while (ruleset != NULL) { 412 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 413 !RB_EMPTY(&ruleset->anchor->children) || 414 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 415 ruleset->topen) 416 return; 417 for (i = 0; i < PF_RULESET_MAX; ++i) 418 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 419 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 420 ruleset->rules[i].inactive.open) 421 return; 422 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); 423 if ((parent = ruleset->anchor->parent) != NULL) 424 RB_REMOVE(pf_anchor_node, &parent->children, 425 ruleset->anchor); 426 free(ruleset->anchor, M_TEMP); 427 if (parent == NULL) 428 return; 429 ruleset = &parent->ruleset; 430 } 431 } 432 433 int 434 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 435 const char *name) 436 { 437 static char *p, path[MAXPATHLEN]; 438 struct pf_ruleset *ruleset; 439 440 r->anchor = NULL; 441 r->anchor_relative = 0; 442 r->anchor_wildcard = 0; 443 if (!name[0]) 444 return (0); 445 if (name[0] == '/') 446 strlcpy(path, name + 1, sizeof(path)); 447 else { 448 /* relative path */ 449 r->anchor_relative = 1; 450 if (s->anchor == NULL || !s->anchor->path[0]) 451 path[0] = 0; 452 else 453 strlcpy(path, s->anchor->path, sizeof(path)); 454 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 455 if (!path[0]) { 456 printf("pf_anchor_setup: .. beyond root\n"); 457 return (1); 458 } 459 if ((p = strrchr(path, '/')) != NULL) 460 *p = 0; 461 else 462 path[0] = 0; 463 r->anchor_relative++; 464 name += 3; 465 } 466 if (path[0]) 467 strlcat(path, "/", sizeof(path)); 468 strlcat(path, name, sizeof(path)); 469 } 470 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 471 r->anchor_wildcard = 1; 472 *p = 0; 473 } 474 ruleset = pf_find_or_create_ruleset(path); 475 if (ruleset == NULL || ruleset->anchor == NULL) { 476 printf("pf_anchor_setup: ruleset\n"); 477 return (1); 478 } 479 r->anchor = ruleset->anchor; 480 r->anchor->refcnt++; 481 return (0); 482 } 483 484 int 485 pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, 486 struct pfioc_rule *pr) 487 { 488 pr->anchor_call[0] = 0; 489 if (r->anchor == NULL) 490 return (0); 491 if (!r->anchor_relative) { 492 strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call)); 493 strlcat(pr->anchor_call, r->anchor->path, 494 sizeof(pr->anchor_call)); 495 } else { 496 char a[MAXPATHLEN], b[MAXPATHLEN], *p; 497 int i; 498 499 if (rs->anchor == NULL) 500 a[0] = 0; 501 else 502 strlcpy(a, rs->anchor->path, sizeof(a)); 503 strlcpy(b, r->anchor->path, sizeof(b)); 504 for (i = 1; i < r->anchor_relative; ++i) { 505 if ((p = strrchr(a, '/')) == NULL) 506 p = a; 507 *p = 0; 508 strlcat(pr->anchor_call, "../", 509 sizeof(pr->anchor_call)); 510 } 511 if (strncmp(a, b, strlen(a))) { 512 printf("pf_anchor_copyout: '%s' '%s'\n", a, b); 513 return (1); 514 } 515 if (strlen(b) > strlen(a)) 516 strlcat(pr->anchor_call, b + (a[0] ? strlen(a) + 1 : 0), 517 sizeof(pr->anchor_call)); 518 } 519 if (r->anchor_wildcard) 520 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*", 521 sizeof(pr->anchor_call)); 522 return (0); 523 } 524 525 void 526 pf_anchor_remove(struct pf_rule *r) 527 { 528 if (r->anchor == NULL) 529 return; 530 if (r->anchor->refcnt <= 0) { 531 printf("pf_anchor_remove: broken refcount"); 532 r->anchor = NULL; 533 return; 534 } 535 if (!--r->anchor->refcnt) 536 pf_remove_if_empty_ruleset(&r->anchor->ruleset); 537 r->anchor = NULL; 538 } 539 540 void 541 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 542 { 543 struct pf_pooladdr *mv_pool_pa; 544 545 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 546 TAILQ_REMOVE(poola, mv_pool_pa, entries); 547 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 548 } 549 } 550 551 void 552 pf_empty_pool(struct pf_palist *poola) 553 { 554 struct pf_pooladdr *empty_pool_pa; 555 556 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 557 pfi_dynaddr_remove(&empty_pool_pa->addr); 558 pf_tbladdr_remove(&empty_pool_pa->addr); 559 pfi_detach_rule(empty_pool_pa->kif); 560 TAILQ_REMOVE(poola, empty_pool_pa, entries); 561 pool_put(&pf_pooladdr_pl, empty_pool_pa); 562 } 563 } 564 565 void 566 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 567 { 568 if (rulequeue != NULL) { 569 if (rule->states <= 0) { 570 /* 571 * XXX - we need to remove the table *before* detaching 572 * the rule to make sure the table code does not delete 573 * the anchor under our feet. 574 */ 575 pf_tbladdr_remove(&rule->src.addr); 576 pf_tbladdr_remove(&rule->dst.addr); 577 } 578 TAILQ_REMOVE(rulequeue, rule, entries); 579 rule->entries.tqe_prev = NULL; 580 rule->nr = -1; 581 } 582 583 if (rule->states > 0 || rule->src_nodes > 0 || 584 rule->entries.tqe_prev != NULL) 585 return; 586 pf_tag_unref(rule->tag); 587 pf_tag_unref(rule->match_tag); 588 #ifdef ALTQ 589 if (rule->pqid != rule->qid) 590 pf_qid_unref(rule->pqid); 591 pf_qid_unref(rule->qid); 592 #endif 593 pfi_dynaddr_remove(&rule->src.addr); 594 pfi_dynaddr_remove(&rule->dst.addr); 595 if (rulequeue == NULL) { 596 pf_tbladdr_remove(&rule->src.addr); 597 pf_tbladdr_remove(&rule->dst.addr); 598 } 599 pfi_detach_rule(rule->kif); 600 pf_anchor_remove(rule); 601 pf_empty_pool(&rule->rpool.list); 602 pool_put(&pf_rule_pl, rule); 603 } 604 605 static u_int16_t 606 tagname2tag(struct pf_tags *head, char *tagname) 607 { 608 struct pf_tagname *tag, *p = NULL; 609 u_int16_t new_tagid = 1; 610 611 TAILQ_FOREACH(tag, head, entries) 612 if (strcmp(tagname, tag->name) == 0) { 613 tag->ref++; 614 return (tag->tag); 615 } 616 617 /* 618 * to avoid fragmentation, we do a linear search from the beginning 619 * and take the first free slot we find. if there is none or the list 620 * is empty, append a new entry at the end. 621 */ 622 623 /* new entry */ 624 if (!TAILQ_EMPTY(head)) 625 for (p = TAILQ_FIRST(head); p != NULL && 626 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 627 new_tagid = p->tag + 1; 628 629 if (new_tagid > TAGID_MAX) 630 return (0); 631 632 /* allocate and fill new struct pf_tagname */ 633 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 634 M_TEMP, M_NOWAIT); 635 if (tag == NULL) 636 return (0); 637 bzero(tag, sizeof(struct pf_tagname)); 638 strlcpy(tag->name, tagname, sizeof(tag->name)); 639 tag->tag = new_tagid; 640 tag->ref++; 641 642 if (p != NULL) /* insert new entry before p */ 643 TAILQ_INSERT_BEFORE(p, tag, entries); 644 else /* either list empty or no free slot in between */ 645 TAILQ_INSERT_TAIL(head, tag, entries); 646 647 return (tag->tag); 648 } 649 650 static void 651 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 652 { 653 struct pf_tagname *tag; 654 655 TAILQ_FOREACH(tag, head, entries) 656 if (tag->tag == tagid) { 657 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 658 return; 659 } 660 } 661 662 static void 663 tag_unref(struct pf_tags *head, u_int16_t tag) 664 { 665 struct pf_tagname *p, *next; 666 667 if (tag == 0) 668 return; 669 670 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 671 next = TAILQ_NEXT(p, entries); 672 if (tag == p->tag) { 673 if (--p->ref == 0) { 674 TAILQ_REMOVE(head, p, entries); 675 free(p, M_TEMP); 676 } 677 break; 678 } 679 } 680 } 681 682 u_int16_t 683 pf_tagname2tag(char *tagname) 684 { 685 return (tagname2tag(&pf_tags, tagname)); 686 } 687 688 void 689 pf_tag2tagname(u_int16_t tagid, char *p) 690 { 691 return (tag2tagname(&pf_tags, tagid, p)); 692 } 693 694 void 695 pf_tag_unref(u_int16_t tag) 696 { 697 return (tag_unref(&pf_tags, tag)); 698 } 699 700 #ifdef ALTQ 701 u_int32_t 702 pf_qname2qid(char *qname) 703 { 704 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 705 } 706 707 void 708 pf_qid2qname(u_int32_t qid, char *p) 709 { 710 return (tag2tagname(&pf_qids, (u_int16_t)qid, p)); 711 } 712 713 void 714 pf_qid_unref(u_int32_t qid) 715 { 716 return (tag_unref(&pf_qids, (u_int16_t)qid)); 717 } 718 719 int 720 pf_begin_altq(u_int32_t *ticket) 721 { 722 struct pf_altq *altq; 723 int error = 0; 724 725 /* Purge the old altq list */ 726 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 727 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 728 if (altq->qname[0] == 0) { 729 /* detach and destroy the discipline */ 730 error = altq_remove(altq); 731 } else 732 pf_qid_unref(altq->qid); 733 pool_put(&pf_altq_pl, altq); 734 } 735 if (error) 736 return (error); 737 *ticket = ++ticket_altqs_inactive; 738 altqs_inactive_open = 1; 739 return (0); 740 } 741 742 int 743 pf_rollback_altq(u_int32_t ticket) 744 { 745 struct pf_altq *altq; 746 int error = 0; 747 748 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 749 return (0); 750 /* Purge the old altq list */ 751 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 752 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 753 if (altq->qname[0] == 0) { 754 /* detach and destroy the discipline */ 755 error = altq_remove(altq); 756 } else 757 pf_qid_unref(altq->qid); 758 pool_put(&pf_altq_pl, altq); 759 } 760 altqs_inactive_open = 0; 761 return (error); 762 } 763 764 int 765 pf_commit_altq(u_int32_t ticket) 766 { 767 struct pf_altqqueue *old_altqs; 768 struct pf_altq *altq; 769 int s, err, error = 0; 770 771 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 772 return (EBUSY); 773 774 /* swap altqs, keep the old. */ 775 s = splsoftnet(); 776 old_altqs = pf_altqs_active; 777 pf_altqs_active = pf_altqs_inactive; 778 pf_altqs_inactive = old_altqs; 779 ticket_altqs_active = ticket_altqs_inactive; 780 781 /* Attach new disciplines */ 782 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 783 if (altq->qname[0] == 0) { 784 /* attach the discipline */ 785 error = altq_pfattach(altq); 786 if (error == 0 && pf_altq_running) 787 error = pf_enable_altq(altq); 788 if (error != 0) { 789 splx(s); 790 return (error); 791 } 792 } 793 } 794 795 /* Purge the old altq list */ 796 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 797 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 798 if (altq->qname[0] == 0) { 799 /* detach and destroy the discipline */ 800 if (pf_altq_running) 801 error = pf_disable_altq(altq); 802 err = altq_pfdetach(altq); 803 if (err != 0 && error == 0) 804 error = err; 805 err = altq_remove(altq); 806 if (err != 0 && error == 0) 807 error = err; 808 } else 809 pf_qid_unref(altq->qid); 810 pool_put(&pf_altq_pl, altq); 811 } 812 splx(s); 813 814 altqs_inactive_open = 0; 815 return (error); 816 } 817 818 int 819 pf_enable_altq(struct pf_altq *altq) 820 { 821 struct ifnet *ifp; 822 struct tb_profile tb; 823 int s, error = 0; 824 825 if ((ifp = ifunit(altq->ifname)) == NULL) 826 return (EINVAL); 827 828 if (ifp->if_snd.altq_type != ALTQT_NONE) 829 error = altq_enable(&ifp->if_snd); 830 831 /* set tokenbucket regulator */ 832 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 833 tb.rate = altq->ifbandwidth; 834 tb.depth = altq->tbrsize; 835 s = splimp(); 836 error = tbr_set(&ifp->if_snd, &tb); 837 splx(s); 838 } 839 840 return (error); 841 } 842 843 int 844 pf_disable_altq(struct pf_altq *altq) 845 { 846 struct ifnet *ifp; 847 struct tb_profile tb; 848 int s, error; 849 850 if ((ifp = ifunit(altq->ifname)) == NULL) 851 return (EINVAL); 852 853 /* 854 * when the discipline is no longer referenced, it was overridden 855 * by a new one. if so, just return. 856 */ 857 if (altq->altq_disc != ifp->if_snd.altq_disc) 858 return (0); 859 860 error = altq_disable(&ifp->if_snd); 861 862 if (error == 0) { 863 /* clear tokenbucket regulator */ 864 tb.rate = 0; 865 s = splimp(); 866 error = tbr_set(&ifp->if_snd, &tb); 867 splx(s); 868 } 869 870 return (error); 871 } 872 #endif /* ALTQ */ 873 874 int 875 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 876 { 877 struct pf_ruleset *rs; 878 struct pf_rule *rule; 879 880 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 881 return (EINVAL); 882 rs = pf_find_or_create_ruleset(anchor); 883 if (rs == NULL) 884 return (EINVAL); 885 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 886 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 887 *ticket = ++rs->rules[rs_num].inactive.ticket; 888 rs->rules[rs_num].inactive.open = 1; 889 return (0); 890 } 891 892 int 893 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 894 { 895 struct pf_ruleset *rs; 896 struct pf_rule *rule; 897 898 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 899 return (EINVAL); 900 rs = pf_find_ruleset(anchor); 901 if (rs == NULL || !rs->rules[rs_num].inactive.open || 902 rs->rules[rs_num].inactive.ticket != ticket) 903 return (0); 904 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 905 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 906 rs->rules[rs_num].inactive.open = 0; 907 return (0); 908 } 909 910 int 911 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 912 { 913 struct pf_ruleset *rs; 914 struct pf_rule *rule; 915 struct pf_rulequeue *old_rules; 916 int s; 917 918 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 919 return (EINVAL); 920 rs = pf_find_ruleset(anchor); 921 if (rs == NULL || !rs->rules[rs_num].inactive.open || 922 ticket != rs->rules[rs_num].inactive.ticket) 923 return (EBUSY); 924 925 /* Swap rules, keep the old. */ 926 s = splsoftnet(); 927 old_rules = rs->rules[rs_num].active.ptr; 928 rs->rules[rs_num].active.ptr = 929 rs->rules[rs_num].inactive.ptr; 930 rs->rules[rs_num].inactive.ptr = old_rules; 931 rs->rules[rs_num].active.ticket = 932 rs->rules[rs_num].inactive.ticket; 933 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 934 935 /* Purge the old rule list. */ 936 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 937 pf_rm_rule(old_rules, rule); 938 rs->rules[rs_num].inactive.open = 0; 939 pf_remove_if_empty_ruleset(rs); 940 splx(s); 941 return (0); 942 } 943 944 int 945 pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p) 946 { 947 struct pf_pooladdr *pa = NULL; 948 struct pf_pool *pool = NULL; 949 int s; 950 int error = 0; 951 952 /* XXX keep in sync with switch() below */ 953 if (securelevel > 1) 954 switch (cmd) { 955 case DIOCGETRULES: 956 case DIOCGETRULE: 957 case DIOCGETADDRS: 958 case DIOCGETADDR: 959 case DIOCGETSTATE: 960 case DIOCSETSTATUSIF: 961 case DIOCGETSTATUS: 962 case DIOCCLRSTATUS: 963 case DIOCNATLOOK: 964 case DIOCSETDEBUG: 965 case DIOCGETSTATES: 966 case DIOCGETTIMEOUT: 967 case DIOCCLRRULECTRS: 968 case DIOCGETLIMIT: 969 case DIOCGETALTQS: 970 case DIOCGETALTQ: 971 case DIOCGETQSTATS: 972 case DIOCGETRULESETS: 973 case DIOCGETRULESET: 974 case DIOCRGETTABLES: 975 case DIOCRGETTSTATS: 976 case DIOCRCLRTSTATS: 977 case DIOCRCLRADDRS: 978 case DIOCRADDADDRS: 979 case DIOCRDELADDRS: 980 case DIOCRSETADDRS: 981 case DIOCRGETADDRS: 982 case DIOCRGETASTATS: 983 case DIOCRCLRASTATS: 984 case DIOCRTSTADDRS: 985 case DIOCOSFPGET: 986 case DIOCGETSRCNODES: 987 case DIOCCLRSRCNODES: 988 case DIOCIGETIFACES: 989 case DIOCICLRISTATS: 990 break; 991 case DIOCRCLRTABLES: 992 case DIOCRADDTABLES: 993 case DIOCRDELTABLES: 994 case DIOCRSETTFLAGS: 995 if (((struct pfioc_table *)addr)->pfrio_flags & 996 PFR_FLAG_DUMMY) 997 break; /* dummy operation ok */ 998 return (EPERM); 999 default: 1000 return (EPERM); 1001 } 1002 1003 if (!(flags & FWRITE)) 1004 switch (cmd) { 1005 case DIOCGETRULES: 1006 case DIOCGETRULE: 1007 case DIOCGETADDRS: 1008 case DIOCGETADDR: 1009 case DIOCGETSTATE: 1010 case DIOCGETSTATUS: 1011 case DIOCGETSTATES: 1012 case DIOCGETTIMEOUT: 1013 case DIOCGETLIMIT: 1014 case DIOCGETALTQS: 1015 case DIOCGETALTQ: 1016 case DIOCGETQSTATS: 1017 case DIOCGETRULESETS: 1018 case DIOCGETRULESET: 1019 case DIOCRGETTABLES: 1020 case DIOCRGETTSTATS: 1021 case DIOCRGETADDRS: 1022 case DIOCRGETASTATS: 1023 case DIOCRTSTADDRS: 1024 case DIOCOSFPGET: 1025 case DIOCGETSRCNODES: 1026 case DIOCIGETIFACES: 1027 break; 1028 case DIOCRCLRTABLES: 1029 case DIOCRADDTABLES: 1030 case DIOCRDELTABLES: 1031 case DIOCRCLRTSTATS: 1032 case DIOCRCLRADDRS: 1033 case DIOCRADDADDRS: 1034 case DIOCRDELADDRS: 1035 case DIOCRSETADDRS: 1036 case DIOCRSETTFLAGS: 1037 if (((struct pfioc_table *)addr)->pfrio_flags & 1038 PFR_FLAG_DUMMY) 1039 break; /* dummy operation ok */ 1040 return (EACCES); 1041 default: 1042 return (EACCES); 1043 } 1044 1045 switch (cmd) { 1046 1047 case DIOCSTART: 1048 if (pf_status.running) 1049 error = EEXIST; 1050 else { 1051 pf_status.running = 1; 1052 pf_status.since = time_second; 1053 if (pf_status.stateid == 0) { 1054 pf_status.stateid = time_second; 1055 pf_status.stateid = pf_status.stateid << 32; 1056 } 1057 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1058 } 1059 break; 1060 1061 case DIOCSTOP: 1062 if (!pf_status.running) 1063 error = ENOENT; 1064 else { 1065 pf_status.running = 0; 1066 pf_status.since = time_second; 1067 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1068 } 1069 break; 1070 1071 case DIOCADDRULE: { 1072 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1073 struct pf_ruleset *ruleset; 1074 struct pf_rule *rule, *tail; 1075 struct pf_pooladdr *pa; 1076 int rs_num; 1077 1078 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1079 ruleset = pf_find_ruleset(pr->anchor); 1080 if (ruleset == NULL) { 1081 error = EINVAL; 1082 break; 1083 } 1084 rs_num = pf_get_ruleset_number(pr->rule.action); 1085 if (rs_num >= PF_RULESET_MAX) { 1086 error = EINVAL; 1087 break; 1088 } 1089 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1090 error = EINVAL; 1091 break; 1092 } 1093 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1094 error = EBUSY; 1095 break; 1096 } 1097 if (pr->pool_ticket != ticket_pabuf) { 1098 error = EBUSY; 1099 break; 1100 } 1101 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1102 if (rule == NULL) { 1103 error = ENOMEM; 1104 break; 1105 } 1106 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1107 rule->anchor = NULL; 1108 rule->kif = NULL; 1109 TAILQ_INIT(&rule->rpool.list); 1110 /* initialize refcounting */ 1111 rule->states = 0; 1112 rule->src_nodes = 0; 1113 rule->entries.tqe_prev = NULL; 1114 #ifndef INET 1115 if (rule->af == AF_INET) { 1116 pool_put(&pf_rule_pl, rule); 1117 error = EAFNOSUPPORT; 1118 break; 1119 } 1120 #endif /* INET */ 1121 #ifndef INET6 1122 if (rule->af == AF_INET6) { 1123 pool_put(&pf_rule_pl, rule); 1124 error = EAFNOSUPPORT; 1125 break; 1126 } 1127 #endif /* INET6 */ 1128 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1129 pf_rulequeue); 1130 if (tail) 1131 rule->nr = tail->nr + 1; 1132 else 1133 rule->nr = 0; 1134 if (rule->ifname[0]) { 1135 rule->kif = pfi_attach_rule(rule->ifname); 1136 if (rule->kif == NULL) { 1137 pool_put(&pf_rule_pl, rule); 1138 error = EINVAL; 1139 break; 1140 } 1141 } 1142 1143 #ifdef ALTQ 1144 /* set queue IDs */ 1145 if (rule->qname[0] != 0) { 1146 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1147 error = EBUSY; 1148 else if (rule->pqname[0] != 0) { 1149 if ((rule->pqid = 1150 pf_qname2qid(rule->pqname)) == 0) 1151 error = EBUSY; 1152 } else 1153 rule->pqid = rule->qid; 1154 } 1155 #endif 1156 if (rule->tagname[0]) 1157 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1158 error = EBUSY; 1159 if (rule->match_tagname[0]) 1160 if ((rule->match_tag = 1161 pf_tagname2tag(rule->match_tagname)) == 0) 1162 error = EBUSY; 1163 if (rule->rt && !rule->direction) 1164 error = EINVAL; 1165 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1166 error = EINVAL; 1167 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1168 error = EINVAL; 1169 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1170 error = EINVAL; 1171 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1172 error = EINVAL; 1173 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1174 error = EINVAL; 1175 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1176 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1177 error = EINVAL; 1178 1179 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1180 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1181 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1182 (rule->rt > PF_FASTROUTE)) && 1183 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1184 error = EINVAL; 1185 1186 if (error) { 1187 pf_rm_rule(NULL, rule); 1188 break; 1189 } 1190 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1191 rule->evaluations = rule->packets = rule->bytes = 0; 1192 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1193 rule, entries); 1194 break; 1195 } 1196 1197 case DIOCGETRULES: { 1198 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1199 struct pf_ruleset *ruleset; 1200 struct pf_rule *tail; 1201 int rs_num; 1202 1203 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1204 ruleset = pf_find_ruleset(pr->anchor); 1205 if (ruleset == NULL) { 1206 error = EINVAL; 1207 break; 1208 } 1209 rs_num = pf_get_ruleset_number(pr->rule.action); 1210 if (rs_num >= PF_RULESET_MAX) { 1211 error = EINVAL; 1212 break; 1213 } 1214 s = splsoftnet(); 1215 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1216 pf_rulequeue); 1217 if (tail) 1218 pr->nr = tail->nr + 1; 1219 else 1220 pr->nr = 0; 1221 pr->ticket = ruleset->rules[rs_num].active.ticket; 1222 splx(s); 1223 break; 1224 } 1225 1226 case DIOCGETRULE: { 1227 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1228 struct pf_ruleset *ruleset; 1229 struct pf_rule *rule; 1230 int rs_num, i; 1231 1232 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1233 ruleset = pf_find_ruleset(pr->anchor); 1234 if (ruleset == NULL) { 1235 error = EINVAL; 1236 break; 1237 } 1238 rs_num = pf_get_ruleset_number(pr->rule.action); 1239 if (rs_num >= PF_RULESET_MAX) { 1240 error = EINVAL; 1241 break; 1242 } 1243 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1244 error = EBUSY; 1245 break; 1246 } 1247 s = splsoftnet(); 1248 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1249 while ((rule != NULL) && (rule->nr != pr->nr)) 1250 rule = TAILQ_NEXT(rule, entries); 1251 if (rule == NULL) { 1252 error = EBUSY; 1253 splx(s); 1254 break; 1255 } 1256 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1257 if (pf_anchor_copyout(ruleset, rule, pr)) { 1258 error = EBUSY; 1259 splx(s); 1260 break; 1261 } 1262 pfi_dynaddr_copyout(&pr->rule.src.addr); 1263 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1264 pf_tbladdr_copyout(&pr->rule.src.addr); 1265 pf_tbladdr_copyout(&pr->rule.dst.addr); 1266 for (i = 0; i < PF_SKIP_COUNT; ++i) 1267 if (rule->skip[i].ptr == NULL) 1268 pr->rule.skip[i].nr = -1; 1269 else 1270 pr->rule.skip[i].nr = 1271 rule->skip[i].ptr->nr; 1272 splx(s); 1273 break; 1274 } 1275 1276 case DIOCCHANGERULE: { 1277 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1278 struct pf_ruleset *ruleset; 1279 struct pf_rule *oldrule = NULL, *newrule = NULL; 1280 u_int32_t nr = 0; 1281 int rs_num; 1282 1283 if (!(pcr->action == PF_CHANGE_REMOVE || 1284 pcr->action == PF_CHANGE_GET_TICKET) && 1285 pcr->pool_ticket != ticket_pabuf) { 1286 error = EBUSY; 1287 break; 1288 } 1289 1290 if (pcr->action < PF_CHANGE_ADD_HEAD || 1291 pcr->action > PF_CHANGE_GET_TICKET) { 1292 error = EINVAL; 1293 break; 1294 } 1295 ruleset = pf_find_ruleset(pcr->anchor); 1296 if (ruleset == NULL) { 1297 error = EINVAL; 1298 break; 1299 } 1300 rs_num = pf_get_ruleset_number(pcr->rule.action); 1301 if (rs_num >= PF_RULESET_MAX) { 1302 error = EINVAL; 1303 break; 1304 } 1305 1306 if (pcr->action == PF_CHANGE_GET_TICKET) { 1307 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1308 break; 1309 } else { 1310 if (pcr->ticket != 1311 ruleset->rules[rs_num].active.ticket) { 1312 error = EINVAL; 1313 break; 1314 } 1315 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1316 error = EINVAL; 1317 break; 1318 } 1319 } 1320 1321 if (pcr->action != PF_CHANGE_REMOVE) { 1322 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1323 if (newrule == NULL) { 1324 error = ENOMEM; 1325 break; 1326 } 1327 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1328 TAILQ_INIT(&newrule->rpool.list); 1329 /* initialize refcounting */ 1330 newrule->states = 0; 1331 newrule->entries.tqe_prev = NULL; 1332 #ifndef INET 1333 if (newrule->af == AF_INET) { 1334 pool_put(&pf_rule_pl, newrule); 1335 error = EAFNOSUPPORT; 1336 break; 1337 } 1338 #endif /* INET */ 1339 #ifndef INET6 1340 if (newrule->af == AF_INET6) { 1341 pool_put(&pf_rule_pl, newrule); 1342 error = EAFNOSUPPORT; 1343 break; 1344 } 1345 #endif /* INET6 */ 1346 if (newrule->ifname[0]) { 1347 newrule->kif = pfi_attach_rule(newrule->ifname); 1348 if (newrule->kif == NULL) { 1349 pool_put(&pf_rule_pl, newrule); 1350 error = EINVAL; 1351 break; 1352 } 1353 } else 1354 newrule->kif = NULL; 1355 1356 #ifdef ALTQ 1357 /* set queue IDs */ 1358 if (newrule->qname[0] != 0) { 1359 if ((newrule->qid = 1360 pf_qname2qid(newrule->qname)) == 0) 1361 error = EBUSY; 1362 else if (newrule->pqname[0] != 0) { 1363 if ((newrule->pqid = 1364 pf_qname2qid(newrule->pqname)) == 0) 1365 error = EBUSY; 1366 } else 1367 newrule->pqid = newrule->qid; 1368 } 1369 #endif /* ALTQ */ 1370 if (newrule->tagname[0]) 1371 if ((newrule->tag = 1372 pf_tagname2tag(newrule->tagname)) == 0) 1373 error = EBUSY; 1374 if (newrule->match_tagname[0]) 1375 if ((newrule->match_tag = pf_tagname2tag( 1376 newrule->match_tagname)) == 0) 1377 error = EBUSY; 1378 1379 if (newrule->rt && !newrule->direction) 1380 error = EINVAL; 1381 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1382 error = EINVAL; 1383 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1384 error = EINVAL; 1385 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1386 error = EINVAL; 1387 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1388 error = EINVAL; 1389 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1390 error = EINVAL; 1391 1392 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1393 if (((((newrule->action == PF_NAT) || 1394 (newrule->action == PF_RDR) || 1395 (newrule->action == PF_BINAT) || 1396 (newrule->rt > PF_FASTROUTE)) && 1397 !pcr->anchor[0])) && 1398 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1399 error = EINVAL; 1400 1401 if (error) { 1402 pf_rm_rule(NULL, newrule); 1403 break; 1404 } 1405 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1406 newrule->evaluations = newrule->packets = 0; 1407 newrule->bytes = 0; 1408 } 1409 pf_empty_pool(&pf_pabuf); 1410 1411 s = splsoftnet(); 1412 1413 if (pcr->action == PF_CHANGE_ADD_HEAD) 1414 oldrule = TAILQ_FIRST( 1415 ruleset->rules[rs_num].active.ptr); 1416 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1417 oldrule = TAILQ_LAST( 1418 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1419 else { 1420 oldrule = TAILQ_FIRST( 1421 ruleset->rules[rs_num].active.ptr); 1422 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1423 oldrule = TAILQ_NEXT(oldrule, entries); 1424 if (oldrule == NULL) { 1425 if (newrule != NULL) 1426 pf_rm_rule(NULL, newrule); 1427 error = EINVAL; 1428 splx(s); 1429 break; 1430 } 1431 } 1432 1433 if (pcr->action == PF_CHANGE_REMOVE) 1434 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1435 else { 1436 if (oldrule == NULL) 1437 TAILQ_INSERT_TAIL( 1438 ruleset->rules[rs_num].active.ptr, 1439 newrule, entries); 1440 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1441 pcr->action == PF_CHANGE_ADD_BEFORE) 1442 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1443 else 1444 TAILQ_INSERT_AFTER( 1445 ruleset->rules[rs_num].active.ptr, 1446 oldrule, newrule, entries); 1447 } 1448 1449 nr = 0; 1450 TAILQ_FOREACH(oldrule, 1451 ruleset->rules[rs_num].active.ptr, entries) 1452 oldrule->nr = nr++; 1453 1454 ruleset->rules[rs_num].active.ticket++; 1455 1456 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1457 pf_remove_if_empty_ruleset(ruleset); 1458 1459 splx(s); 1460 break; 1461 } 1462 1463 case DIOCCLRSTATES: { 1464 struct pf_state *state; 1465 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1466 int killed = 0; 1467 1468 s = splsoftnet(); 1469 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1470 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1471 state->u.s.kif->pfik_name)) { 1472 state->timeout = PFTM_PURGE; 1473 #if NPFSYNC 1474 /* don't send out individual delete messages */ 1475 state->sync_flags = PFSTATE_NOSYNC; 1476 #endif 1477 killed++; 1478 } 1479 } 1480 pf_purge_expired_states(); 1481 pf_status.states = 0; 1482 psk->psk_af = killed; 1483 #if NPFSYNC 1484 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1485 #endif 1486 splx(s); 1487 break; 1488 } 1489 1490 case DIOCKILLSTATES: { 1491 struct pf_state *state; 1492 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1493 int killed = 0; 1494 1495 s = splsoftnet(); 1496 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1497 if ((!psk->psk_af || state->af == psk->psk_af) 1498 && (!psk->psk_proto || psk->psk_proto == 1499 state->proto) && 1500 PF_MATCHA(psk->psk_src.neg, 1501 &psk->psk_src.addr.v.a.addr, 1502 &psk->psk_src.addr.v.a.mask, 1503 &state->lan.addr, state->af) && 1504 PF_MATCHA(psk->psk_dst.neg, 1505 &psk->psk_dst.addr.v.a.addr, 1506 &psk->psk_dst.addr.v.a.mask, 1507 &state->ext.addr, state->af) && 1508 (psk->psk_src.port_op == 0 || 1509 pf_match_port(psk->psk_src.port_op, 1510 psk->psk_src.port[0], psk->psk_src.port[1], 1511 state->lan.port)) && 1512 (psk->psk_dst.port_op == 0 || 1513 pf_match_port(psk->psk_dst.port_op, 1514 psk->psk_dst.port[0], psk->psk_dst.port[1], 1515 state->ext.port)) && 1516 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1517 state->u.s.kif->pfik_name))) { 1518 state->timeout = PFTM_PURGE; 1519 killed++; 1520 } 1521 } 1522 pf_purge_expired_states(); 1523 splx(s); 1524 psk->psk_af = killed; 1525 break; 1526 } 1527 1528 case DIOCADDSTATE: { 1529 struct pfioc_state *ps = (struct pfioc_state *)addr; 1530 struct pf_state *state; 1531 struct pfi_kif *kif; 1532 1533 if (ps->state.timeout >= PFTM_MAX && 1534 ps->state.timeout != PFTM_UNTIL_PACKET) { 1535 error = EINVAL; 1536 break; 1537 } 1538 state = pool_get(&pf_state_pl, PR_NOWAIT); 1539 if (state == NULL) { 1540 error = ENOMEM; 1541 break; 1542 } 1543 s = splsoftnet(); 1544 kif = pfi_lookup_create(ps->state.u.ifname); 1545 if (kif == NULL) { 1546 pool_put(&pf_state_pl, state); 1547 error = ENOENT; 1548 splx(s); 1549 break; 1550 } 1551 bcopy(&ps->state, state, sizeof(struct pf_state)); 1552 bzero(&state->u, sizeof(state->u)); 1553 state->rule.ptr = &pf_default_rule; 1554 state->nat_rule.ptr = NULL; 1555 state->anchor.ptr = NULL; 1556 state->rt_kif = NULL; 1557 state->creation = time_second; 1558 state->pfsync_time = 0; 1559 state->packets[0] = state->packets[1] = 0; 1560 state->bytes[0] = state->bytes[1] = 0; 1561 1562 if (pf_insert_state(kif, state)) { 1563 pfi_maybe_destroy(kif); 1564 pool_put(&pf_state_pl, state); 1565 error = ENOMEM; 1566 } 1567 splx(s); 1568 break; 1569 } 1570 1571 case DIOCGETSTATE: { 1572 struct pfioc_state *ps = (struct pfioc_state *)addr; 1573 struct pf_state *state; 1574 u_int32_t nr; 1575 1576 nr = 0; 1577 s = splsoftnet(); 1578 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1579 if (nr >= ps->nr) 1580 break; 1581 nr++; 1582 } 1583 if (state == NULL) { 1584 error = EBUSY; 1585 splx(s); 1586 break; 1587 } 1588 bcopy(state, &ps->state, sizeof(struct pf_state)); 1589 ps->state.rule.nr = state->rule.ptr->nr; 1590 ps->state.nat_rule.nr = (state->nat_rule.ptr == NULL) ? 1591 -1 : state->nat_rule.ptr->nr; 1592 ps->state.anchor.nr = (state->anchor.ptr == NULL) ? 1593 -1 : state->anchor.ptr->nr; 1594 splx(s); 1595 ps->state.expire = pf_state_expires(state); 1596 if (ps->state.expire > time_second) 1597 ps->state.expire -= time_second; 1598 else 1599 ps->state.expire = 0; 1600 break; 1601 } 1602 1603 case DIOCGETSTATES: { 1604 struct pfioc_states *ps = (struct pfioc_states *)addr; 1605 struct pf_state *state; 1606 struct pf_state *p, pstore; 1607 struct pfi_kif *kif; 1608 u_int32_t nr = 0; 1609 int space = ps->ps_len; 1610 1611 if (space == 0) { 1612 s = splsoftnet(); 1613 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1614 nr += kif->pfik_states; 1615 splx(s); 1616 ps->ps_len = sizeof(struct pf_state) * nr; 1617 return (0); 1618 } 1619 1620 s = splsoftnet(); 1621 p = ps->ps_states; 1622 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1623 RB_FOREACH(state, pf_state_tree_ext_gwy, 1624 &kif->pfik_ext_gwy) { 1625 int secs = time_second; 1626 1627 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1628 break; 1629 1630 bcopy(state, &pstore, sizeof(pstore)); 1631 strlcpy(pstore.u.ifname, kif->pfik_name, 1632 sizeof(pstore.u.ifname)); 1633 pstore.rule.nr = state->rule.ptr->nr; 1634 pstore.nat_rule.nr = (state->nat_rule.ptr == 1635 NULL) ? -1 : state->nat_rule.ptr->nr; 1636 pstore.anchor.nr = (state->anchor.ptr == 1637 NULL) ? -1 : state->anchor.ptr->nr; 1638 pstore.creation = secs - pstore.creation; 1639 pstore.expire = pf_state_expires(state); 1640 if (pstore.expire > secs) 1641 pstore.expire -= secs; 1642 else 1643 pstore.expire = 0; 1644 error = copyout(&pstore, p, sizeof(*p)); 1645 if (error) { 1646 splx(s); 1647 goto fail; 1648 } 1649 p++; 1650 nr++; 1651 } 1652 ps->ps_len = sizeof(struct pf_state) * nr; 1653 splx(s); 1654 break; 1655 } 1656 1657 case DIOCGETSTATUS: { 1658 struct pf_status *s = (struct pf_status *)addr; 1659 bcopy(&pf_status, s, sizeof(struct pf_status)); 1660 pfi_fill_oldstatus(s); 1661 break; 1662 } 1663 1664 case DIOCSETSTATUSIF: { 1665 struct pfioc_if *pi = (struct pfioc_if *)addr; 1666 1667 if (pi->ifname[0] == 0) { 1668 bzero(pf_status.ifname, IFNAMSIZ); 1669 break; 1670 } 1671 if (ifunit(pi->ifname) == NULL) { 1672 error = EINVAL; 1673 break; 1674 } 1675 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 1676 break; 1677 } 1678 1679 case DIOCCLRSTATUS: { 1680 bzero(pf_status.counters, sizeof(pf_status.counters)); 1681 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 1682 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 1683 if (*pf_status.ifname) 1684 pfi_clr_istats(pf_status.ifname, NULL, 1685 PFI_FLAG_INSTANCE); 1686 break; 1687 } 1688 1689 case DIOCNATLOOK: { 1690 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1691 struct pf_state *state; 1692 struct pf_state key; 1693 int m = 0, direction = pnl->direction; 1694 1695 key.af = pnl->af; 1696 key.proto = pnl->proto; 1697 1698 if (!pnl->proto || 1699 PF_AZERO(&pnl->saddr, pnl->af) || 1700 PF_AZERO(&pnl->daddr, pnl->af) || 1701 !pnl->dport || !pnl->sport) 1702 error = EINVAL; 1703 else { 1704 s = splsoftnet(); 1705 1706 /* 1707 * userland gives us source and dest of connection, 1708 * reverse the lookup so we ask for what happens with 1709 * the return traffic, enabling us to find it in the 1710 * state tree. 1711 */ 1712 if (direction == PF_IN) { 1713 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 1714 key.ext.port = pnl->dport; 1715 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 1716 key.gwy.port = pnl->sport; 1717 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 1718 } else { 1719 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 1720 key.lan.port = pnl->dport; 1721 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 1722 key.ext.port = pnl->sport; 1723 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 1724 } 1725 if (m > 1) 1726 error = E2BIG; /* more than one state */ 1727 else if (state != NULL) { 1728 if (direction == PF_IN) { 1729 PF_ACPY(&pnl->rsaddr, &state->lan.addr, 1730 state->af); 1731 pnl->rsport = state->lan.port; 1732 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 1733 pnl->af); 1734 pnl->rdport = pnl->dport; 1735 } else { 1736 PF_ACPY(&pnl->rdaddr, &state->gwy.addr, 1737 state->af); 1738 pnl->rdport = state->gwy.port; 1739 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 1740 pnl->af); 1741 pnl->rsport = pnl->sport; 1742 } 1743 } else 1744 error = ENOENT; 1745 splx(s); 1746 } 1747 break; 1748 } 1749 1750 case DIOCSETTIMEOUT: { 1751 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1752 int old; 1753 1754 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1755 pt->seconds < 0) { 1756 error = EINVAL; 1757 goto fail; 1758 } 1759 old = pf_default_rule.timeout[pt->timeout]; 1760 pf_default_rule.timeout[pt->timeout] = pt->seconds; 1761 pt->seconds = old; 1762 break; 1763 } 1764 1765 case DIOCGETTIMEOUT: { 1766 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1767 1768 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1769 error = EINVAL; 1770 goto fail; 1771 } 1772 pt->seconds = pf_default_rule.timeout[pt->timeout]; 1773 break; 1774 } 1775 1776 case DIOCGETLIMIT: { 1777 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1778 1779 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1780 error = EINVAL; 1781 goto fail; 1782 } 1783 pl->limit = pf_pool_limits[pl->index].limit; 1784 break; 1785 } 1786 1787 case DIOCSETLIMIT: { 1788 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1789 int old_limit; 1790 1791 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1792 pf_pool_limits[pl->index].pp == NULL) { 1793 error = EINVAL; 1794 goto fail; 1795 } 1796 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 1797 pl->limit, NULL, 0) != 0) { 1798 error = EBUSY; 1799 goto fail; 1800 } 1801 old_limit = pf_pool_limits[pl->index].limit; 1802 pf_pool_limits[pl->index].limit = pl->limit; 1803 pl->limit = old_limit; 1804 break; 1805 } 1806 1807 case DIOCSETDEBUG: { 1808 u_int32_t *level = (u_int32_t *)addr; 1809 1810 pf_status.debug = *level; 1811 break; 1812 } 1813 1814 case DIOCCLRRULECTRS: { 1815 struct pf_ruleset *ruleset = &pf_main_ruleset; 1816 struct pf_rule *rule; 1817 1818 s = splsoftnet(); 1819 TAILQ_FOREACH(rule, 1820 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) 1821 rule->evaluations = rule->packets = 1822 rule->bytes = 0; 1823 splx(s); 1824 break; 1825 } 1826 1827 #ifdef ALTQ 1828 case DIOCSTARTALTQ: { 1829 struct pf_altq *altq; 1830 1831 /* enable all altq interfaces on active list */ 1832 s = splsoftnet(); 1833 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1834 if (altq->qname[0] == 0) { 1835 error = pf_enable_altq(altq); 1836 if (error != 0) 1837 break; 1838 } 1839 } 1840 if (error == 0) 1841 pf_altq_running = 1; 1842 splx(s); 1843 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 1844 break; 1845 } 1846 1847 case DIOCSTOPALTQ: { 1848 struct pf_altq *altq; 1849 1850 /* disable all altq interfaces on active list */ 1851 s = splsoftnet(); 1852 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1853 if (altq->qname[0] == 0) { 1854 error = pf_disable_altq(altq); 1855 if (error != 0) 1856 break; 1857 } 1858 } 1859 if (error == 0) 1860 pf_altq_running = 0; 1861 splx(s); 1862 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 1863 break; 1864 } 1865 1866 case DIOCADDALTQ: { 1867 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1868 struct pf_altq *altq, *a; 1869 1870 if (pa->ticket != ticket_altqs_inactive) { 1871 error = EBUSY; 1872 break; 1873 } 1874 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 1875 if (altq == NULL) { 1876 error = ENOMEM; 1877 break; 1878 } 1879 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 1880 1881 /* 1882 * if this is for a queue, find the discipline and 1883 * copy the necessary fields 1884 */ 1885 if (altq->qname[0] != 0) { 1886 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 1887 error = EBUSY; 1888 pool_put(&pf_altq_pl, altq); 1889 break; 1890 } 1891 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 1892 if (strncmp(a->ifname, altq->ifname, 1893 IFNAMSIZ) == 0 && a->qname[0] == 0) { 1894 altq->altq_disc = a->altq_disc; 1895 break; 1896 } 1897 } 1898 } 1899 1900 error = altq_add(altq); 1901 if (error) { 1902 pool_put(&pf_altq_pl, altq); 1903 break; 1904 } 1905 1906 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 1907 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1908 break; 1909 } 1910 1911 case DIOCGETALTQS: { 1912 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1913 struct pf_altq *altq; 1914 1915 pa->nr = 0; 1916 s = splsoftnet(); 1917 TAILQ_FOREACH(altq, pf_altqs_active, entries) 1918 pa->nr++; 1919 pa->ticket = ticket_altqs_active; 1920 splx(s); 1921 break; 1922 } 1923 1924 case DIOCGETALTQ: { 1925 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1926 struct pf_altq *altq; 1927 u_int32_t nr; 1928 1929 if (pa->ticket != ticket_altqs_active) { 1930 error = EBUSY; 1931 break; 1932 } 1933 nr = 0; 1934 s = splsoftnet(); 1935 altq = TAILQ_FIRST(pf_altqs_active); 1936 while ((altq != NULL) && (nr < pa->nr)) { 1937 altq = TAILQ_NEXT(altq, entries); 1938 nr++; 1939 } 1940 if (altq == NULL) { 1941 error = EBUSY; 1942 splx(s); 1943 break; 1944 } 1945 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1946 splx(s); 1947 break; 1948 } 1949 1950 case DIOCCHANGEALTQ: 1951 /* CHANGEALTQ not supported yet! */ 1952 error = ENODEV; 1953 break; 1954 1955 case DIOCGETQSTATS: { 1956 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 1957 struct pf_altq *altq; 1958 u_int32_t nr; 1959 int nbytes; 1960 1961 if (pq->ticket != ticket_altqs_active) { 1962 error = EBUSY; 1963 break; 1964 } 1965 nbytes = pq->nbytes; 1966 nr = 0; 1967 s = splsoftnet(); 1968 altq = TAILQ_FIRST(pf_altqs_active); 1969 while ((altq != NULL) && (nr < pq->nr)) { 1970 altq = TAILQ_NEXT(altq, entries); 1971 nr++; 1972 } 1973 if (altq == NULL) { 1974 error = EBUSY; 1975 splx(s); 1976 break; 1977 } 1978 error = altq_getqstats(altq, pq->buf, &nbytes); 1979 splx(s); 1980 if (error == 0) { 1981 pq->scheduler = altq->scheduler; 1982 pq->nbytes = nbytes; 1983 } 1984 break; 1985 } 1986 #endif /* ALTQ */ 1987 1988 case DIOCBEGINADDRS: { 1989 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 1990 1991 pf_empty_pool(&pf_pabuf); 1992 pp->ticket = ++ticket_pabuf; 1993 break; 1994 } 1995 1996 case DIOCADDADDR: { 1997 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 1998 1999 #ifndef INET 2000 if (pp->af == AF_INET) { 2001 error = EAFNOSUPPORT; 2002 break; 2003 } 2004 #endif /* INET */ 2005 #ifndef INET6 2006 if (pp->af == AF_INET6) { 2007 error = EAFNOSUPPORT; 2008 break; 2009 } 2010 #endif /* INET6 */ 2011 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2012 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2013 pp->addr.addr.type != PF_ADDR_TABLE) { 2014 error = EINVAL; 2015 break; 2016 } 2017 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2018 if (pa == NULL) { 2019 error = ENOMEM; 2020 break; 2021 } 2022 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2023 if (pa->ifname[0]) { 2024 pa->kif = pfi_attach_rule(pa->ifname); 2025 if (pa->kif == NULL) { 2026 pool_put(&pf_pooladdr_pl, pa); 2027 error = EINVAL; 2028 break; 2029 } 2030 } 2031 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 2032 pfi_dynaddr_remove(&pa->addr); 2033 pfi_detach_rule(pa->kif); 2034 pool_put(&pf_pooladdr_pl, pa); 2035 error = EINVAL; 2036 break; 2037 } 2038 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 2039 break; 2040 } 2041 2042 case DIOCGETADDRS: { 2043 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2044 2045 pp->nr = 0; 2046 s = splsoftnet(); 2047 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2048 pp->r_num, 0, 1, 0); 2049 if (pool == NULL) { 2050 error = EBUSY; 2051 splx(s); 2052 break; 2053 } 2054 TAILQ_FOREACH(pa, &pool->list, entries) 2055 pp->nr++; 2056 splx(s); 2057 break; 2058 } 2059 2060 case DIOCGETADDR: { 2061 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2062 u_int32_t nr = 0; 2063 2064 s = splsoftnet(); 2065 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2066 pp->r_num, 0, 1, 1); 2067 if (pool == NULL) { 2068 error = EBUSY; 2069 splx(s); 2070 break; 2071 } 2072 pa = TAILQ_FIRST(&pool->list); 2073 while ((pa != NULL) && (nr < pp->nr)) { 2074 pa = TAILQ_NEXT(pa, entries); 2075 nr++; 2076 } 2077 if (pa == NULL) { 2078 error = EBUSY; 2079 splx(s); 2080 break; 2081 } 2082 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2083 pfi_dynaddr_copyout(&pp->addr.addr); 2084 pf_tbladdr_copyout(&pp->addr.addr); 2085 splx(s); 2086 break; 2087 } 2088 2089 case DIOCCHANGEADDR: { 2090 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2091 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2092 struct pf_ruleset *ruleset; 2093 2094 if (pca->action < PF_CHANGE_ADD_HEAD || 2095 pca->action > PF_CHANGE_REMOVE) { 2096 error = EINVAL; 2097 break; 2098 } 2099 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2100 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2101 pca->addr.addr.type != PF_ADDR_TABLE) { 2102 error = EINVAL; 2103 break; 2104 } 2105 2106 ruleset = pf_find_ruleset(pca->anchor); 2107 if (ruleset == NULL) { 2108 error = EBUSY; 2109 break; 2110 } 2111 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2112 pca->r_num, pca->r_last, 1, 1); 2113 if (pool == NULL) { 2114 error = EBUSY; 2115 break; 2116 } 2117 if (pca->action != PF_CHANGE_REMOVE) { 2118 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2119 if (newpa == NULL) { 2120 error = ENOMEM; 2121 break; 2122 } 2123 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2124 #ifndef INET 2125 if (pca->af == AF_INET) { 2126 pool_put(&pf_pooladdr_pl, newpa); 2127 error = EAFNOSUPPORT; 2128 break; 2129 } 2130 #endif /* INET */ 2131 #ifndef INET6 2132 if (pca->af == AF_INET6) { 2133 pool_put(&pf_pooladdr_pl, newpa); 2134 error = EAFNOSUPPORT; 2135 break; 2136 } 2137 #endif /* INET6 */ 2138 if (newpa->ifname[0]) { 2139 newpa->kif = pfi_attach_rule(newpa->ifname); 2140 if (newpa->kif == NULL) { 2141 pool_put(&pf_pooladdr_pl, newpa); 2142 error = EINVAL; 2143 break; 2144 } 2145 } else 2146 newpa->kif = NULL; 2147 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2148 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2149 pfi_dynaddr_remove(&newpa->addr); 2150 pfi_detach_rule(newpa->kif); 2151 pool_put(&pf_pooladdr_pl, newpa); 2152 error = EINVAL; 2153 break; 2154 } 2155 } 2156 2157 s = splsoftnet(); 2158 2159 if (pca->action == PF_CHANGE_ADD_HEAD) 2160 oldpa = TAILQ_FIRST(&pool->list); 2161 else if (pca->action == PF_CHANGE_ADD_TAIL) 2162 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2163 else { 2164 int i = 0; 2165 2166 oldpa = TAILQ_FIRST(&pool->list); 2167 while ((oldpa != NULL) && (i < pca->nr)) { 2168 oldpa = TAILQ_NEXT(oldpa, entries); 2169 i++; 2170 } 2171 if (oldpa == NULL) { 2172 error = EINVAL; 2173 splx(s); 2174 break; 2175 } 2176 } 2177 2178 if (pca->action == PF_CHANGE_REMOVE) { 2179 TAILQ_REMOVE(&pool->list, oldpa, entries); 2180 pfi_dynaddr_remove(&oldpa->addr); 2181 pf_tbladdr_remove(&oldpa->addr); 2182 pfi_detach_rule(oldpa->kif); 2183 pool_put(&pf_pooladdr_pl, oldpa); 2184 } else { 2185 if (oldpa == NULL) 2186 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2187 else if (pca->action == PF_CHANGE_ADD_HEAD || 2188 pca->action == PF_CHANGE_ADD_BEFORE) 2189 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2190 else 2191 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2192 newpa, entries); 2193 } 2194 2195 pool->cur = TAILQ_FIRST(&pool->list); 2196 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2197 pca->af); 2198 splx(s); 2199 break; 2200 } 2201 2202 case DIOCGETRULESETS: { 2203 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2204 struct pf_ruleset *ruleset; 2205 struct pf_anchor *anchor; 2206 2207 pr->path[sizeof(pr->path) - 1] = 0; 2208 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2209 error = EINVAL; 2210 break; 2211 } 2212 pr->nr = 0; 2213 if (ruleset->anchor == NULL) { 2214 /* XXX kludge for pf_main_ruleset */ 2215 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2216 if (anchor->parent == NULL) 2217 pr->nr++; 2218 } else { 2219 RB_FOREACH(anchor, pf_anchor_node, 2220 &ruleset->anchor->children) 2221 pr->nr++; 2222 } 2223 break; 2224 } 2225 2226 case DIOCGETRULESET: { 2227 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2228 struct pf_ruleset *ruleset; 2229 struct pf_anchor *anchor; 2230 u_int32_t nr = 0; 2231 2232 pr->path[sizeof(pr->path) - 1] = 0; 2233 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2234 error = EINVAL; 2235 break; 2236 } 2237 pr->name[0] = 0; 2238 if (ruleset->anchor == NULL) { 2239 /* XXX kludge for pf_main_ruleset */ 2240 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2241 if (anchor->parent == NULL && nr++ == pr->nr) { 2242 strlcpy(pr->name, anchor->name, 2243 sizeof(pr->name)); 2244 break; 2245 } 2246 } else { 2247 RB_FOREACH(anchor, pf_anchor_node, 2248 &ruleset->anchor->children) 2249 if (nr++ == pr->nr) { 2250 strlcpy(pr->name, anchor->name, 2251 sizeof(pr->name)); 2252 break; 2253 } 2254 } 2255 if (!pr->name[0]) 2256 error = EBUSY; 2257 break; 2258 } 2259 2260 case DIOCRCLRTABLES: { 2261 struct pfioc_table *io = (struct pfioc_table *)addr; 2262 2263 if (io->pfrio_esize != 0) { 2264 error = ENODEV; 2265 break; 2266 } 2267 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2268 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2269 break; 2270 } 2271 2272 case DIOCRADDTABLES: { 2273 struct pfioc_table *io = (struct pfioc_table *)addr; 2274 2275 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2276 error = ENODEV; 2277 break; 2278 } 2279 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2280 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2281 break; 2282 } 2283 2284 case DIOCRDELTABLES: { 2285 struct pfioc_table *io = (struct pfioc_table *)addr; 2286 2287 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2288 error = ENODEV; 2289 break; 2290 } 2291 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2292 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2293 break; 2294 } 2295 2296 case DIOCRGETTABLES: { 2297 struct pfioc_table *io = (struct pfioc_table *)addr; 2298 2299 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2300 error = ENODEV; 2301 break; 2302 } 2303 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2304 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2305 break; 2306 } 2307 2308 case DIOCRGETTSTATS: { 2309 struct pfioc_table *io = (struct pfioc_table *)addr; 2310 2311 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2312 error = ENODEV; 2313 break; 2314 } 2315 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2316 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2317 break; 2318 } 2319 2320 case DIOCRCLRTSTATS: { 2321 struct pfioc_table *io = (struct pfioc_table *)addr; 2322 2323 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2324 error = ENODEV; 2325 break; 2326 } 2327 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2328 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2329 break; 2330 } 2331 2332 case DIOCRSETTFLAGS: { 2333 struct pfioc_table *io = (struct pfioc_table *)addr; 2334 2335 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2336 error = ENODEV; 2337 break; 2338 } 2339 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2340 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2341 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2342 break; 2343 } 2344 2345 case DIOCRCLRADDRS: { 2346 struct pfioc_table *io = (struct pfioc_table *)addr; 2347 2348 if (io->pfrio_esize != 0) { 2349 error = ENODEV; 2350 break; 2351 } 2352 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2353 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2354 break; 2355 } 2356 2357 case DIOCRADDADDRS: { 2358 struct pfioc_table *io = (struct pfioc_table *)addr; 2359 2360 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2361 error = ENODEV; 2362 break; 2363 } 2364 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2365 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2366 PFR_FLAG_USERIOCTL); 2367 break; 2368 } 2369 2370 case DIOCRDELADDRS: { 2371 struct pfioc_table *io = (struct pfioc_table *)addr; 2372 2373 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2374 error = ENODEV; 2375 break; 2376 } 2377 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2378 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2379 PFR_FLAG_USERIOCTL); 2380 break; 2381 } 2382 2383 case DIOCRSETADDRS: { 2384 struct pfioc_table *io = (struct pfioc_table *)addr; 2385 2386 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2387 error = ENODEV; 2388 break; 2389 } 2390 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2391 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2392 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2393 PFR_FLAG_USERIOCTL); 2394 break; 2395 } 2396 2397 case DIOCRGETADDRS: { 2398 struct pfioc_table *io = (struct pfioc_table *)addr; 2399 2400 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2401 error = ENODEV; 2402 break; 2403 } 2404 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2405 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2406 break; 2407 } 2408 2409 case DIOCRGETASTATS: { 2410 struct pfioc_table *io = (struct pfioc_table *)addr; 2411 2412 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2413 error = ENODEV; 2414 break; 2415 } 2416 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2417 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2418 break; 2419 } 2420 2421 case DIOCRCLRASTATS: { 2422 struct pfioc_table *io = (struct pfioc_table *)addr; 2423 2424 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2425 error = ENODEV; 2426 break; 2427 } 2428 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2429 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2430 PFR_FLAG_USERIOCTL); 2431 break; 2432 } 2433 2434 case DIOCRTSTADDRS: { 2435 struct pfioc_table *io = (struct pfioc_table *)addr; 2436 2437 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2438 error = ENODEV; 2439 break; 2440 } 2441 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2442 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2443 PFR_FLAG_USERIOCTL); 2444 break; 2445 } 2446 2447 case DIOCRINADEFINE: { 2448 struct pfioc_table *io = (struct pfioc_table *)addr; 2449 2450 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2451 error = ENODEV; 2452 break; 2453 } 2454 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2455 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2456 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2457 break; 2458 } 2459 2460 case DIOCOSFPADD: { 2461 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2462 s = splsoftnet(); 2463 error = pf_osfp_add(io); 2464 splx(s); 2465 break; 2466 } 2467 2468 case DIOCOSFPGET: { 2469 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2470 s = splsoftnet(); 2471 error = pf_osfp_get(io); 2472 splx(s); 2473 break; 2474 } 2475 2476 case DIOCXBEGIN: { 2477 struct pfioc_trans *io = (struct pfioc_trans *) 2478 addr; 2479 static struct pfioc_trans_e ioe; 2480 static struct pfr_table table; 2481 int i; 2482 2483 if (io->esize != sizeof(ioe)) { 2484 error = ENODEV; 2485 goto fail; 2486 } 2487 for (i = 0; i < io->size; i++) { 2488 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2489 error = EFAULT; 2490 goto fail; 2491 } 2492 switch (ioe.rs_num) { 2493 #ifdef ALTQ 2494 case PF_RULESET_ALTQ: 2495 if (ioe.anchor[0]) { 2496 error = EINVAL; 2497 goto fail; 2498 } 2499 if ((error = pf_begin_altq(&ioe.ticket))) 2500 goto fail; 2501 break; 2502 #endif /* ALTQ */ 2503 case PF_RULESET_TABLE: 2504 bzero(&table, sizeof(table)); 2505 strlcpy(table.pfrt_anchor, ioe.anchor, 2506 sizeof(table.pfrt_anchor)); 2507 if ((error = pfr_ina_begin(&table, 2508 &ioe.ticket, NULL, 0))) 2509 goto fail; 2510 break; 2511 default: 2512 if ((error = pf_begin_rules(&ioe.ticket, 2513 ioe.rs_num, ioe.anchor))) 2514 goto fail; 2515 break; 2516 } 2517 if (copyout(&ioe, io->array+i, sizeof(io->array[i]))) { 2518 error = EFAULT; 2519 goto fail; 2520 } 2521 } 2522 break; 2523 } 2524 2525 case DIOCXROLLBACK: { 2526 struct pfioc_trans *io = (struct pfioc_trans *) 2527 addr; 2528 static struct pfioc_trans_e ioe; 2529 static struct pfr_table table; 2530 int i; 2531 2532 if (io->esize != sizeof(ioe)) { 2533 error = ENODEV; 2534 goto fail; 2535 } 2536 for (i = 0; i < io->size; i++) { 2537 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2538 error = EFAULT; 2539 goto fail; 2540 } 2541 switch (ioe.rs_num) { 2542 #ifdef ALTQ 2543 case PF_RULESET_ALTQ: 2544 if (ioe.anchor[0]) { 2545 error = EINVAL; 2546 goto fail; 2547 } 2548 if ((error = pf_rollback_altq(ioe.ticket))) 2549 goto fail; /* really bad */ 2550 break; 2551 #endif /* ALTQ */ 2552 case PF_RULESET_TABLE: 2553 bzero(&table, sizeof(table)); 2554 strlcpy(table.pfrt_anchor, ioe.anchor, 2555 sizeof(table.pfrt_anchor)); 2556 if ((error = pfr_ina_rollback(&table, 2557 ioe.ticket, NULL, 0))) 2558 goto fail; /* really bad */ 2559 break; 2560 default: 2561 if ((error = pf_rollback_rules(ioe.ticket, 2562 ioe.rs_num, ioe.anchor))) 2563 goto fail; /* really bad */ 2564 break; 2565 } 2566 } 2567 break; 2568 } 2569 2570 case DIOCXCOMMIT: { 2571 struct pfioc_trans *io = (struct pfioc_trans *) 2572 addr; 2573 static struct pfioc_trans_e ioe; 2574 static struct pfr_table table; 2575 struct pf_ruleset *rs; 2576 int i; 2577 2578 if (io->esize != sizeof(ioe)) { 2579 error = ENODEV; 2580 goto fail; 2581 } 2582 /* first makes sure everything will succeed */ 2583 for (i = 0; i < io->size; i++) { 2584 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2585 error = EFAULT; 2586 goto fail; 2587 } 2588 switch (ioe.rs_num) { 2589 #ifdef ALTQ 2590 case PF_RULESET_ALTQ: 2591 if (ioe.anchor[0]) { 2592 error = EINVAL; 2593 goto fail; 2594 } 2595 if (!altqs_inactive_open || ioe.ticket != 2596 ticket_altqs_inactive) { 2597 error = EBUSY; 2598 goto fail; 2599 } 2600 break; 2601 #endif /* ALTQ */ 2602 case PF_RULESET_TABLE: 2603 rs = pf_find_ruleset(ioe.anchor); 2604 if (rs == NULL || !rs->topen || ioe.ticket != 2605 rs->tticket) { 2606 error = EBUSY; 2607 goto fail; 2608 } 2609 break; 2610 default: 2611 if (ioe.rs_num < 0 || ioe.rs_num >= 2612 PF_RULESET_MAX) { 2613 error = EINVAL; 2614 goto fail; 2615 } 2616 rs = pf_find_ruleset(ioe.anchor); 2617 if (rs == NULL || 2618 !rs->rules[ioe.rs_num].inactive.open || 2619 rs->rules[ioe.rs_num].inactive.ticket != 2620 ioe.ticket) { 2621 error = EBUSY; 2622 goto fail; 2623 } 2624 break; 2625 } 2626 } 2627 /* now do the commit - no errors should happen here */ 2628 for (i = 0; i < io->size; i++) { 2629 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2630 error = EFAULT; 2631 goto fail; 2632 } 2633 switch (ioe.rs_num) { 2634 #ifdef ALTQ 2635 case PF_RULESET_ALTQ: 2636 if ((error = pf_commit_altq(ioe.ticket))) 2637 goto fail; /* really bad */ 2638 break; 2639 #endif /* ALTQ */ 2640 case PF_RULESET_TABLE: 2641 bzero(&table, sizeof(table)); 2642 strlcpy(table.pfrt_anchor, ioe.anchor, 2643 sizeof(table.pfrt_anchor)); 2644 if ((error = pfr_ina_commit(&table, ioe.ticket, 2645 NULL, NULL, 0))) 2646 goto fail; /* really bad */ 2647 break; 2648 default: 2649 if ((error = pf_commit_rules(ioe.ticket, 2650 ioe.rs_num, ioe.anchor))) 2651 goto fail; /* really bad */ 2652 break; 2653 } 2654 } 2655 break; 2656 } 2657 2658 case DIOCGETSRCNODES: { 2659 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 2660 struct pf_src_node *n; 2661 struct pf_src_node *p, pstore; 2662 u_int32_t nr = 0; 2663 int space = psn->psn_len; 2664 2665 if (space == 0) { 2666 s = splsoftnet(); 2667 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 2668 nr++; 2669 splx(s); 2670 psn->psn_len = sizeof(struct pf_src_node) * nr; 2671 return (0); 2672 } 2673 2674 s = splsoftnet(); 2675 p = psn->psn_src_nodes; 2676 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2677 int secs = time_second; 2678 2679 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 2680 break; 2681 2682 bcopy(n, &pstore, sizeof(pstore)); 2683 if (n->rule.ptr != NULL) 2684 pstore.rule.nr = n->rule.ptr->nr; 2685 pstore.creation = secs - pstore.creation; 2686 if (pstore.expire > secs) 2687 pstore.expire -= secs; 2688 else 2689 pstore.expire = 0; 2690 error = copyout(&pstore, p, sizeof(*p)); 2691 if (error) { 2692 splx(s); 2693 goto fail; 2694 } 2695 p++; 2696 nr++; 2697 } 2698 psn->psn_len = sizeof(struct pf_src_node) * nr; 2699 splx(s); 2700 break; 2701 } 2702 2703 case DIOCCLRSRCNODES: { 2704 struct pf_src_node *n; 2705 struct pf_state *state; 2706 2707 s = splsoftnet(); 2708 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 2709 state->src_node = NULL; 2710 state->nat_src_node = NULL; 2711 } 2712 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2713 n->expire = 1; 2714 n->states = 0; 2715 } 2716 pf_purge_expired_src_nodes(); 2717 pf_status.src_nodes = 0; 2718 splx(s); 2719 break; 2720 } 2721 2722 case DIOCSETHOSTID: { 2723 u_int32_t *hostid = (u_int32_t *)addr; 2724 2725 if (*hostid == 0) { 2726 error = EINVAL; 2727 goto fail; 2728 } 2729 pf_status.hostid = *hostid; 2730 break; 2731 } 2732 2733 case DIOCOSFPFLUSH: 2734 s = splsoftnet(); 2735 pf_osfp_flush(); 2736 splx(s); 2737 break; 2738 2739 case DIOCIGETIFACES: { 2740 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2741 2742 if (io->pfiio_esize != sizeof(struct pfi_if)) { 2743 error = ENODEV; 2744 break; 2745 } 2746 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 2747 &io->pfiio_size, io->pfiio_flags); 2748 break; 2749 } 2750 2751 case DIOCICLRISTATS: { 2752 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2753 2754 error = pfi_clr_istats(io->pfiio_name, &io->pfiio_nzero, 2755 io->pfiio_flags); 2756 break; 2757 } 2758 2759 default: 2760 error = ENODEV; 2761 break; 2762 } 2763 fail: 2764 2765 return (error); 2766 } 2767
Indexes created Thu Oct 02 14:10:14 GMT 2025