pf_ioctl.c revision 1.1.1.3
1 /* $OpenBSD: pf_ioctl.c,v 1.139 2005/03/03 07:13:39 dhartmei Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include "pfsync.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/mbuf.h> 43 #include <sys/filio.h> 44 #include <sys/fcntl.h> 45 #include <sys/socket.h> 46 #include <sys/socketvar.h> 47 #include <sys/kernel.h> 48 #include <sys/time.h> 49 #include <sys/timeout.h> 50 #include <sys/pool.h> 51 #include <sys/malloc.h> 52 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/route.h> 56 57 #include <netinet/in.h> 58 #include <netinet/in_var.h> 59 #include <netinet/in_systm.h> 60 #include <netinet/ip.h> 61 #include <netinet/ip_var.h> 62 #include <netinet/ip_icmp.h> 63 64 #include <dev/rndvar.h> 65 #include <net/pfvar.h> 66 67 #if NPFSYNC > 0 68 #include <net/if_pfsync.h> 69 #endif /* NPFSYNC > 0 */ 70 71 #ifdef INET6 72 #include <netinet/ip6.h> 73 #include <netinet/in_pcb.h> 74 #endif /* INET6 */ 75 76 #ifdef ALTQ 77 #include <altq/altq.h> 78 #endif 79 80 void pfattach(int); 81 int pfopen(dev_t, int, int, struct proc *); 82 int pfclose(dev_t, int, int, struct proc *); 83 struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 84 u_int8_t, u_int8_t, u_int8_t); 85 int pf_get_ruleset_number(u_int8_t); 86 void pf_init_ruleset(struct pf_ruleset *); 87 int pf_anchor_setup(struct pf_rule *, 88 const struct pf_ruleset *, const char *); 89 int pf_anchor_copyout(const struct pf_ruleset *, 90 const struct pf_rule *, struct pfioc_rule *); 91 void pf_anchor_remove(struct pf_rule *); 92 93 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 94 void pf_empty_pool(struct pf_palist *); 95 int pfioctl(dev_t, u_long, caddr_t, int, struct proc *); 96 #ifdef ALTQ 97 int pf_begin_altq(u_int32_t *); 98 int pf_rollback_altq(u_int32_t); 99 int pf_commit_altq(u_int32_t); 100 int pf_enable_altq(struct pf_altq *); 101 int pf_disable_altq(struct pf_altq *); 102 #endif /* ALTQ */ 103 int pf_begin_rules(u_int32_t *, int, const char *); 104 int pf_rollback_rules(u_int32_t, int, char *); 105 int pf_commit_rules(u_int32_t, int, char *); 106 107 extern struct timeout pf_expire_to; 108 109 struct pf_rule pf_default_rule; 110 #ifdef ALTQ 111 static int pf_altq_running; 112 #endif 113 114 #define TAGID_MAX 50000 115 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 116 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 117 118 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 119 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 120 #endif 121 static u_int16_t tagname2tag(struct pf_tags *, char *); 122 static void tag2tagname(struct pf_tags *, u_int16_t, char *); 123 static void tag_unref(struct pf_tags *, u_int16_t); 124 int pf_rtlabel_add(struct pf_addr_wrap *); 125 void pf_rtlabel_remove(struct pf_addr_wrap *); 126 void pf_rtlabel_copyout(struct pf_addr_wrap *); 127 128 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 129 130 void 131 pfattach(int num) 132 { 133 u_int32_t *timeout = pf_default_rule.timeout; 134 135 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 136 &pool_allocator_nointr); 137 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 138 "pfsrctrpl", NULL); 139 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 140 NULL); 141 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 142 &pool_allocator_nointr); 143 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 144 "pfpooladdrpl", &pool_allocator_nointr); 145 pfr_initialize(); 146 pfi_initialize(); 147 pf_osfp_initialize(); 148 149 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 150 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 151 152 RB_INIT(&tree_src_tracking); 153 RB_INIT(&pf_anchors); 154 pf_init_ruleset(&pf_main_ruleset); 155 TAILQ_INIT(&pf_altqs[0]); 156 TAILQ_INIT(&pf_altqs[1]); 157 TAILQ_INIT(&pf_pabuf); 158 pf_altqs_active = &pf_altqs[0]; 159 pf_altqs_inactive = &pf_altqs[1]; 160 TAILQ_INIT(&state_updates); 161 162 /* default rule should never be garbage collected */ 163 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 164 pf_default_rule.action = PF_PASS; 165 pf_default_rule.nr = -1; 166 167 /* initialize default timeouts */ 168 timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 169 timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 170 timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 171 timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 172 timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 173 timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 174 timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 175 timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 176 timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 177 timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 178 timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 179 timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 180 timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 181 timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 182 timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 183 timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 184 timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 185 timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 186 187 timeout_set(&pf_expire_to, pf_purge_timeout, &pf_expire_to); 188 timeout_add(&pf_expire_to, timeout[PFTM_INTERVAL] * hz); 189 190 pf_normalize_init(); 191 bzero(&pf_status, sizeof(pf_status)); 192 pf_status.debug = PF_DEBUG_URGENT; 193 194 /* XXX do our best to avoid a conflict */ 195 pf_status.hostid = arc4random(); 196 } 197 198 int 199 pfopen(dev_t dev, int flags, int fmt, struct proc *p) 200 { 201 if (minor(dev) >= 1) 202 return (ENXIO); 203 return (0); 204 } 205 206 int 207 pfclose(dev_t dev, int flags, int fmt, struct proc *p) 208 { 209 if (minor(dev) >= 1) 210 return (ENXIO); 211 return (0); 212 } 213 214 struct pf_pool * 215 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 216 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 217 u_int8_t check_ticket) 218 { 219 struct pf_ruleset *ruleset; 220 struct pf_rule *rule; 221 int rs_num; 222 223 ruleset = pf_find_ruleset(anchor); 224 if (ruleset == NULL) 225 return (NULL); 226 rs_num = pf_get_ruleset_number(rule_action); 227 if (rs_num >= PF_RULESET_MAX) 228 return (NULL); 229 if (active) { 230 if (check_ticket && ticket != 231 ruleset->rules[rs_num].active.ticket) 232 return (NULL); 233 if (r_last) 234 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 235 pf_rulequeue); 236 else 237 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 238 } else { 239 if (check_ticket && ticket != 240 ruleset->rules[rs_num].inactive.ticket) 241 return (NULL); 242 if (r_last) 243 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 244 pf_rulequeue); 245 else 246 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 247 } 248 if (!r_last) { 249 while ((rule != NULL) && (rule->nr != rule_number)) 250 rule = TAILQ_NEXT(rule, entries); 251 } 252 if (rule == NULL) 253 return (NULL); 254 255 return (&rule->rpool); 256 } 257 258 int 259 pf_get_ruleset_number(u_int8_t action) 260 { 261 switch (action) { 262 case PF_SCRUB: 263 case PF_NOSCRUB: 264 return (PF_RULESET_SCRUB); 265 break; 266 case PF_PASS: 267 case PF_DROP: 268 return (PF_RULESET_FILTER); 269 break; 270 case PF_NAT: 271 case PF_NONAT: 272 return (PF_RULESET_NAT); 273 break; 274 case PF_BINAT: 275 case PF_NOBINAT: 276 return (PF_RULESET_BINAT); 277 break; 278 case PF_RDR: 279 case PF_NORDR: 280 return (PF_RULESET_RDR); 281 break; 282 default: 283 return (PF_RULESET_MAX); 284 break; 285 } 286 } 287 288 void 289 pf_init_ruleset(struct pf_ruleset *ruleset) 290 { 291 int i; 292 293 memset(ruleset, 0, sizeof(struct pf_ruleset)); 294 for (i = 0; i < PF_RULESET_MAX; i++) { 295 TAILQ_INIT(&ruleset->rules[i].queues[0]); 296 TAILQ_INIT(&ruleset->rules[i].queues[1]); 297 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 298 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 299 } 300 } 301 302 struct pf_anchor * 303 pf_find_anchor(const char *path) 304 { 305 static struct pf_anchor key; 306 307 memset(&key, 0, sizeof(key)); 308 strlcpy(key.path, path, sizeof(key.path)); 309 return (RB_FIND(pf_anchor_global, &pf_anchors, &key)); 310 } 311 312 struct pf_ruleset * 313 pf_find_ruleset(const char *path) 314 { 315 struct pf_anchor *anchor; 316 317 while (*path == '/') 318 path++; 319 if (!*path) 320 return (&pf_main_ruleset); 321 anchor = pf_find_anchor(path); 322 if (anchor == NULL) 323 return (NULL); 324 else 325 return (&anchor->ruleset); 326 } 327 328 struct pf_ruleset * 329 pf_find_or_create_ruleset(const char *path) 330 { 331 static char p[MAXPATHLEN]; 332 char *q, *r; 333 struct pf_ruleset *ruleset; 334 struct pf_anchor *anchor, *dup, *parent = NULL; 335 336 while (*path == '/') 337 path++; 338 ruleset = pf_find_ruleset(path); 339 if (ruleset != NULL) 340 return (ruleset); 341 strlcpy(p, path, sizeof(p)); 342 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 343 *q = 0; 344 if ((ruleset = pf_find_ruleset(p)) != NULL) { 345 parent = ruleset->anchor; 346 break; 347 } 348 } 349 if (q == NULL) 350 q = p; 351 else 352 q++; 353 strlcpy(p, path, sizeof(p)); 354 if (!*q) 355 return (NULL); 356 while ((r = strchr(q, '/')) != NULL || *q) { 357 if (r != NULL) 358 *r = 0; 359 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 360 (parent != NULL && strlen(parent->path) >= 361 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) 362 return (NULL); 363 anchor = (struct pf_anchor *)malloc(sizeof(*anchor), M_TEMP, 364 M_NOWAIT); 365 if (anchor == NULL) 366 return (NULL); 367 memset(anchor, 0, sizeof(*anchor)); 368 RB_INIT(&anchor->children); 369 strlcpy(anchor->name, q, sizeof(anchor->name)); 370 if (parent != NULL) { 371 strlcpy(anchor->path, parent->path, 372 sizeof(anchor->path)); 373 strlcat(anchor->path, "/", sizeof(anchor->path)); 374 } 375 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 376 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != 377 NULL) { 378 printf("pf_find_or_create_ruleset: RB_INSERT1 " 379 "'%s' '%s' collides with '%s' '%s'\n", 380 anchor->path, anchor->name, dup->path, dup->name); 381 free(anchor, M_TEMP); 382 return (NULL); 383 } 384 if (parent != NULL) { 385 anchor->parent = parent; 386 if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 387 anchor)) != NULL) { 388 printf("pf_find_or_create_ruleset: " 389 "RB_INSERT2 '%s' '%s' collides with " 390 "'%s' '%s'\n", anchor->path, anchor->name, 391 dup->path, dup->name); 392 RB_REMOVE(pf_anchor_global, &pf_anchors, 393 anchor); 394 free(anchor, M_TEMP); 395 return (NULL); 396 } 397 } 398 pf_init_ruleset(&anchor->ruleset); 399 anchor->ruleset.anchor = anchor; 400 parent = anchor; 401 if (r != NULL) 402 q = r + 1; 403 else 404 *q = 0; 405 } 406 return (&anchor->ruleset); 407 } 408 409 void 410 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 411 { 412 struct pf_anchor *parent; 413 int i; 414 415 while (ruleset != NULL) { 416 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 417 !RB_EMPTY(&ruleset->anchor->children) || 418 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 419 ruleset->topen) 420 return; 421 for (i = 0; i < PF_RULESET_MAX; ++i) 422 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 423 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 424 ruleset->rules[i].inactive.open) 425 return; 426 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); 427 if ((parent = ruleset->anchor->parent) != NULL) 428 RB_REMOVE(pf_anchor_node, &parent->children, 429 ruleset->anchor); 430 free(ruleset->anchor, M_TEMP); 431 if (parent == NULL) 432 return; 433 ruleset = &parent->ruleset; 434 } 435 } 436 437 int 438 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 439 const char *name) 440 { 441 static char *p, path[MAXPATHLEN]; 442 struct pf_ruleset *ruleset; 443 444 r->anchor = NULL; 445 r->anchor_relative = 0; 446 r->anchor_wildcard = 0; 447 if (!name[0]) 448 return (0); 449 if (name[0] == '/') 450 strlcpy(path, name + 1, sizeof(path)); 451 else { 452 /* relative path */ 453 r->anchor_relative = 1; 454 if (s->anchor == NULL || !s->anchor->path[0]) 455 path[0] = 0; 456 else 457 strlcpy(path, s->anchor->path, sizeof(path)); 458 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 459 if (!path[0]) { 460 printf("pf_anchor_setup: .. beyond root\n"); 461 return (1); 462 } 463 if ((p = strrchr(path, '/')) != NULL) 464 *p = 0; 465 else 466 path[0] = 0; 467 r->anchor_relative++; 468 name += 3; 469 } 470 if (path[0]) 471 strlcat(path, "/", sizeof(path)); 472 strlcat(path, name, sizeof(path)); 473 } 474 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 475 r->anchor_wildcard = 1; 476 *p = 0; 477 } 478 ruleset = pf_find_or_create_ruleset(path); 479 if (ruleset == NULL || ruleset->anchor == NULL) { 480 printf("pf_anchor_setup: ruleset\n"); 481 return (1); 482 } 483 r->anchor = ruleset->anchor; 484 r->anchor->refcnt++; 485 return (0); 486 } 487 488 int 489 pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, 490 struct pfioc_rule *pr) 491 { 492 pr->anchor_call[0] = 0; 493 if (r->anchor == NULL) 494 return (0); 495 if (!r->anchor_relative) { 496 strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call)); 497 strlcat(pr->anchor_call, r->anchor->path, 498 sizeof(pr->anchor_call)); 499 } else { 500 char a[MAXPATHLEN], b[MAXPATHLEN], *p; 501 int i; 502 503 if (rs->anchor == NULL) 504 a[0] = 0; 505 else 506 strlcpy(a, rs->anchor->path, sizeof(a)); 507 strlcpy(b, r->anchor->path, sizeof(b)); 508 for (i = 1; i < r->anchor_relative; ++i) { 509 if ((p = strrchr(a, '/')) == NULL) 510 p = a; 511 *p = 0; 512 strlcat(pr->anchor_call, "../", 513 sizeof(pr->anchor_call)); 514 } 515 if (strncmp(a, b, strlen(a))) { 516 printf("pf_anchor_copyout: '%s' '%s'\n", a, b); 517 return (1); 518 } 519 if (strlen(b) > strlen(a)) 520 strlcat(pr->anchor_call, b + (a[0] ? strlen(a) + 1 : 0), 521 sizeof(pr->anchor_call)); 522 } 523 if (r->anchor_wildcard) 524 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*", 525 sizeof(pr->anchor_call)); 526 return (0); 527 } 528 529 void 530 pf_anchor_remove(struct pf_rule *r) 531 { 532 if (r->anchor == NULL) 533 return; 534 if (r->anchor->refcnt <= 0) { 535 printf("pf_anchor_remove: broken refcount"); 536 r->anchor = NULL; 537 return; 538 } 539 if (!--r->anchor->refcnt) 540 pf_remove_if_empty_ruleset(&r->anchor->ruleset); 541 r->anchor = NULL; 542 } 543 544 void 545 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 546 { 547 struct pf_pooladdr *mv_pool_pa; 548 549 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 550 TAILQ_REMOVE(poola, mv_pool_pa, entries); 551 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 552 } 553 } 554 555 void 556 pf_empty_pool(struct pf_palist *poola) 557 { 558 struct pf_pooladdr *empty_pool_pa; 559 560 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 561 pfi_dynaddr_remove(&empty_pool_pa->addr); 562 pf_tbladdr_remove(&empty_pool_pa->addr); 563 pfi_detach_rule(empty_pool_pa->kif); 564 TAILQ_REMOVE(poola, empty_pool_pa, entries); 565 pool_put(&pf_pooladdr_pl, empty_pool_pa); 566 } 567 } 568 569 void 570 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 571 { 572 if (rulequeue != NULL) { 573 if (rule->states <= 0) { 574 /* 575 * XXX - we need to remove the table *before* detaching 576 * the rule to make sure the table code does not delete 577 * the anchor under our feet. 578 */ 579 pf_tbladdr_remove(&rule->src.addr); 580 pf_tbladdr_remove(&rule->dst.addr); 581 if (rule->overload_tbl) 582 pfr_detach_table(rule->overload_tbl); 583 } 584 TAILQ_REMOVE(rulequeue, rule, entries); 585 rule->entries.tqe_prev = NULL; 586 rule->nr = -1; 587 } 588 589 if (rule->states > 0 || rule->src_nodes > 0 || 590 rule->entries.tqe_prev != NULL) 591 return; 592 pf_tag_unref(rule->tag); 593 pf_tag_unref(rule->match_tag); 594 #ifdef ALTQ 595 if (rule->pqid != rule->qid) 596 pf_qid_unref(rule->pqid); 597 pf_qid_unref(rule->qid); 598 #endif 599 pf_rtlabel_remove(&rule->src.addr); 600 pf_rtlabel_remove(&rule->dst.addr); 601 pfi_dynaddr_remove(&rule->src.addr); 602 pfi_dynaddr_remove(&rule->dst.addr); 603 if (rulequeue == NULL) { 604 pf_tbladdr_remove(&rule->src.addr); 605 pf_tbladdr_remove(&rule->dst.addr); 606 if (rule->overload_tbl) 607 pfr_detach_table(rule->overload_tbl); 608 } 609 pfi_detach_rule(rule->kif); 610 pf_anchor_remove(rule); 611 pf_empty_pool(&rule->rpool.list); 612 pool_put(&pf_rule_pl, rule); 613 } 614 615 static u_int16_t 616 tagname2tag(struct pf_tags *head, char *tagname) 617 { 618 struct pf_tagname *tag, *p = NULL; 619 u_int16_t new_tagid = 1; 620 621 TAILQ_FOREACH(tag, head, entries) 622 if (strcmp(tagname, tag->name) == 0) { 623 tag->ref++; 624 return (tag->tag); 625 } 626 627 /* 628 * to avoid fragmentation, we do a linear search from the beginning 629 * and take the first free slot we find. if there is none or the list 630 * is empty, append a new entry at the end. 631 */ 632 633 /* new entry */ 634 if (!TAILQ_EMPTY(head)) 635 for (p = TAILQ_FIRST(head); p != NULL && 636 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 637 new_tagid = p->tag + 1; 638 639 if (new_tagid > TAGID_MAX) 640 return (0); 641 642 /* allocate and fill new struct pf_tagname */ 643 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 644 M_TEMP, M_NOWAIT); 645 if (tag == NULL) 646 return (0); 647 bzero(tag, sizeof(struct pf_tagname)); 648 strlcpy(tag->name, tagname, sizeof(tag->name)); 649 tag->tag = new_tagid; 650 tag->ref++; 651 652 if (p != NULL) /* insert new entry before p */ 653 TAILQ_INSERT_BEFORE(p, tag, entries); 654 else /* either list empty or no free slot in between */ 655 TAILQ_INSERT_TAIL(head, tag, entries); 656 657 return (tag->tag); 658 } 659 660 static void 661 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 662 { 663 struct pf_tagname *tag; 664 665 TAILQ_FOREACH(tag, head, entries) 666 if (tag->tag == tagid) { 667 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 668 return; 669 } 670 } 671 672 static void 673 tag_unref(struct pf_tags *head, u_int16_t tag) 674 { 675 struct pf_tagname *p, *next; 676 677 if (tag == 0) 678 return; 679 680 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 681 next = TAILQ_NEXT(p, entries); 682 if (tag == p->tag) { 683 if (--p->ref == 0) { 684 TAILQ_REMOVE(head, p, entries); 685 free(p, M_TEMP); 686 } 687 break; 688 } 689 } 690 } 691 692 u_int16_t 693 pf_tagname2tag(char *tagname) 694 { 695 return (tagname2tag(&pf_tags, tagname)); 696 } 697 698 void 699 pf_tag2tagname(u_int16_t tagid, char *p) 700 { 701 return (tag2tagname(&pf_tags, tagid, p)); 702 } 703 704 void 705 pf_tag_ref(u_int16_t tag) 706 { 707 struct pf_tagname *t; 708 709 TAILQ_FOREACH(t, &pf_tags, entries) 710 if (t->tag == tag) 711 break; 712 if (t != NULL) 713 t->ref++; 714 } 715 716 void 717 pf_tag_unref(u_int16_t tag) 718 { 719 return (tag_unref(&pf_tags, tag)); 720 } 721 722 int 723 pf_rtlabel_add(struct pf_addr_wrap *a) 724 { 725 if (a->type == PF_ADDR_RTLABEL && 726 (a->v.rtlabel = rtlabel_name2id(a->v.rtlabelname)) == 0) 727 return (-1); 728 return (0); 729 } 730 731 void 732 pf_rtlabel_remove(struct pf_addr_wrap *a) 733 { 734 if (a->type == PF_ADDR_RTLABEL) 735 rtlabel_unref(a->v.rtlabel); 736 } 737 738 void 739 pf_rtlabel_copyout(struct pf_addr_wrap *a) 740 { 741 const char *name; 742 743 if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel) { 744 if ((name = rtlabel_id2name(a->v.rtlabel)) == NULL) 745 strlcpy(a->v.rtlabelname, "?", 746 sizeof(a->v.rtlabelname)); 747 else 748 strlcpy(a->v.rtlabelname, name, 749 sizeof(a->v.rtlabelname)); 750 } 751 } 752 753 #ifdef ALTQ 754 u_int32_t 755 pf_qname2qid(char *qname) 756 { 757 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 758 } 759 760 void 761 pf_qid2qname(u_int32_t qid, char *p) 762 { 763 return (tag2tagname(&pf_qids, (u_int16_t)qid, p)); 764 } 765 766 void 767 pf_qid_unref(u_int32_t qid) 768 { 769 return (tag_unref(&pf_qids, (u_int16_t)qid)); 770 } 771 772 int 773 pf_begin_altq(u_int32_t *ticket) 774 { 775 struct pf_altq *altq; 776 int error = 0; 777 778 /* Purge the old altq list */ 779 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 780 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 781 if (altq->qname[0] == 0) { 782 /* detach and destroy the discipline */ 783 error = altq_remove(altq); 784 } else 785 pf_qid_unref(altq->qid); 786 pool_put(&pf_altq_pl, altq); 787 } 788 if (error) 789 return (error); 790 *ticket = ++ticket_altqs_inactive; 791 altqs_inactive_open = 1; 792 return (0); 793 } 794 795 int 796 pf_rollback_altq(u_int32_t ticket) 797 { 798 struct pf_altq *altq; 799 int error = 0; 800 801 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 802 return (0); 803 /* Purge the old altq list */ 804 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 805 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 806 if (altq->qname[0] == 0) { 807 /* detach and destroy the discipline */ 808 error = altq_remove(altq); 809 } else 810 pf_qid_unref(altq->qid); 811 pool_put(&pf_altq_pl, altq); 812 } 813 altqs_inactive_open = 0; 814 return (error); 815 } 816 817 int 818 pf_commit_altq(u_int32_t ticket) 819 { 820 struct pf_altqqueue *old_altqs; 821 struct pf_altq *altq; 822 int s, err, error = 0; 823 824 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 825 return (EBUSY); 826 827 /* swap altqs, keep the old. */ 828 s = splsoftnet(); 829 old_altqs = pf_altqs_active; 830 pf_altqs_active = pf_altqs_inactive; 831 pf_altqs_inactive = old_altqs; 832 ticket_altqs_active = ticket_altqs_inactive; 833 834 /* Attach new disciplines */ 835 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 836 if (altq->qname[0] == 0) { 837 /* attach the discipline */ 838 error = altq_pfattach(altq); 839 if (error == 0 && pf_altq_running) 840 error = pf_enable_altq(altq); 841 if (error != 0) { 842 splx(s); 843 return (error); 844 } 845 } 846 } 847 848 /* Purge the old altq list */ 849 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 850 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 851 if (altq->qname[0] == 0) { 852 /* detach and destroy the discipline */ 853 if (pf_altq_running) 854 error = pf_disable_altq(altq); 855 err = altq_pfdetach(altq); 856 if (err != 0 && error == 0) 857 error = err; 858 err = altq_remove(altq); 859 if (err != 0 && error == 0) 860 error = err; 861 } else 862 pf_qid_unref(altq->qid); 863 pool_put(&pf_altq_pl, altq); 864 } 865 splx(s); 866 867 altqs_inactive_open = 0; 868 return (error); 869 } 870 871 int 872 pf_enable_altq(struct pf_altq *altq) 873 { 874 struct ifnet *ifp; 875 struct tb_profile tb; 876 int s, error = 0; 877 878 if ((ifp = ifunit(altq->ifname)) == NULL) 879 return (EINVAL); 880 881 if (ifp->if_snd.altq_type != ALTQT_NONE) 882 error = altq_enable(&ifp->if_snd); 883 884 /* set tokenbucket regulator */ 885 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 886 tb.rate = altq->ifbandwidth; 887 tb.depth = altq->tbrsize; 888 s = splimp(); 889 error = tbr_set(&ifp->if_snd, &tb); 890 splx(s); 891 } 892 893 return (error); 894 } 895 896 int 897 pf_disable_altq(struct pf_altq *altq) 898 { 899 struct ifnet *ifp; 900 struct tb_profile tb; 901 int s, error; 902 903 if ((ifp = ifunit(altq->ifname)) == NULL) 904 return (EINVAL); 905 906 /* 907 * when the discipline is no longer referenced, it was overridden 908 * by a new one. if so, just return. 909 */ 910 if (altq->altq_disc != ifp->if_snd.altq_disc) 911 return (0); 912 913 error = altq_disable(&ifp->if_snd); 914 915 if (error == 0) { 916 /* clear tokenbucket regulator */ 917 tb.rate = 0; 918 s = splimp(); 919 error = tbr_set(&ifp->if_snd, &tb); 920 splx(s); 921 } 922 923 return (error); 924 } 925 #endif /* ALTQ */ 926 927 int 928 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 929 { 930 struct pf_ruleset *rs; 931 struct pf_rule *rule; 932 933 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 934 return (EINVAL); 935 rs = pf_find_or_create_ruleset(anchor); 936 if (rs == NULL) 937 return (EINVAL); 938 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 939 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 940 *ticket = ++rs->rules[rs_num].inactive.ticket; 941 rs->rules[rs_num].inactive.open = 1; 942 return (0); 943 } 944 945 int 946 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 947 { 948 struct pf_ruleset *rs; 949 struct pf_rule *rule; 950 951 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 952 return (EINVAL); 953 rs = pf_find_ruleset(anchor); 954 if (rs == NULL || !rs->rules[rs_num].inactive.open || 955 rs->rules[rs_num].inactive.ticket != ticket) 956 return (0); 957 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 958 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 959 rs->rules[rs_num].inactive.open = 0; 960 return (0); 961 } 962 963 int 964 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 965 { 966 struct pf_ruleset *rs; 967 struct pf_rule *rule; 968 struct pf_rulequeue *old_rules; 969 int s; 970 971 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 972 return (EINVAL); 973 rs = pf_find_ruleset(anchor); 974 if (rs == NULL || !rs->rules[rs_num].inactive.open || 975 ticket != rs->rules[rs_num].inactive.ticket) 976 return (EBUSY); 977 978 /* Swap rules, keep the old. */ 979 s = splsoftnet(); 980 old_rules = rs->rules[rs_num].active.ptr; 981 rs->rules[rs_num].active.ptr = 982 rs->rules[rs_num].inactive.ptr; 983 rs->rules[rs_num].inactive.ptr = old_rules; 984 rs->rules[rs_num].active.ticket = 985 rs->rules[rs_num].inactive.ticket; 986 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 987 988 /* Purge the old rule list. */ 989 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 990 pf_rm_rule(old_rules, rule); 991 rs->rules[rs_num].inactive.open = 0; 992 pf_remove_if_empty_ruleset(rs); 993 splx(s); 994 return (0); 995 } 996 997 int 998 pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p) 999 { 1000 struct pf_pooladdr *pa = NULL; 1001 struct pf_pool *pool = NULL; 1002 int s; 1003 int error = 0; 1004 1005 /* XXX keep in sync with switch() below */ 1006 if (securelevel > 1) 1007 switch (cmd) { 1008 case DIOCGETRULES: 1009 case DIOCGETRULE: 1010 case DIOCGETADDRS: 1011 case DIOCGETADDR: 1012 case DIOCGETSTATE: 1013 case DIOCSETSTATUSIF: 1014 case DIOCGETSTATUS: 1015 case DIOCCLRSTATUS: 1016 case DIOCNATLOOK: 1017 case DIOCSETDEBUG: 1018 case DIOCGETSTATES: 1019 case DIOCGETTIMEOUT: 1020 case DIOCCLRRULECTRS: 1021 case DIOCGETLIMIT: 1022 case DIOCGETALTQS: 1023 case DIOCGETALTQ: 1024 case DIOCGETQSTATS: 1025 case DIOCGETRULESETS: 1026 case DIOCGETRULESET: 1027 case DIOCRGETTABLES: 1028 case DIOCRGETTSTATS: 1029 case DIOCRCLRTSTATS: 1030 case DIOCRCLRADDRS: 1031 case DIOCRADDADDRS: 1032 case DIOCRDELADDRS: 1033 case DIOCRSETADDRS: 1034 case DIOCRGETADDRS: 1035 case DIOCRGETASTATS: 1036 case DIOCRCLRASTATS: 1037 case DIOCRTSTADDRS: 1038 case DIOCOSFPGET: 1039 case DIOCGETSRCNODES: 1040 case DIOCCLRSRCNODES: 1041 case DIOCIGETIFACES: 1042 case DIOCICLRISTATS: 1043 case DIOCSETIFFLAG: 1044 case DIOCCLRIFFLAG: 1045 break; 1046 case DIOCRCLRTABLES: 1047 case DIOCRADDTABLES: 1048 case DIOCRDELTABLES: 1049 case DIOCRSETTFLAGS: 1050 if (((struct pfioc_table *)addr)->pfrio_flags & 1051 PFR_FLAG_DUMMY) 1052 break; /* dummy operation ok */ 1053 return (EPERM); 1054 default: 1055 return (EPERM); 1056 } 1057 1058 if (!(flags & FWRITE)) 1059 switch (cmd) { 1060 case DIOCGETRULES: 1061 case DIOCGETRULE: 1062 case DIOCGETADDRS: 1063 case DIOCGETADDR: 1064 case DIOCGETSTATE: 1065 case DIOCGETSTATUS: 1066 case DIOCGETSTATES: 1067 case DIOCGETTIMEOUT: 1068 case DIOCGETLIMIT: 1069 case DIOCGETALTQS: 1070 case DIOCGETALTQ: 1071 case DIOCGETQSTATS: 1072 case DIOCGETRULESETS: 1073 case DIOCGETRULESET: 1074 case DIOCRGETTABLES: 1075 case DIOCRGETTSTATS: 1076 case DIOCRGETADDRS: 1077 case DIOCRGETASTATS: 1078 case DIOCRTSTADDRS: 1079 case DIOCOSFPGET: 1080 case DIOCGETSRCNODES: 1081 case DIOCIGETIFACES: 1082 break; 1083 case DIOCRCLRTABLES: 1084 case DIOCRADDTABLES: 1085 case DIOCRDELTABLES: 1086 case DIOCRCLRTSTATS: 1087 case DIOCRCLRADDRS: 1088 case DIOCRADDADDRS: 1089 case DIOCRDELADDRS: 1090 case DIOCRSETADDRS: 1091 case DIOCRSETTFLAGS: 1092 if (((struct pfioc_table *)addr)->pfrio_flags & 1093 PFR_FLAG_DUMMY) 1094 break; /* dummy operation ok */ 1095 return (EACCES); 1096 default: 1097 return (EACCES); 1098 } 1099 1100 s = splsoftnet(); 1101 switch (cmd) { 1102 1103 case DIOCSTART: 1104 if (pf_status.running) 1105 error = EEXIST; 1106 else { 1107 pf_status.running = 1; 1108 pf_status.since = time_second; 1109 if (pf_status.stateid == 0) { 1110 pf_status.stateid = time_second; 1111 pf_status.stateid = pf_status.stateid << 32; 1112 } 1113 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1114 } 1115 break; 1116 1117 case DIOCSTOP: 1118 if (!pf_status.running) 1119 error = ENOENT; 1120 else { 1121 pf_status.running = 0; 1122 pf_status.since = time_second; 1123 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1124 } 1125 break; 1126 1127 case DIOCADDRULE: { 1128 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1129 struct pf_ruleset *ruleset; 1130 struct pf_rule *rule, *tail; 1131 struct pf_pooladdr *pa; 1132 int rs_num; 1133 1134 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1135 ruleset = pf_find_ruleset(pr->anchor); 1136 if (ruleset == NULL) { 1137 error = EINVAL; 1138 break; 1139 } 1140 rs_num = pf_get_ruleset_number(pr->rule.action); 1141 if (rs_num >= PF_RULESET_MAX) { 1142 error = EINVAL; 1143 break; 1144 } 1145 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1146 error = EINVAL; 1147 break; 1148 } 1149 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1150 error = EBUSY; 1151 break; 1152 } 1153 if (pr->pool_ticket != ticket_pabuf) { 1154 error = EBUSY; 1155 break; 1156 } 1157 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1158 if (rule == NULL) { 1159 error = ENOMEM; 1160 break; 1161 } 1162 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1163 rule->anchor = NULL; 1164 rule->kif = NULL; 1165 TAILQ_INIT(&rule->rpool.list); 1166 /* initialize refcounting */ 1167 rule->states = 0; 1168 rule->src_nodes = 0; 1169 rule->entries.tqe_prev = NULL; 1170 #ifndef INET 1171 if (rule->af == AF_INET) { 1172 pool_put(&pf_rule_pl, rule); 1173 error = EAFNOSUPPORT; 1174 break; 1175 } 1176 #endif /* INET */ 1177 #ifndef INET6 1178 if (rule->af == AF_INET6) { 1179 pool_put(&pf_rule_pl, rule); 1180 error = EAFNOSUPPORT; 1181 break; 1182 } 1183 #endif /* INET6 */ 1184 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1185 pf_rulequeue); 1186 if (tail) 1187 rule->nr = tail->nr + 1; 1188 else 1189 rule->nr = 0; 1190 if (rule->ifname[0]) { 1191 rule->kif = pfi_attach_rule(rule->ifname); 1192 if (rule->kif == NULL) { 1193 pool_put(&pf_rule_pl, rule); 1194 error = EINVAL; 1195 break; 1196 } 1197 } 1198 1199 #ifdef ALTQ 1200 /* set queue IDs */ 1201 if (rule->qname[0] != 0) { 1202 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1203 error = EBUSY; 1204 else if (rule->pqname[0] != 0) { 1205 if ((rule->pqid = 1206 pf_qname2qid(rule->pqname)) == 0) 1207 error = EBUSY; 1208 } else 1209 rule->pqid = rule->qid; 1210 } 1211 #endif 1212 if (rule->tagname[0]) 1213 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1214 error = EBUSY; 1215 if (rule->match_tagname[0]) 1216 if ((rule->match_tag = 1217 pf_tagname2tag(rule->match_tagname)) == 0) 1218 error = EBUSY; 1219 if (rule->rt && !rule->direction) 1220 error = EINVAL; 1221 if (pf_rtlabel_add(&rule->src.addr) || 1222 pf_rtlabel_add(&rule->dst.addr)) 1223 error = EBUSY; 1224 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1225 error = EINVAL; 1226 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1227 error = EINVAL; 1228 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1229 error = EINVAL; 1230 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1231 error = EINVAL; 1232 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1233 error = EINVAL; 1234 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1235 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1236 error = EINVAL; 1237 1238 if (rule->overload_tblname[0]) { 1239 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1240 rule->overload_tblname)) == NULL) 1241 error = EINVAL; 1242 else 1243 rule->overload_tbl->pfrkt_flags |= 1244 PFR_TFLAG_ACTIVE; 1245 } 1246 1247 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1248 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1249 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1250 (rule->rt > PF_FASTROUTE)) && 1251 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1252 error = EINVAL; 1253 1254 if (error) { 1255 pf_rm_rule(NULL, rule); 1256 break; 1257 } 1258 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1259 rule->evaluations = rule->packets = rule->bytes = 0; 1260 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1261 rule, entries); 1262 break; 1263 } 1264 1265 case DIOCGETRULES: { 1266 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1267 struct pf_ruleset *ruleset; 1268 struct pf_rule *tail; 1269 int rs_num; 1270 1271 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1272 ruleset = pf_find_ruleset(pr->anchor); 1273 if (ruleset == NULL) { 1274 error = EINVAL; 1275 break; 1276 } 1277 rs_num = pf_get_ruleset_number(pr->rule.action); 1278 if (rs_num >= PF_RULESET_MAX) { 1279 error = EINVAL; 1280 break; 1281 } 1282 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1283 pf_rulequeue); 1284 if (tail) 1285 pr->nr = tail->nr + 1; 1286 else 1287 pr->nr = 0; 1288 pr->ticket = ruleset->rules[rs_num].active.ticket; 1289 break; 1290 } 1291 1292 case DIOCGETRULE: { 1293 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1294 struct pf_ruleset *ruleset; 1295 struct pf_rule *rule; 1296 int rs_num, i; 1297 1298 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1299 ruleset = pf_find_ruleset(pr->anchor); 1300 if (ruleset == NULL) { 1301 error = EINVAL; 1302 break; 1303 } 1304 rs_num = pf_get_ruleset_number(pr->rule.action); 1305 if (rs_num >= PF_RULESET_MAX) { 1306 error = EINVAL; 1307 break; 1308 } 1309 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1310 error = EBUSY; 1311 break; 1312 } 1313 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1314 while ((rule != NULL) && (rule->nr != pr->nr)) 1315 rule = TAILQ_NEXT(rule, entries); 1316 if (rule == NULL) { 1317 error = EBUSY; 1318 break; 1319 } 1320 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1321 if (pf_anchor_copyout(ruleset, rule, pr)) { 1322 error = EBUSY; 1323 break; 1324 } 1325 pfi_dynaddr_copyout(&pr->rule.src.addr); 1326 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1327 pf_tbladdr_copyout(&pr->rule.src.addr); 1328 pf_tbladdr_copyout(&pr->rule.dst.addr); 1329 pf_rtlabel_copyout(&pr->rule.src.addr); 1330 pf_rtlabel_copyout(&pr->rule.dst.addr); 1331 for (i = 0; i < PF_SKIP_COUNT; ++i) 1332 if (rule->skip[i].ptr == NULL) 1333 pr->rule.skip[i].nr = -1; 1334 else 1335 pr->rule.skip[i].nr = 1336 rule->skip[i].ptr->nr; 1337 break; 1338 } 1339 1340 case DIOCCHANGERULE: { 1341 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1342 struct pf_ruleset *ruleset; 1343 struct pf_rule *oldrule = NULL, *newrule = NULL; 1344 u_int32_t nr = 0; 1345 int rs_num; 1346 1347 if (!(pcr->action == PF_CHANGE_REMOVE || 1348 pcr->action == PF_CHANGE_GET_TICKET) && 1349 pcr->pool_ticket != ticket_pabuf) { 1350 error = EBUSY; 1351 break; 1352 } 1353 1354 if (pcr->action < PF_CHANGE_ADD_HEAD || 1355 pcr->action > PF_CHANGE_GET_TICKET) { 1356 error = EINVAL; 1357 break; 1358 } 1359 ruleset = pf_find_ruleset(pcr->anchor); 1360 if (ruleset == NULL) { 1361 error = EINVAL; 1362 break; 1363 } 1364 rs_num = pf_get_ruleset_number(pcr->rule.action); 1365 if (rs_num >= PF_RULESET_MAX) { 1366 error = EINVAL; 1367 break; 1368 } 1369 1370 if (pcr->action == PF_CHANGE_GET_TICKET) { 1371 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1372 break; 1373 } else { 1374 if (pcr->ticket != 1375 ruleset->rules[rs_num].active.ticket) { 1376 error = EINVAL; 1377 break; 1378 } 1379 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1380 error = EINVAL; 1381 break; 1382 } 1383 } 1384 1385 if (pcr->action != PF_CHANGE_REMOVE) { 1386 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1387 if (newrule == NULL) { 1388 error = ENOMEM; 1389 break; 1390 } 1391 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1392 TAILQ_INIT(&newrule->rpool.list); 1393 /* initialize refcounting */ 1394 newrule->states = 0; 1395 newrule->entries.tqe_prev = NULL; 1396 #ifndef INET 1397 if (newrule->af == AF_INET) { 1398 pool_put(&pf_rule_pl, newrule); 1399 error = EAFNOSUPPORT; 1400 break; 1401 } 1402 #endif /* INET */ 1403 #ifndef INET6 1404 if (newrule->af == AF_INET6) { 1405 pool_put(&pf_rule_pl, newrule); 1406 error = EAFNOSUPPORT; 1407 break; 1408 } 1409 #endif /* INET6 */ 1410 if (newrule->ifname[0]) { 1411 newrule->kif = pfi_attach_rule(newrule->ifname); 1412 if (newrule->kif == NULL) { 1413 pool_put(&pf_rule_pl, newrule); 1414 error = EINVAL; 1415 break; 1416 } 1417 } else 1418 newrule->kif = NULL; 1419 1420 #ifdef ALTQ 1421 /* set queue IDs */ 1422 if (newrule->qname[0] != 0) { 1423 if ((newrule->qid = 1424 pf_qname2qid(newrule->qname)) == 0) 1425 error = EBUSY; 1426 else if (newrule->pqname[0] != 0) { 1427 if ((newrule->pqid = 1428 pf_qname2qid(newrule->pqname)) == 0) 1429 error = EBUSY; 1430 } else 1431 newrule->pqid = newrule->qid; 1432 } 1433 #endif /* ALTQ */ 1434 if (newrule->tagname[0]) 1435 if ((newrule->tag = 1436 pf_tagname2tag(newrule->tagname)) == 0) 1437 error = EBUSY; 1438 if (newrule->match_tagname[0]) 1439 if ((newrule->match_tag = pf_tagname2tag( 1440 newrule->match_tagname)) == 0) 1441 error = EBUSY; 1442 if (newrule->rt && !newrule->direction) 1443 error = EINVAL; 1444 if (pf_rtlabel_add(&newrule->src.addr) || 1445 pf_rtlabel_add(&newrule->dst.addr)) 1446 error = EBUSY; 1447 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1448 error = EINVAL; 1449 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1450 error = EINVAL; 1451 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1452 error = EINVAL; 1453 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1454 error = EINVAL; 1455 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1456 error = EINVAL; 1457 1458 if (newrule->overload_tblname[0]) { 1459 if ((newrule->overload_tbl = pfr_attach_table( 1460 ruleset, newrule->overload_tblname)) == 1461 NULL) 1462 error = EINVAL; 1463 else 1464 newrule->overload_tbl->pfrkt_flags |= 1465 PFR_TFLAG_ACTIVE; 1466 } 1467 1468 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1469 if (((((newrule->action == PF_NAT) || 1470 (newrule->action == PF_RDR) || 1471 (newrule->action == PF_BINAT) || 1472 (newrule->rt > PF_FASTROUTE)) && 1473 !pcr->anchor[0])) && 1474 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1475 error = EINVAL; 1476 1477 if (error) { 1478 pf_rm_rule(NULL, newrule); 1479 break; 1480 } 1481 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1482 newrule->evaluations = newrule->packets = 0; 1483 newrule->bytes = 0; 1484 } 1485 pf_empty_pool(&pf_pabuf); 1486 1487 if (pcr->action == PF_CHANGE_ADD_HEAD) 1488 oldrule = TAILQ_FIRST( 1489 ruleset->rules[rs_num].active.ptr); 1490 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1491 oldrule = TAILQ_LAST( 1492 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1493 else { 1494 oldrule = TAILQ_FIRST( 1495 ruleset->rules[rs_num].active.ptr); 1496 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1497 oldrule = TAILQ_NEXT(oldrule, entries); 1498 if (oldrule == NULL) { 1499 if (newrule != NULL) 1500 pf_rm_rule(NULL, newrule); 1501 error = EINVAL; 1502 break; 1503 } 1504 } 1505 1506 if (pcr->action == PF_CHANGE_REMOVE) 1507 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1508 else { 1509 if (oldrule == NULL) 1510 TAILQ_INSERT_TAIL( 1511 ruleset->rules[rs_num].active.ptr, 1512 newrule, entries); 1513 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1514 pcr->action == PF_CHANGE_ADD_BEFORE) 1515 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1516 else 1517 TAILQ_INSERT_AFTER( 1518 ruleset->rules[rs_num].active.ptr, 1519 oldrule, newrule, entries); 1520 } 1521 1522 nr = 0; 1523 TAILQ_FOREACH(oldrule, 1524 ruleset->rules[rs_num].active.ptr, entries) 1525 oldrule->nr = nr++; 1526 1527 ruleset->rules[rs_num].active.ticket++; 1528 1529 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1530 pf_remove_if_empty_ruleset(ruleset); 1531 1532 break; 1533 } 1534 1535 case DIOCCLRSTATES: { 1536 struct pf_state *state; 1537 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1538 int killed = 0; 1539 1540 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1541 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1542 state->u.s.kif->pfik_name)) { 1543 state->timeout = PFTM_PURGE; 1544 #if NPFSYNC 1545 /* don't send out individual delete messages */ 1546 state->sync_flags = PFSTATE_NOSYNC; 1547 #endif 1548 killed++; 1549 } 1550 } 1551 pf_purge_expired_states(); 1552 pf_status.states = 0; 1553 psk->psk_af = killed; 1554 #if NPFSYNC 1555 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1556 #endif 1557 break; 1558 } 1559 1560 case DIOCKILLSTATES: { 1561 struct pf_state *state; 1562 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1563 int killed = 0; 1564 1565 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1566 if ((!psk->psk_af || state->af == psk->psk_af) 1567 && (!psk->psk_proto || psk->psk_proto == 1568 state->proto) && 1569 PF_MATCHA(psk->psk_src.neg, 1570 &psk->psk_src.addr.v.a.addr, 1571 &psk->psk_src.addr.v.a.mask, 1572 &state->lan.addr, state->af) && 1573 PF_MATCHA(psk->psk_dst.neg, 1574 &psk->psk_dst.addr.v.a.addr, 1575 &psk->psk_dst.addr.v.a.mask, 1576 &state->ext.addr, state->af) && 1577 (psk->psk_src.port_op == 0 || 1578 pf_match_port(psk->psk_src.port_op, 1579 psk->psk_src.port[0], psk->psk_src.port[1], 1580 state->lan.port)) && 1581 (psk->psk_dst.port_op == 0 || 1582 pf_match_port(psk->psk_dst.port_op, 1583 psk->psk_dst.port[0], psk->psk_dst.port[1], 1584 state->ext.port)) && 1585 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1586 state->u.s.kif->pfik_name))) { 1587 state->timeout = PFTM_PURGE; 1588 killed++; 1589 } 1590 } 1591 pf_purge_expired_states(); 1592 psk->psk_af = killed; 1593 break; 1594 } 1595 1596 case DIOCADDSTATE: { 1597 struct pfioc_state *ps = (struct pfioc_state *)addr; 1598 struct pf_state *state; 1599 struct pfi_kif *kif; 1600 1601 if (ps->state.timeout >= PFTM_MAX && 1602 ps->state.timeout != PFTM_UNTIL_PACKET) { 1603 error = EINVAL; 1604 break; 1605 } 1606 state = pool_get(&pf_state_pl, PR_NOWAIT); 1607 if (state == NULL) { 1608 error = ENOMEM; 1609 break; 1610 } 1611 kif = pfi_lookup_create(ps->state.u.ifname); 1612 if (kif == NULL) { 1613 pool_put(&pf_state_pl, state); 1614 error = ENOENT; 1615 break; 1616 } 1617 bcopy(&ps->state, state, sizeof(struct pf_state)); 1618 bzero(&state->u, sizeof(state->u)); 1619 state->rule.ptr = &pf_default_rule; 1620 state->nat_rule.ptr = NULL; 1621 state->anchor.ptr = NULL; 1622 state->rt_kif = NULL; 1623 state->creation = time_second; 1624 state->pfsync_time = 0; 1625 state->packets[0] = state->packets[1] = 0; 1626 state->bytes[0] = state->bytes[1] = 0; 1627 1628 if (pf_insert_state(kif, state)) { 1629 pfi_maybe_destroy(kif); 1630 pool_put(&pf_state_pl, state); 1631 error = ENOMEM; 1632 } 1633 break; 1634 } 1635 1636 case DIOCGETSTATE: { 1637 struct pfioc_state *ps = (struct pfioc_state *)addr; 1638 struct pf_state *state; 1639 u_int32_t nr; 1640 1641 nr = 0; 1642 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1643 if (nr >= ps->nr) 1644 break; 1645 nr++; 1646 } 1647 if (state == NULL) { 1648 error = EBUSY; 1649 break; 1650 } 1651 bcopy(state, &ps->state, sizeof(struct pf_state)); 1652 ps->state.rule.nr = state->rule.ptr->nr; 1653 ps->state.nat_rule.nr = (state->nat_rule.ptr == NULL) ? 1654 -1 : state->nat_rule.ptr->nr; 1655 ps->state.anchor.nr = (state->anchor.ptr == NULL) ? 1656 -1 : state->anchor.ptr->nr; 1657 ps->state.expire = pf_state_expires(state); 1658 if (ps->state.expire > time_second) 1659 ps->state.expire -= time_second; 1660 else 1661 ps->state.expire = 0; 1662 break; 1663 } 1664 1665 case DIOCGETSTATES: { 1666 struct pfioc_states *ps = (struct pfioc_states *)addr; 1667 struct pf_state *state; 1668 struct pf_state *p, pstore; 1669 struct pfi_kif *kif; 1670 u_int32_t nr = 0; 1671 int space = ps->ps_len; 1672 1673 if (space == 0) { 1674 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1675 nr += kif->pfik_states; 1676 ps->ps_len = sizeof(struct pf_state) * nr; 1677 break; 1678 } 1679 1680 p = ps->ps_states; 1681 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1682 RB_FOREACH(state, pf_state_tree_ext_gwy, 1683 &kif->pfik_ext_gwy) { 1684 int secs = time_second; 1685 1686 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1687 break; 1688 1689 bcopy(state, &pstore, sizeof(pstore)); 1690 strlcpy(pstore.u.ifname, kif->pfik_name, 1691 sizeof(pstore.u.ifname)); 1692 pstore.rule.nr = state->rule.ptr->nr; 1693 pstore.nat_rule.nr = (state->nat_rule.ptr == 1694 NULL) ? -1 : state->nat_rule.ptr->nr; 1695 pstore.anchor.nr = (state->anchor.ptr == 1696 NULL) ? -1 : state->anchor.ptr->nr; 1697 pstore.creation = secs - pstore.creation; 1698 pstore.expire = pf_state_expires(state); 1699 if (pstore.expire > secs) 1700 pstore.expire -= secs; 1701 else 1702 pstore.expire = 0; 1703 error = copyout(&pstore, p, sizeof(*p)); 1704 if (error) 1705 goto fail; 1706 p++; 1707 nr++; 1708 } 1709 ps->ps_len = sizeof(struct pf_state) * nr; 1710 break; 1711 } 1712 1713 case DIOCGETSTATUS: { 1714 struct pf_status *s = (struct pf_status *)addr; 1715 bcopy(&pf_status, s, sizeof(struct pf_status)); 1716 pfi_fill_oldstatus(s); 1717 break; 1718 } 1719 1720 case DIOCSETSTATUSIF: { 1721 struct pfioc_if *pi = (struct pfioc_if *)addr; 1722 1723 if (pi->ifname[0] == 0) { 1724 bzero(pf_status.ifname, IFNAMSIZ); 1725 break; 1726 } 1727 if (ifunit(pi->ifname) == NULL) { 1728 error = EINVAL; 1729 break; 1730 } 1731 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 1732 break; 1733 } 1734 1735 case DIOCCLRSTATUS: { 1736 bzero(pf_status.counters, sizeof(pf_status.counters)); 1737 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 1738 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 1739 if (*pf_status.ifname) 1740 pfi_clr_istats(pf_status.ifname, NULL, 1741 PFI_FLAG_INSTANCE); 1742 break; 1743 } 1744 1745 case DIOCNATLOOK: { 1746 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1747 struct pf_state *state; 1748 struct pf_state key; 1749 int m = 0, direction = pnl->direction; 1750 1751 key.af = pnl->af; 1752 key.proto = pnl->proto; 1753 1754 if (!pnl->proto || 1755 PF_AZERO(&pnl->saddr, pnl->af) || 1756 PF_AZERO(&pnl->daddr, pnl->af) || 1757 !pnl->dport || !pnl->sport) 1758 error = EINVAL; 1759 else { 1760 /* 1761 * userland gives us source and dest of connection, 1762 * reverse the lookup so we ask for what happens with 1763 * the return traffic, enabling us to find it in the 1764 * state tree. 1765 */ 1766 if (direction == PF_IN) { 1767 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 1768 key.ext.port = pnl->dport; 1769 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 1770 key.gwy.port = pnl->sport; 1771 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 1772 } else { 1773 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 1774 key.lan.port = pnl->dport; 1775 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 1776 key.ext.port = pnl->sport; 1777 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 1778 } 1779 if (m > 1) 1780 error = E2BIG; /* more than one state */ 1781 else if (state != NULL) { 1782 if (direction == PF_IN) { 1783 PF_ACPY(&pnl->rsaddr, &state->lan.addr, 1784 state->af); 1785 pnl->rsport = state->lan.port; 1786 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 1787 pnl->af); 1788 pnl->rdport = pnl->dport; 1789 } else { 1790 PF_ACPY(&pnl->rdaddr, &state->gwy.addr, 1791 state->af); 1792 pnl->rdport = state->gwy.port; 1793 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 1794 pnl->af); 1795 pnl->rsport = pnl->sport; 1796 } 1797 } else 1798 error = ENOENT; 1799 } 1800 break; 1801 } 1802 1803 case DIOCSETTIMEOUT: { 1804 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1805 int old; 1806 1807 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1808 pt->seconds < 0) { 1809 error = EINVAL; 1810 goto fail; 1811 } 1812 old = pf_default_rule.timeout[pt->timeout]; 1813 pf_default_rule.timeout[pt->timeout] = pt->seconds; 1814 pt->seconds = old; 1815 break; 1816 } 1817 1818 case DIOCGETTIMEOUT: { 1819 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1820 1821 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1822 error = EINVAL; 1823 goto fail; 1824 } 1825 pt->seconds = pf_default_rule.timeout[pt->timeout]; 1826 break; 1827 } 1828 1829 case DIOCGETLIMIT: { 1830 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1831 1832 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1833 error = EINVAL; 1834 goto fail; 1835 } 1836 pl->limit = pf_pool_limits[pl->index].limit; 1837 break; 1838 } 1839 1840 case DIOCSETLIMIT: { 1841 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1842 int old_limit; 1843 1844 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1845 pf_pool_limits[pl->index].pp == NULL) { 1846 error = EINVAL; 1847 goto fail; 1848 } 1849 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 1850 pl->limit, NULL, 0) != 0) { 1851 error = EBUSY; 1852 goto fail; 1853 } 1854 old_limit = pf_pool_limits[pl->index].limit; 1855 pf_pool_limits[pl->index].limit = pl->limit; 1856 pl->limit = old_limit; 1857 break; 1858 } 1859 1860 case DIOCSETDEBUG: { 1861 u_int32_t *level = (u_int32_t *)addr; 1862 1863 pf_status.debug = *level; 1864 break; 1865 } 1866 1867 case DIOCCLRRULECTRS: { 1868 struct pf_ruleset *ruleset = &pf_main_ruleset; 1869 struct pf_rule *rule; 1870 1871 TAILQ_FOREACH(rule, 1872 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) 1873 rule->evaluations = rule->packets = 1874 rule->bytes = 0; 1875 break; 1876 } 1877 1878 #ifdef ALTQ 1879 case DIOCSTARTALTQ: { 1880 struct pf_altq *altq; 1881 1882 /* enable all altq interfaces on active list */ 1883 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1884 if (altq->qname[0] == 0) { 1885 error = pf_enable_altq(altq); 1886 if (error != 0) 1887 break; 1888 } 1889 } 1890 if (error == 0) 1891 pf_altq_running = 1; 1892 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 1893 break; 1894 } 1895 1896 case DIOCSTOPALTQ: { 1897 struct pf_altq *altq; 1898 1899 /* disable all altq interfaces on active list */ 1900 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1901 if (altq->qname[0] == 0) { 1902 error = pf_disable_altq(altq); 1903 if (error != 0) 1904 break; 1905 } 1906 } 1907 if (error == 0) 1908 pf_altq_running = 0; 1909 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 1910 break; 1911 } 1912 1913 case DIOCADDALTQ: { 1914 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1915 struct pf_altq *altq, *a; 1916 1917 if (pa->ticket != ticket_altqs_inactive) { 1918 error = EBUSY; 1919 break; 1920 } 1921 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 1922 if (altq == NULL) { 1923 error = ENOMEM; 1924 break; 1925 } 1926 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 1927 1928 /* 1929 * if this is for a queue, find the discipline and 1930 * copy the necessary fields 1931 */ 1932 if (altq->qname[0] != 0) { 1933 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 1934 error = EBUSY; 1935 pool_put(&pf_altq_pl, altq); 1936 break; 1937 } 1938 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 1939 if (strncmp(a->ifname, altq->ifname, 1940 IFNAMSIZ) == 0 && a->qname[0] == 0) { 1941 altq->altq_disc = a->altq_disc; 1942 break; 1943 } 1944 } 1945 } 1946 1947 error = altq_add(altq); 1948 if (error) { 1949 pool_put(&pf_altq_pl, altq); 1950 break; 1951 } 1952 1953 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 1954 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1955 break; 1956 } 1957 1958 case DIOCGETALTQS: { 1959 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1960 struct pf_altq *altq; 1961 1962 pa->nr = 0; 1963 TAILQ_FOREACH(altq, pf_altqs_active, entries) 1964 pa->nr++; 1965 pa->ticket = ticket_altqs_active; 1966 break; 1967 } 1968 1969 case DIOCGETALTQ: { 1970 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1971 struct pf_altq *altq; 1972 u_int32_t nr; 1973 1974 if (pa->ticket != ticket_altqs_active) { 1975 error = EBUSY; 1976 break; 1977 } 1978 nr = 0; 1979 altq = TAILQ_FIRST(pf_altqs_active); 1980 while ((altq != NULL) && (nr < pa->nr)) { 1981 altq = TAILQ_NEXT(altq, entries); 1982 nr++; 1983 } 1984 if (altq == NULL) { 1985 error = EBUSY; 1986 break; 1987 } 1988 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1989 break; 1990 } 1991 1992 case DIOCCHANGEALTQ: 1993 /* CHANGEALTQ not supported yet! */ 1994 error = ENODEV; 1995 break; 1996 1997 case DIOCGETQSTATS: { 1998 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 1999 struct pf_altq *altq; 2000 u_int32_t nr; 2001 int nbytes; 2002 2003 if (pq->ticket != ticket_altqs_active) { 2004 error = EBUSY; 2005 break; 2006 } 2007 nbytes = pq->nbytes; 2008 nr = 0; 2009 altq = TAILQ_FIRST(pf_altqs_active); 2010 while ((altq != NULL) && (nr < pq->nr)) { 2011 altq = TAILQ_NEXT(altq, entries); 2012 nr++; 2013 } 2014 if (altq == NULL) { 2015 error = EBUSY; 2016 break; 2017 } 2018 error = altq_getqstats(altq, pq->buf, &nbytes); 2019 if (error == 0) { 2020 pq->scheduler = altq->scheduler; 2021 pq->nbytes = nbytes; 2022 } 2023 break; 2024 } 2025 #endif /* ALTQ */ 2026 2027 case DIOCBEGINADDRS: { 2028 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2029 2030 pf_empty_pool(&pf_pabuf); 2031 pp->ticket = ++ticket_pabuf; 2032 break; 2033 } 2034 2035 case DIOCADDADDR: { 2036 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2037 2038 #ifndef INET 2039 if (pp->af == AF_INET) { 2040 error = EAFNOSUPPORT; 2041 break; 2042 } 2043 #endif /* INET */ 2044 #ifndef INET6 2045 if (pp->af == AF_INET6) { 2046 error = EAFNOSUPPORT; 2047 break; 2048 } 2049 #endif /* INET6 */ 2050 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2051 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2052 pp->addr.addr.type != PF_ADDR_TABLE) { 2053 error = EINVAL; 2054 break; 2055 } 2056 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2057 if (pa == NULL) { 2058 error = ENOMEM; 2059 break; 2060 } 2061 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2062 if (pa->ifname[0]) { 2063 pa->kif = pfi_attach_rule(pa->ifname); 2064 if (pa->kif == NULL) { 2065 pool_put(&pf_pooladdr_pl, pa); 2066 error = EINVAL; 2067 break; 2068 } 2069 } 2070 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 2071 pfi_dynaddr_remove(&pa->addr); 2072 pfi_detach_rule(pa->kif); 2073 pool_put(&pf_pooladdr_pl, pa); 2074 error = EINVAL; 2075 break; 2076 } 2077 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 2078 break; 2079 } 2080 2081 case DIOCGETADDRS: { 2082 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2083 2084 pp->nr = 0; 2085 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2086 pp->r_num, 0, 1, 0); 2087 if (pool == NULL) { 2088 error = EBUSY; 2089 break; 2090 } 2091 TAILQ_FOREACH(pa, &pool->list, entries) 2092 pp->nr++; 2093 break; 2094 } 2095 2096 case DIOCGETADDR: { 2097 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2098 u_int32_t nr = 0; 2099 2100 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2101 pp->r_num, 0, 1, 1); 2102 if (pool == NULL) { 2103 error = EBUSY; 2104 break; 2105 } 2106 pa = TAILQ_FIRST(&pool->list); 2107 while ((pa != NULL) && (nr < pp->nr)) { 2108 pa = TAILQ_NEXT(pa, entries); 2109 nr++; 2110 } 2111 if (pa == NULL) { 2112 error = EBUSY; 2113 break; 2114 } 2115 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2116 pfi_dynaddr_copyout(&pp->addr.addr); 2117 pf_tbladdr_copyout(&pp->addr.addr); 2118 pf_rtlabel_copyout(&pp->addr.addr); 2119 break; 2120 } 2121 2122 case DIOCCHANGEADDR: { 2123 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2124 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2125 struct pf_ruleset *ruleset; 2126 2127 if (pca->action < PF_CHANGE_ADD_HEAD || 2128 pca->action > PF_CHANGE_REMOVE) { 2129 error = EINVAL; 2130 break; 2131 } 2132 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2133 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2134 pca->addr.addr.type != PF_ADDR_TABLE) { 2135 error = EINVAL; 2136 break; 2137 } 2138 2139 ruleset = pf_find_ruleset(pca->anchor); 2140 if (ruleset == NULL) { 2141 error = EBUSY; 2142 break; 2143 } 2144 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2145 pca->r_num, pca->r_last, 1, 1); 2146 if (pool == NULL) { 2147 error = EBUSY; 2148 break; 2149 } 2150 if (pca->action != PF_CHANGE_REMOVE) { 2151 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2152 if (newpa == NULL) { 2153 error = ENOMEM; 2154 break; 2155 } 2156 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2157 #ifndef INET 2158 if (pca->af == AF_INET) { 2159 pool_put(&pf_pooladdr_pl, newpa); 2160 error = EAFNOSUPPORT; 2161 break; 2162 } 2163 #endif /* INET */ 2164 #ifndef INET6 2165 if (pca->af == AF_INET6) { 2166 pool_put(&pf_pooladdr_pl, newpa); 2167 error = EAFNOSUPPORT; 2168 break; 2169 } 2170 #endif /* INET6 */ 2171 if (newpa->ifname[0]) { 2172 newpa->kif = pfi_attach_rule(newpa->ifname); 2173 if (newpa->kif == NULL) { 2174 pool_put(&pf_pooladdr_pl, newpa); 2175 error = EINVAL; 2176 break; 2177 } 2178 } else 2179 newpa->kif = NULL; 2180 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2181 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2182 pfi_dynaddr_remove(&newpa->addr); 2183 pfi_detach_rule(newpa->kif); 2184 pool_put(&pf_pooladdr_pl, newpa); 2185 error = EINVAL; 2186 break; 2187 } 2188 } 2189 2190 if (pca->action == PF_CHANGE_ADD_HEAD) 2191 oldpa = TAILQ_FIRST(&pool->list); 2192 else if (pca->action == PF_CHANGE_ADD_TAIL) 2193 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2194 else { 2195 int i = 0; 2196 2197 oldpa = TAILQ_FIRST(&pool->list); 2198 while ((oldpa != NULL) && (i < pca->nr)) { 2199 oldpa = TAILQ_NEXT(oldpa, entries); 2200 i++; 2201 } 2202 if (oldpa == NULL) { 2203 error = EINVAL; 2204 break; 2205 } 2206 } 2207 2208 if (pca->action == PF_CHANGE_REMOVE) { 2209 TAILQ_REMOVE(&pool->list, oldpa, entries); 2210 pfi_dynaddr_remove(&oldpa->addr); 2211 pf_tbladdr_remove(&oldpa->addr); 2212 pfi_detach_rule(oldpa->kif); 2213 pool_put(&pf_pooladdr_pl, oldpa); 2214 } else { 2215 if (oldpa == NULL) 2216 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2217 else if (pca->action == PF_CHANGE_ADD_HEAD || 2218 pca->action == PF_CHANGE_ADD_BEFORE) 2219 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2220 else 2221 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2222 newpa, entries); 2223 } 2224 2225 pool->cur = TAILQ_FIRST(&pool->list); 2226 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2227 pca->af); 2228 break; 2229 } 2230 2231 case DIOCGETRULESETS: { 2232 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2233 struct pf_ruleset *ruleset; 2234 struct pf_anchor *anchor; 2235 2236 pr->path[sizeof(pr->path) - 1] = 0; 2237 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2238 error = EINVAL; 2239 break; 2240 } 2241 pr->nr = 0; 2242 if (ruleset->anchor == NULL) { 2243 /* XXX kludge for pf_main_ruleset */ 2244 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2245 if (anchor->parent == NULL) 2246 pr->nr++; 2247 } else { 2248 RB_FOREACH(anchor, pf_anchor_node, 2249 &ruleset->anchor->children) 2250 pr->nr++; 2251 } 2252 break; 2253 } 2254 2255 case DIOCGETRULESET: { 2256 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2257 struct pf_ruleset *ruleset; 2258 struct pf_anchor *anchor; 2259 u_int32_t nr = 0; 2260 2261 pr->path[sizeof(pr->path) - 1] = 0; 2262 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2263 error = EINVAL; 2264 break; 2265 } 2266 pr->name[0] = 0; 2267 if (ruleset->anchor == NULL) { 2268 /* XXX kludge for pf_main_ruleset */ 2269 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2270 if (anchor->parent == NULL && nr++ == pr->nr) { 2271 strlcpy(pr->name, anchor->name, 2272 sizeof(pr->name)); 2273 break; 2274 } 2275 } else { 2276 RB_FOREACH(anchor, pf_anchor_node, 2277 &ruleset->anchor->children) 2278 if (nr++ == pr->nr) { 2279 strlcpy(pr->name, anchor->name, 2280 sizeof(pr->name)); 2281 break; 2282 } 2283 } 2284 if (!pr->name[0]) 2285 error = EBUSY; 2286 break; 2287 } 2288 2289 case DIOCRCLRTABLES: { 2290 struct pfioc_table *io = (struct pfioc_table *)addr; 2291 2292 if (io->pfrio_esize != 0) { 2293 error = ENODEV; 2294 break; 2295 } 2296 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2297 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2298 break; 2299 } 2300 2301 case DIOCRADDTABLES: { 2302 struct pfioc_table *io = (struct pfioc_table *)addr; 2303 2304 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2305 error = ENODEV; 2306 break; 2307 } 2308 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2309 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2310 break; 2311 } 2312 2313 case DIOCRDELTABLES: { 2314 struct pfioc_table *io = (struct pfioc_table *)addr; 2315 2316 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2317 error = ENODEV; 2318 break; 2319 } 2320 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2321 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2322 break; 2323 } 2324 2325 case DIOCRGETTABLES: { 2326 struct pfioc_table *io = (struct pfioc_table *)addr; 2327 2328 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2329 error = ENODEV; 2330 break; 2331 } 2332 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2333 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2334 break; 2335 } 2336 2337 case DIOCRGETTSTATS: { 2338 struct pfioc_table *io = (struct pfioc_table *)addr; 2339 2340 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2341 error = ENODEV; 2342 break; 2343 } 2344 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2345 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2346 break; 2347 } 2348 2349 case DIOCRCLRTSTATS: { 2350 struct pfioc_table *io = (struct pfioc_table *)addr; 2351 2352 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2353 error = ENODEV; 2354 break; 2355 } 2356 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2357 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2358 break; 2359 } 2360 2361 case DIOCRSETTFLAGS: { 2362 struct pfioc_table *io = (struct pfioc_table *)addr; 2363 2364 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2365 error = ENODEV; 2366 break; 2367 } 2368 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2369 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2370 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2371 break; 2372 } 2373 2374 case DIOCRCLRADDRS: { 2375 struct pfioc_table *io = (struct pfioc_table *)addr; 2376 2377 if (io->pfrio_esize != 0) { 2378 error = ENODEV; 2379 break; 2380 } 2381 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2382 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2383 break; 2384 } 2385 2386 case DIOCRADDADDRS: { 2387 struct pfioc_table *io = (struct pfioc_table *)addr; 2388 2389 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2390 error = ENODEV; 2391 break; 2392 } 2393 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2394 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2395 PFR_FLAG_USERIOCTL); 2396 break; 2397 } 2398 2399 case DIOCRDELADDRS: { 2400 struct pfioc_table *io = (struct pfioc_table *)addr; 2401 2402 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2403 error = ENODEV; 2404 break; 2405 } 2406 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2407 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2408 PFR_FLAG_USERIOCTL); 2409 break; 2410 } 2411 2412 case DIOCRSETADDRS: { 2413 struct pfioc_table *io = (struct pfioc_table *)addr; 2414 2415 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2416 error = ENODEV; 2417 break; 2418 } 2419 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2420 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2421 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2422 PFR_FLAG_USERIOCTL); 2423 break; 2424 } 2425 2426 case DIOCRGETADDRS: { 2427 struct pfioc_table *io = (struct pfioc_table *)addr; 2428 2429 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2430 error = ENODEV; 2431 break; 2432 } 2433 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2434 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2435 break; 2436 } 2437 2438 case DIOCRGETASTATS: { 2439 struct pfioc_table *io = (struct pfioc_table *)addr; 2440 2441 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2442 error = ENODEV; 2443 break; 2444 } 2445 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2446 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2447 break; 2448 } 2449 2450 case DIOCRCLRASTATS: { 2451 struct pfioc_table *io = (struct pfioc_table *)addr; 2452 2453 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2454 error = ENODEV; 2455 break; 2456 } 2457 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2458 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2459 PFR_FLAG_USERIOCTL); 2460 break; 2461 } 2462 2463 case DIOCRTSTADDRS: { 2464 struct pfioc_table *io = (struct pfioc_table *)addr; 2465 2466 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2467 error = ENODEV; 2468 break; 2469 } 2470 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2471 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2472 PFR_FLAG_USERIOCTL); 2473 break; 2474 } 2475 2476 case DIOCRINADEFINE: { 2477 struct pfioc_table *io = (struct pfioc_table *)addr; 2478 2479 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2480 error = ENODEV; 2481 break; 2482 } 2483 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2484 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2485 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2486 break; 2487 } 2488 2489 case DIOCOSFPADD: { 2490 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2491 error = pf_osfp_add(io); 2492 break; 2493 } 2494 2495 case DIOCOSFPGET: { 2496 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2497 error = pf_osfp_get(io); 2498 break; 2499 } 2500 2501 case DIOCXBEGIN: { 2502 struct pfioc_trans *io = (struct pfioc_trans *) 2503 addr; 2504 static struct pfioc_trans_e ioe; 2505 static struct pfr_table table; 2506 int i; 2507 2508 if (io->esize != sizeof(ioe)) { 2509 error = ENODEV; 2510 goto fail; 2511 } 2512 for (i = 0; i < io->size; i++) { 2513 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2514 error = EFAULT; 2515 goto fail; 2516 } 2517 switch (ioe.rs_num) { 2518 #ifdef ALTQ 2519 case PF_RULESET_ALTQ: 2520 if (ioe.anchor[0]) { 2521 error = EINVAL; 2522 goto fail; 2523 } 2524 if ((error = pf_begin_altq(&ioe.ticket))) 2525 goto fail; 2526 break; 2527 #endif /* ALTQ */ 2528 case PF_RULESET_TABLE: 2529 bzero(&table, sizeof(table)); 2530 strlcpy(table.pfrt_anchor, ioe.anchor, 2531 sizeof(table.pfrt_anchor)); 2532 if ((error = pfr_ina_begin(&table, 2533 &ioe.ticket, NULL, 0))) 2534 goto fail; 2535 break; 2536 default: 2537 if ((error = pf_begin_rules(&ioe.ticket, 2538 ioe.rs_num, ioe.anchor))) 2539 goto fail; 2540 break; 2541 } 2542 if (copyout(&ioe, io->array+i, sizeof(io->array[i]))) { 2543 error = EFAULT; 2544 goto fail; 2545 } 2546 } 2547 break; 2548 } 2549 2550 case DIOCXROLLBACK: { 2551 struct pfioc_trans *io = (struct pfioc_trans *) 2552 addr; 2553 static struct pfioc_trans_e ioe; 2554 static struct pfr_table table; 2555 int i; 2556 2557 if (io->esize != sizeof(ioe)) { 2558 error = ENODEV; 2559 goto fail; 2560 } 2561 for (i = 0; i < io->size; i++) { 2562 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2563 error = EFAULT; 2564 goto fail; 2565 } 2566 switch (ioe.rs_num) { 2567 #ifdef ALTQ 2568 case PF_RULESET_ALTQ: 2569 if (ioe.anchor[0]) { 2570 error = EINVAL; 2571 goto fail; 2572 } 2573 if ((error = pf_rollback_altq(ioe.ticket))) 2574 goto fail; /* really bad */ 2575 break; 2576 #endif /* ALTQ */ 2577 case PF_RULESET_TABLE: 2578 bzero(&table, sizeof(table)); 2579 strlcpy(table.pfrt_anchor, ioe.anchor, 2580 sizeof(table.pfrt_anchor)); 2581 if ((error = pfr_ina_rollback(&table, 2582 ioe.ticket, NULL, 0))) 2583 goto fail; /* really bad */ 2584 break; 2585 default: 2586 if ((error = pf_rollback_rules(ioe.ticket, 2587 ioe.rs_num, ioe.anchor))) 2588 goto fail; /* really bad */ 2589 break; 2590 } 2591 } 2592 break; 2593 } 2594 2595 case DIOCXCOMMIT: { 2596 struct pfioc_trans *io = (struct pfioc_trans *) 2597 addr; 2598 static struct pfioc_trans_e ioe; 2599 static struct pfr_table table; 2600 struct pf_ruleset *rs; 2601 int i; 2602 2603 if (io->esize != sizeof(ioe)) { 2604 error = ENODEV; 2605 goto fail; 2606 } 2607 /* first makes sure everything will succeed */ 2608 for (i = 0; i < io->size; i++) { 2609 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2610 error = EFAULT; 2611 goto fail; 2612 } 2613 switch (ioe.rs_num) { 2614 #ifdef ALTQ 2615 case PF_RULESET_ALTQ: 2616 if (ioe.anchor[0]) { 2617 error = EINVAL; 2618 goto fail; 2619 } 2620 if (!altqs_inactive_open || ioe.ticket != 2621 ticket_altqs_inactive) { 2622 error = EBUSY; 2623 goto fail; 2624 } 2625 break; 2626 #endif /* ALTQ */ 2627 case PF_RULESET_TABLE: 2628 rs = pf_find_ruleset(ioe.anchor); 2629 if (rs == NULL || !rs->topen || ioe.ticket != 2630 rs->tticket) { 2631 error = EBUSY; 2632 goto fail; 2633 } 2634 break; 2635 default: 2636 if (ioe.rs_num < 0 || ioe.rs_num >= 2637 PF_RULESET_MAX) { 2638 error = EINVAL; 2639 goto fail; 2640 } 2641 rs = pf_find_ruleset(ioe.anchor); 2642 if (rs == NULL || 2643 !rs->rules[ioe.rs_num].inactive.open || 2644 rs->rules[ioe.rs_num].inactive.ticket != 2645 ioe.ticket) { 2646 error = EBUSY; 2647 goto fail; 2648 } 2649 break; 2650 } 2651 } 2652 /* now do the commit - no errors should happen here */ 2653 for (i = 0; i < io->size; i++) { 2654 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2655 error = EFAULT; 2656 goto fail; 2657 } 2658 switch (ioe.rs_num) { 2659 #ifdef ALTQ 2660 case PF_RULESET_ALTQ: 2661 if ((error = pf_commit_altq(ioe.ticket))) 2662 goto fail; /* really bad */ 2663 break; 2664 #endif /* ALTQ */ 2665 case PF_RULESET_TABLE: 2666 bzero(&table, sizeof(table)); 2667 strlcpy(table.pfrt_anchor, ioe.anchor, 2668 sizeof(table.pfrt_anchor)); 2669 if ((error = pfr_ina_commit(&table, ioe.ticket, 2670 NULL, NULL, 0))) 2671 goto fail; /* really bad */ 2672 break; 2673 default: 2674 if ((error = pf_commit_rules(ioe.ticket, 2675 ioe.rs_num, ioe.anchor))) 2676 goto fail; /* really bad */ 2677 break; 2678 } 2679 } 2680 break; 2681 } 2682 2683 case DIOCGETSRCNODES: { 2684 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 2685 struct pf_src_node *n; 2686 struct pf_src_node *p, pstore; 2687 u_int32_t nr = 0; 2688 int space = psn->psn_len; 2689 2690 if (space == 0) { 2691 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 2692 nr++; 2693 psn->psn_len = sizeof(struct pf_src_node) * nr; 2694 break; 2695 } 2696 2697 p = psn->psn_src_nodes; 2698 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2699 int secs = time_second, diff; 2700 2701 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 2702 break; 2703 2704 bcopy(n, &pstore, sizeof(pstore)); 2705 if (n->rule.ptr != NULL) 2706 pstore.rule.nr = n->rule.ptr->nr; 2707 pstore.creation = secs - pstore.creation; 2708 if (pstore.expire > secs) 2709 pstore.expire -= secs; 2710 else 2711 pstore.expire = 0; 2712 2713 /* adjust the connection rate estimate */ 2714 diff = secs - n->conn_rate.last; 2715 if (diff >= n->conn_rate.seconds) 2716 pstore.conn_rate.count = 0; 2717 else 2718 pstore.conn_rate.count -= 2719 n->conn_rate.count * diff / 2720 n->conn_rate.seconds; 2721 2722 error = copyout(&pstore, p, sizeof(*p)); 2723 if (error) 2724 goto fail; 2725 p++; 2726 nr++; 2727 } 2728 psn->psn_len = sizeof(struct pf_src_node) * nr; 2729 break; 2730 } 2731 2732 case DIOCCLRSRCNODES: { 2733 struct pf_src_node *n; 2734 struct pf_state *state; 2735 2736 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 2737 state->src_node = NULL; 2738 state->nat_src_node = NULL; 2739 } 2740 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2741 n->expire = 1; 2742 n->states = 0; 2743 } 2744 pf_purge_expired_src_nodes(); 2745 pf_status.src_nodes = 0; 2746 break; 2747 } 2748 2749 case DIOCSETHOSTID: { 2750 u_int32_t *hostid = (u_int32_t *)addr; 2751 2752 if (*hostid == 0) 2753 pf_status.hostid = arc4random(); 2754 else 2755 pf_status.hostid = *hostid; 2756 break; 2757 } 2758 2759 case DIOCOSFPFLUSH: 2760 pf_osfp_flush(); 2761 break; 2762 2763 case DIOCIGETIFACES: { 2764 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2765 2766 if (io->pfiio_esize != sizeof(struct pfi_if)) { 2767 error = ENODEV; 2768 break; 2769 } 2770 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 2771 &io->pfiio_size, io->pfiio_flags); 2772 break; 2773 } 2774 2775 case DIOCICLRISTATS: { 2776 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2777 2778 error = pfi_clr_istats(io->pfiio_name, &io->pfiio_nzero, 2779 io->pfiio_flags); 2780 break; 2781 } 2782 2783 case DIOCSETIFFLAG: { 2784 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2785 2786 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 2787 break; 2788 } 2789 2790 case DIOCCLRIFFLAG: { 2791 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2792 2793 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 2794 break; 2795 } 2796 2797 default: 2798 error = ENODEV; 2799 break; 2800 } 2801 fail: 2802 splx(s); 2803 return (error); 2804 } 2805
Indexes created Thu Oct 02 14:10:14 GMT 2025