pf_ioctl.c revision 1.11
1 /* $NetBSD: pf_ioctl.c,v 1.11 2004/11/13 21:13:07 yamt Exp $ */ 2 /* $OpenBSD: pf_ioctl.c,v 1.112 2004/03/22 04:54:18 mcbride Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #ifdef _KERNEL_OPT 40 #include "opt_inet.h" 41 #include "opt_altq.h" 42 #include "opt_pfil_hooks.h" 43 #endif 44 45 #ifdef __OpenBSD__ 46 #include "pfsync.h" 47 #else 48 #define NPFSYNC 0 49 #endif 50 51 #include <sys/param.h> 52 #include <sys/systm.h> 53 #include <sys/mbuf.h> 54 #include <sys/filio.h> 55 #include <sys/fcntl.h> 56 #include <sys/socket.h> 57 #include <sys/socketvar.h> 58 #include <sys/kernel.h> 59 #include <sys/time.h> 60 #ifdef __OpenBSD__ 61 #include <sys/timeout.h> 62 #else 63 #include <sys/callout.h> 64 #endif 65 #include <sys/pool.h> 66 #include <sys/malloc.h> 67 #ifdef __NetBSD__ 68 #include <sys/conf.h> 69 #endif 70 71 #include <net/if.h> 72 #include <net/if_types.h> 73 #include <net/route.h> 74 75 #include <netinet/in.h> 76 #include <netinet/in_var.h> 77 #include <netinet/in_systm.h> 78 #include <netinet/ip.h> 79 #include <netinet/ip_var.h> 80 #include <netinet/ip_icmp.h> 81 82 #ifdef __OpenBSD__ 83 #include <dev/rndvar.h> 84 #endif 85 #include <net/pfvar.h> 86 87 #if NPFSYNC > 0 88 #include <net/if_pfsync.h> 89 #endif /* NPFSYNC > 0 */ 90 91 #ifdef INET6 92 #include <netinet/ip6.h> 93 #include <netinet/in_pcb.h> 94 #endif /* INET6 */ 95 96 #ifdef ALTQ 97 #include <altq/altq.h> 98 #endif 99 100 void pfattach(int); 101 #ifdef _LKM 102 void pfdetach(void); 103 #endif 104 int pfopen(dev_t, int, int, struct proc *); 105 int pfclose(dev_t, int, int, struct proc *); 106 struct pf_pool *pf_get_pool(char *, char *, u_int32_t, 107 u_int8_t, u_int8_t, u_int8_t, u_int8_t, u_int8_t); 108 int pf_get_ruleset_number(u_int8_t); 109 void pf_init_ruleset(struct pf_ruleset *); 110 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 111 void pf_empty_pool(struct pf_palist *); 112 int pfioctl(dev_t, u_long, caddr_t, int, struct proc *); 113 #ifdef ALTQ 114 int pf_begin_altq(u_int32_t *); 115 int pf_rollback_altq(u_int32_t); 116 int pf_commit_altq(u_int32_t); 117 #endif /* ALTQ */ 118 int pf_begin_rules(u_int32_t *, int, char *, char *); 119 int pf_rollback_rules(u_int32_t, int, char *, char *); 120 int pf_commit_rules(u_int32_t, int, char *, char *); 121 122 #ifdef __NetBSD__ 123 const struct cdevsw pf_cdevsw = { 124 pfopen, pfclose, noread, nowrite, pfioctl, 125 nostop, notty, nopoll, nommap, nokqfilter, 126 }; 127 128 static int pf_pfil_attach(void); 129 static int pf_pfil_detach(void); 130 131 static int pf_pfil_attached = 0; 132 #endif 133 134 #ifdef __OpenBSD__ 135 extern struct timeout pf_expire_to; 136 #else 137 extern struct callout pf_expire_to; 138 #endif 139 140 struct pf_rule pf_default_rule; 141 142 #define TAGID_MAX 50000 143 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 144 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 145 146 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 147 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 148 #endif 149 static u_int16_t tagname2tag(struct pf_tags *, char *); 150 static void tag2tagname(struct pf_tags *, u_int16_t, char *); 151 static void tag_unref(struct pf_tags *, u_int16_t); 152 153 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 154 155 #ifdef __NetBSD__ 156 extern struct pfil_head if_pfil; 157 #endif 158 159 void 160 pfattach(int num) 161 { 162 u_int32_t *timeout = pf_default_rule.timeout; 163 164 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 165 &pool_allocator_nointr); 166 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 167 "pfsrctrpl", NULL); 168 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 169 NULL); 170 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 171 NULL); 172 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 173 "pfpooladdrpl", NULL); 174 pfr_initialize(); 175 pfi_initialize(); 176 pf_osfp_initialize(); 177 178 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 179 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 180 181 RB_INIT(&tree_src_tracking); 182 TAILQ_INIT(&pf_anchors); 183 pf_init_ruleset(&pf_main_ruleset); 184 TAILQ_INIT(&pf_altqs[0]); 185 TAILQ_INIT(&pf_altqs[1]); 186 TAILQ_INIT(&pf_pabuf); 187 pf_altqs_active = &pf_altqs[0]; 188 pf_altqs_inactive = &pf_altqs[1]; 189 TAILQ_INIT(&state_updates); 190 191 /* default rule should never be garbage collected */ 192 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 193 pf_default_rule.action = PF_PASS; 194 pf_default_rule.nr = -1; 195 196 /* initialize default timeouts */ 197 timeout[PFTM_TCP_FIRST_PACKET] = 120; /* First TCP packet */ 198 timeout[PFTM_TCP_OPENING] = 30; /* No response yet */ 199 timeout[PFTM_TCP_ESTABLISHED] = 24*60*60; /* Established */ 200 timeout[PFTM_TCP_CLOSING] = 15 * 60; /* Half closed */ 201 timeout[PFTM_TCP_FIN_WAIT] = 45; /* Got both FINs */ 202 timeout[PFTM_TCP_CLOSED] = 90; /* Got a RST */ 203 timeout[PFTM_UDP_FIRST_PACKET] = 60; /* First UDP packet */ 204 timeout[PFTM_UDP_SINGLE] = 30; /* Unidirectional */ 205 timeout[PFTM_UDP_MULTIPLE] = 60; /* Bidirectional */ 206 timeout[PFTM_ICMP_FIRST_PACKET] = 20; /* First ICMP packet */ 207 timeout[PFTM_ICMP_ERROR_REPLY] = 10; /* Got error response */ 208 timeout[PFTM_OTHER_FIRST_PACKET] = 60; /* First packet */ 209 timeout[PFTM_OTHER_SINGLE] = 30; /* Unidirectional */ 210 timeout[PFTM_OTHER_MULTIPLE] = 60; /* Bidirectional */ 211 timeout[PFTM_FRAG] = 30; /* Fragment expire */ 212 timeout[PFTM_INTERVAL] = 10; /* Expire interval */ 213 timeout[PFTM_SRC_NODE] = 0; /* Source tracking */ 214 215 #ifdef __OpenBSD__ 216 timeout_set(&pf_expire_to, pf_purge_timeout, &pf_expire_to); 217 timeout_add(&pf_expire_to, timeout[PFTM_INTERVAL] * hz); 218 #else 219 callout_init(&pf_expire_to); 220 callout_reset(&pf_expire_to, timeout[PFTM_INTERVAL] * hz, 221 pf_purge_timeout, &pf_expire_to); 222 #endif 223 224 pf_normalize_init(); 225 bzero(&pf_status, sizeof(pf_status)); 226 pf_status.debug = PF_DEBUG_URGENT; 227 228 /* XXX do our best to avoid a conflict */ 229 pf_status.hostid = arc4random(); 230 } 231 232 #ifdef _LKM 233 #define TAILQ_DRAIN(list, element) \ 234 do { \ 235 while ((element = TAILQ_FIRST(list)) != NULL) { \ 236 TAILQ_REMOVE(list, element, entries); \ 237 free(element, M_TEMP); \ 238 } \ 239 } while (0) 240 241 void 242 pfdetach(void) 243 { 244 struct pf_pooladdr *pooladdr_e; 245 struct pf_altq *altq_e; 246 struct pf_anchor *anchor_e; 247 248 (void)pf_pfil_detach(); 249 250 callout_stop(&pf_expire_to); 251 pf_normalize_destroy(); 252 pf_osfp_destroy(); 253 pfi_destroy(); 254 255 TAILQ_DRAIN(&pf_pabuf, pooladdr_e); 256 TAILQ_DRAIN(&pf_altqs[1], altq_e); 257 TAILQ_DRAIN(&pf_altqs[0], altq_e); 258 TAILQ_DRAIN(&pf_anchors, anchor_e); 259 260 pf_remove_if_empty_ruleset(&pf_main_ruleset); 261 pfr_destroy(); 262 pool_destroy(&pf_pooladdr_pl); 263 pool_destroy(&pf_altq_pl); 264 pool_destroy(&pf_state_pl); 265 pool_destroy(&pf_rule_pl); 266 pool_destroy(&pf_src_tree_pl); 267 } 268 #endif 269 270 int 271 pfopen(dev_t dev, int flags, int fmt, struct proc *p) 272 { 273 if (minor(dev) >= 1) 274 return (ENXIO); 275 return (0); 276 } 277 278 int 279 pfclose(dev_t dev, int flags, int fmt, struct proc *p) 280 { 281 if (minor(dev) >= 1) 282 return (ENXIO); 283 return (0); 284 } 285 286 struct pf_pool * 287 pf_get_pool(char *anchorname, char *rulesetname, u_int32_t ticket, 288 u_int8_t rule_action, u_int8_t rule_number, u_int8_t r_last, 289 u_int8_t active, u_int8_t check_ticket) 290 { 291 struct pf_ruleset *ruleset; 292 struct pf_rule *rule; 293 int rs_num; 294 295 ruleset = pf_find_ruleset(anchorname, rulesetname); 296 if (ruleset == NULL) 297 return (NULL); 298 rs_num = pf_get_ruleset_number(rule_action); 299 if (rs_num >= PF_RULESET_MAX) 300 return (NULL); 301 if (active) { 302 if (check_ticket && ticket != 303 ruleset->rules[rs_num].active.ticket) 304 return (NULL); 305 if (r_last) 306 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 307 pf_rulequeue); 308 else 309 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 310 } else { 311 if (check_ticket && ticket != 312 ruleset->rules[rs_num].inactive.ticket) 313 return (NULL); 314 if (r_last) 315 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 316 pf_rulequeue); 317 else 318 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 319 } 320 if (!r_last) { 321 while ((rule != NULL) && (rule->nr != rule_number)) 322 rule = TAILQ_NEXT(rule, entries); 323 } 324 if (rule == NULL) 325 return (NULL); 326 327 return (&rule->rpool); 328 } 329 330 int 331 pf_get_ruleset_number(u_int8_t action) 332 { 333 switch (action) { 334 case PF_SCRUB: 335 return (PF_RULESET_SCRUB); 336 break; 337 case PF_PASS: 338 case PF_DROP: 339 return (PF_RULESET_FILTER); 340 break; 341 case PF_NAT: 342 case PF_NONAT: 343 return (PF_RULESET_NAT); 344 break; 345 case PF_BINAT: 346 case PF_NOBINAT: 347 return (PF_RULESET_BINAT); 348 break; 349 case PF_RDR: 350 case PF_NORDR: 351 return (PF_RULESET_RDR); 352 break; 353 default: 354 return (PF_RULESET_MAX); 355 break; 356 } 357 } 358 359 void 360 pf_init_ruleset(struct pf_ruleset *ruleset) 361 { 362 int i; 363 364 memset(ruleset, 0, sizeof(struct pf_ruleset)); 365 for (i = 0; i < PF_RULESET_MAX; i++) { 366 TAILQ_INIT(&ruleset->rules[i].queues[0]); 367 TAILQ_INIT(&ruleset->rules[i].queues[1]); 368 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 369 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 370 } 371 } 372 373 struct pf_anchor * 374 pf_find_anchor(const char *anchorname) 375 { 376 struct pf_anchor *anchor; 377 int n = -1; 378 379 anchor = TAILQ_FIRST(&pf_anchors); 380 while (anchor != NULL && (n = strcmp(anchor->name, anchorname)) < 0) 381 anchor = TAILQ_NEXT(anchor, entries); 382 if (n == 0) 383 return (anchor); 384 else 385 return (NULL); 386 } 387 388 struct pf_ruleset * 389 pf_find_ruleset(char *anchorname, char *rulesetname) 390 { 391 struct pf_anchor *anchor; 392 struct pf_ruleset *ruleset; 393 394 if (!anchorname[0] && !rulesetname[0]) 395 return (&pf_main_ruleset); 396 if (!anchorname[0] || !rulesetname[0]) 397 return (NULL); 398 anchorname[PF_ANCHOR_NAME_SIZE-1] = 0; 399 rulesetname[PF_RULESET_NAME_SIZE-1] = 0; 400 anchor = pf_find_anchor(anchorname); 401 if (anchor == NULL) 402 return (NULL); 403 ruleset = TAILQ_FIRST(&anchor->rulesets); 404 while (ruleset != NULL && strcmp(ruleset->name, rulesetname) < 0) 405 ruleset = TAILQ_NEXT(ruleset, entries); 406 if (ruleset != NULL && !strcmp(ruleset->name, rulesetname)) 407 return (ruleset); 408 else 409 return (NULL); 410 } 411 412 struct pf_ruleset * 413 pf_find_or_create_ruleset(char anchorname[PF_ANCHOR_NAME_SIZE], 414 char rulesetname[PF_RULESET_NAME_SIZE]) 415 { 416 struct pf_anchor *anchor, *a; 417 struct pf_ruleset *ruleset, *r; 418 419 if (!anchorname[0] && !rulesetname[0]) 420 return (&pf_main_ruleset); 421 if (!anchorname[0] || !rulesetname[0]) 422 return (NULL); 423 anchorname[PF_ANCHOR_NAME_SIZE-1] = 0; 424 rulesetname[PF_RULESET_NAME_SIZE-1] = 0; 425 a = TAILQ_FIRST(&pf_anchors); 426 while (a != NULL && strcmp(a->name, anchorname) < 0) 427 a = TAILQ_NEXT(a, entries); 428 if (a != NULL && !strcmp(a->name, anchorname)) 429 anchor = a; 430 else { 431 anchor = (struct pf_anchor *)malloc(sizeof(struct pf_anchor), 432 M_TEMP, M_NOWAIT); 433 if (anchor == NULL) 434 return (NULL); 435 memset(anchor, 0, sizeof(struct pf_anchor)); 436 bcopy(anchorname, anchor->name, sizeof(anchor->name)); 437 TAILQ_INIT(&anchor->rulesets); 438 if (a != NULL) 439 TAILQ_INSERT_BEFORE(a, anchor, entries); 440 else 441 TAILQ_INSERT_TAIL(&pf_anchors, anchor, entries); 442 } 443 r = TAILQ_FIRST(&anchor->rulesets); 444 while (r != NULL && strcmp(r->name, rulesetname) < 0) 445 r = TAILQ_NEXT(r, entries); 446 if (r != NULL && !strcmp(r->name, rulesetname)) 447 return (r); 448 ruleset = (struct pf_ruleset *)malloc(sizeof(struct pf_ruleset), 449 M_TEMP, M_NOWAIT); 450 if (ruleset != NULL) { 451 pf_init_ruleset(ruleset); 452 bcopy(rulesetname, ruleset->name, sizeof(ruleset->name)); 453 ruleset->anchor = anchor; 454 if (r != NULL) 455 TAILQ_INSERT_BEFORE(r, ruleset, entries); 456 else 457 TAILQ_INSERT_TAIL(&anchor->rulesets, ruleset, entries); 458 } 459 return (ruleset); 460 } 461 462 void 463 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 464 { 465 struct pf_anchor *anchor; 466 int i; 467 468 if (ruleset == NULL || ruleset->anchor == NULL || ruleset->tables > 0 || 469 ruleset->topen) 470 return; 471 for (i = 0; i < PF_RULESET_MAX; ++i) 472 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 473 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 474 ruleset->rules[i].inactive.open) 475 return; 476 477 anchor = ruleset->anchor; 478 TAILQ_REMOVE(&anchor->rulesets, ruleset, entries); 479 free(ruleset, M_TEMP); 480 481 if (TAILQ_EMPTY(&anchor->rulesets)) { 482 TAILQ_REMOVE(&pf_anchors, anchor, entries); 483 free(anchor, M_TEMP); 484 pf_update_anchor_rules(); 485 } 486 } 487 488 void 489 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 490 { 491 struct pf_pooladdr *mv_pool_pa; 492 493 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 494 TAILQ_REMOVE(poola, mv_pool_pa, entries); 495 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 496 } 497 } 498 499 void 500 pf_empty_pool(struct pf_palist *poola) 501 { 502 struct pf_pooladdr *empty_pool_pa; 503 504 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 505 pfi_dynaddr_remove(&empty_pool_pa->addr); 506 pf_tbladdr_remove(&empty_pool_pa->addr); 507 pfi_detach_rule(empty_pool_pa->kif); 508 TAILQ_REMOVE(poola, empty_pool_pa, entries); 509 pool_put(&pf_pooladdr_pl, empty_pool_pa); 510 } 511 } 512 513 void 514 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 515 { 516 if (rulequeue != NULL) { 517 if (rule->states <= 0) { 518 /* 519 * XXX - we need to remove the table *before* detaching 520 * the rule to make sure the table code does not delete 521 * the anchor under our feet. 522 */ 523 pf_tbladdr_remove(&rule->src.addr); 524 pf_tbladdr_remove(&rule->dst.addr); 525 } 526 TAILQ_REMOVE(rulequeue, rule, entries); 527 rule->entries.tqe_prev = NULL; 528 rule->nr = -1; 529 } 530 531 if (rule->states > 0 || rule->src_nodes > 0 || 532 rule->entries.tqe_prev != NULL) 533 return; 534 pf_tag_unref(rule->tag); 535 pf_tag_unref(rule->match_tag); 536 #ifdef ALTQ 537 if (rule->pqid != rule->qid) 538 pf_qid_unref(rule->pqid); 539 pf_qid_unref(rule->qid); 540 #endif 541 pfi_dynaddr_remove(&rule->src.addr); 542 pfi_dynaddr_remove(&rule->dst.addr); 543 if (rulequeue == NULL) { 544 pf_tbladdr_remove(&rule->src.addr); 545 pf_tbladdr_remove(&rule->dst.addr); 546 } 547 pfi_detach_rule(rule->kif); 548 pf_empty_pool(&rule->rpool.list); 549 pool_put(&pf_rule_pl, rule); 550 } 551 552 static u_int16_t 553 tagname2tag(struct pf_tags *head, char *tagname) 554 { 555 struct pf_tagname *tag, *p = NULL; 556 u_int16_t new_tagid = 1; 557 558 TAILQ_FOREACH(tag, head, entries) 559 if (strcmp(tagname, tag->name) == 0) { 560 tag->ref++; 561 return (tag->tag); 562 } 563 564 /* 565 * to avoid fragmentation, we do a linear search from the beginning 566 * and take the first free slot we find. if there is none or the list 567 * is empty, append a new entry at the end. 568 */ 569 570 /* new entry */ 571 if (!TAILQ_EMPTY(head)) 572 for (p = TAILQ_FIRST(head); p != NULL && 573 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 574 new_tagid = p->tag + 1; 575 576 if (new_tagid > TAGID_MAX) 577 return (0); 578 579 /* allocate and fill new struct pf_tagname */ 580 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 581 M_TEMP, M_NOWAIT); 582 if (tag == NULL) 583 return (0); 584 bzero(tag, sizeof(struct pf_tagname)); 585 strlcpy(tag->name, tagname, sizeof(tag->name)); 586 tag->tag = new_tagid; 587 tag->ref++; 588 589 if (p != NULL) /* insert new entry before p */ 590 TAILQ_INSERT_BEFORE(p, tag, entries); 591 else /* either list empty or no free slot in between */ 592 TAILQ_INSERT_TAIL(head, tag, entries); 593 594 return (tag->tag); 595 } 596 597 static void 598 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 599 { 600 struct pf_tagname *tag; 601 602 TAILQ_FOREACH(tag, head, entries) 603 if (tag->tag == tagid) { 604 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 605 return; 606 } 607 } 608 609 static void 610 tag_unref(struct pf_tags *head, u_int16_t tag) 611 { 612 struct pf_tagname *p, *next; 613 614 if (tag == 0) 615 return; 616 617 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 618 next = TAILQ_NEXT(p, entries); 619 if (tag == p->tag) { 620 if (--p->ref == 0) { 621 TAILQ_REMOVE(head, p, entries); 622 free(p, M_TEMP); 623 } 624 break; 625 } 626 } 627 } 628 629 u_int16_t 630 pf_tagname2tag(char *tagname) 631 { 632 return (tagname2tag(&pf_tags, tagname)); 633 } 634 635 void 636 pf_tag2tagname(u_int16_t tagid, char *p) 637 { 638 return (tag2tagname(&pf_tags, tagid, p)); 639 } 640 641 void 642 pf_tag_unref(u_int16_t tag) 643 { 644 return (tag_unref(&pf_tags, tag)); 645 } 646 647 #ifdef ALTQ 648 u_int32_t 649 pf_qname2qid(char *qname) 650 { 651 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 652 } 653 654 void 655 pf_qid2qname(u_int32_t qid, char *p) 656 { 657 return (tag2tagname(&pf_qids, (u_int16_t)qid, p)); 658 } 659 660 void 661 pf_qid_unref(u_int32_t qid) 662 { 663 return (tag_unref(&pf_qids, (u_int16_t)qid)); 664 } 665 666 int 667 pf_begin_altq(u_int32_t *ticket) 668 { 669 struct pf_altq *altq; 670 int error = 0; 671 672 /* Purge the old altq list */ 673 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 674 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 675 if (altq->qname[0] == 0) { 676 /* detach and destroy the discipline */ 677 error = altq_remove(altq); 678 } else 679 pf_qid_unref(altq->qid); 680 pool_put(&pf_altq_pl, altq); 681 } 682 if (error) 683 return (error); 684 *ticket = ++ticket_altqs_inactive; 685 altqs_inactive_open = 1; 686 return (0); 687 } 688 689 int 690 pf_rollback_altq(u_int32_t ticket) 691 { 692 struct pf_altq *altq; 693 int error = 0; 694 695 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 696 return (0); 697 /* Purge the old altq list */ 698 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 699 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 700 if (altq->qname[0] == 0) { 701 /* detach and destroy the discipline */ 702 error = altq_remove(altq); 703 } else 704 pf_qid_unref(altq->qid); 705 pool_put(&pf_altq_pl, altq); 706 } 707 altqs_inactive_open = 0; 708 return (error); 709 } 710 711 int 712 pf_commit_altq(u_int32_t ticket) 713 { 714 struct pf_altqqueue *old_altqs; 715 struct pf_altq *altq; 716 int s, err, error = 0; 717 718 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 719 return (EBUSY); 720 721 /* swap altqs, keep the old. */ 722 s = splsoftnet(); 723 old_altqs = pf_altqs_active; 724 pf_altqs_active = pf_altqs_inactive; 725 pf_altqs_inactive = old_altqs; 726 ticket_altqs_active = ticket_altqs_inactive; 727 728 /* Attach new disciplines */ 729 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 730 if (altq->qname[0] == 0) { 731 /* attach the discipline */ 732 error = altq_pfattach(altq); 733 if (error) { 734 splx(s); 735 return (error); 736 } 737 } 738 } 739 740 /* Purge the old altq list */ 741 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 742 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 743 if (altq->qname[0] == 0) { 744 /* detach and destroy the discipline */ 745 err = altq_pfdetach(altq); 746 if (err != 0 && error == 0) 747 error = err; 748 err = altq_remove(altq); 749 if (err != 0 && error == 0) 750 error = err; 751 } else 752 pf_qid_unref(altq->qid); 753 pool_put(&pf_altq_pl, altq); 754 } 755 splx(s); 756 757 altqs_inactive_open = 0; 758 return (error); 759 } 760 #endif /* ALTQ */ 761 762 int 763 pf_begin_rules(u_int32_t *ticket, int rs_num, char *anchor, char *ruleset) 764 { 765 struct pf_ruleset *rs; 766 struct pf_rule *rule; 767 768 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 769 return (EINVAL); 770 rs = pf_find_or_create_ruleset(anchor, ruleset); 771 if (rs == NULL) 772 return (EINVAL); 773 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 774 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 775 *ticket = ++rs->rules[rs_num].inactive.ticket; 776 rs->rules[rs_num].inactive.open = 1; 777 return (0); 778 } 779 780 int 781 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor, char *ruleset) 782 { 783 struct pf_ruleset *rs; 784 struct pf_rule *rule; 785 786 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 787 return (EINVAL); 788 rs = pf_find_ruleset(anchor, ruleset); 789 if (rs == NULL || !rs->rules[rs_num].inactive.open || 790 rs->rules[rs_num].inactive.ticket != ticket) 791 return (0); 792 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 793 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 794 rs->rules[rs_num].inactive.open = 0; 795 return (0); 796 } 797 798 int 799 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor, char *ruleset) 800 { 801 struct pf_ruleset *rs; 802 struct pf_rule *rule; 803 struct pf_rulequeue *old_rules; 804 int s; 805 806 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 807 return (EINVAL); 808 rs = pf_find_ruleset(anchor, ruleset); 809 if (rs == NULL || !rs->rules[rs_num].inactive.open || 810 ticket != rs->rules[rs_num].inactive.ticket) 811 return (EBUSY); 812 813 /* Swap rules, keep the old. */ 814 s = splsoftnet(); 815 old_rules = rs->rules[rs_num].active.ptr; 816 rs->rules[rs_num].active.ptr = 817 rs->rules[rs_num].inactive.ptr; 818 rs->rules[rs_num].inactive.ptr = old_rules; 819 rs->rules[rs_num].active.ticket = 820 rs->rules[rs_num].inactive.ticket; 821 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 822 823 /* Purge the old rule list. */ 824 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 825 pf_rm_rule(old_rules, rule); 826 rs->rules[rs_num].inactive.open = 0; 827 pf_remove_if_empty_ruleset(rs); 828 pf_update_anchor_rules(); 829 splx(s); 830 return (0); 831 } 832 833 int 834 pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p) 835 { 836 struct pf_pooladdr *pa = NULL; 837 struct pf_pool *pool = NULL; 838 int s; 839 int error = 0; 840 841 /* XXX keep in sync with switch() below */ 842 if (securelevel > 1) 843 switch (cmd) { 844 case DIOCGETRULES: 845 case DIOCGETRULE: 846 case DIOCGETADDRS: 847 case DIOCGETADDR: 848 case DIOCGETSTATE: 849 case DIOCSETSTATUSIF: 850 case DIOCGETSTATUS: 851 case DIOCCLRSTATUS: 852 case DIOCNATLOOK: 853 case DIOCSETDEBUG: 854 case DIOCGETSTATES: 855 case DIOCGETTIMEOUT: 856 case DIOCCLRRULECTRS: 857 case DIOCGETLIMIT: 858 case DIOCGETALTQS: 859 case DIOCGETALTQ: 860 case DIOCGETQSTATS: 861 case DIOCGETANCHORS: 862 case DIOCGETANCHOR: 863 case DIOCGETRULESETS: 864 case DIOCGETRULESET: 865 case DIOCRGETTABLES: 866 case DIOCRGETTSTATS: 867 case DIOCRCLRTSTATS: 868 case DIOCRCLRADDRS: 869 case DIOCRADDADDRS: 870 case DIOCRDELADDRS: 871 case DIOCRSETADDRS: 872 case DIOCRGETADDRS: 873 case DIOCRGETASTATS: 874 case DIOCRCLRASTATS: 875 case DIOCRTSTADDRS: 876 case DIOCOSFPGET: 877 case DIOCGETSRCNODES: 878 case DIOCCLRSRCNODES: 879 case DIOCIGETIFACES: 880 case DIOCICLRISTATS: 881 break; 882 case DIOCRCLRTABLES: 883 case DIOCRADDTABLES: 884 case DIOCRDELTABLES: 885 case DIOCRSETTFLAGS: 886 if (((struct pfioc_table *)addr)->pfrio_flags & 887 PFR_FLAG_DUMMY) 888 break; /* dummy operation ok */ 889 return (EPERM); 890 default: 891 return (EPERM); 892 } 893 894 if (!(flags & FWRITE)) 895 switch (cmd) { 896 case DIOCGETRULES: 897 case DIOCGETRULE: 898 case DIOCGETADDRS: 899 case DIOCGETADDR: 900 case DIOCGETSTATE: 901 case DIOCGETSTATUS: 902 case DIOCGETSTATES: 903 case DIOCGETTIMEOUT: 904 case DIOCGETLIMIT: 905 case DIOCGETALTQS: 906 case DIOCGETALTQ: 907 case DIOCGETQSTATS: 908 case DIOCGETANCHORS: 909 case DIOCGETANCHOR: 910 case DIOCGETRULESETS: 911 case DIOCGETRULESET: 912 case DIOCRGETTABLES: 913 case DIOCRGETTSTATS: 914 case DIOCRGETADDRS: 915 case DIOCRGETASTATS: 916 case DIOCRTSTADDRS: 917 case DIOCOSFPGET: 918 case DIOCGETSRCNODES: 919 case DIOCIGETIFACES: 920 break; 921 case DIOCRCLRTABLES: 922 case DIOCRADDTABLES: 923 case DIOCRDELTABLES: 924 case DIOCRCLRTSTATS: 925 case DIOCRCLRADDRS: 926 case DIOCRADDADDRS: 927 case DIOCRDELADDRS: 928 case DIOCRSETADDRS: 929 case DIOCRSETTFLAGS: 930 if (((struct pfioc_table *)addr)->pfrio_flags & 931 PFR_FLAG_DUMMY) 932 break; /* dummy operation ok */ 933 return (EACCES); 934 default: 935 return (EACCES); 936 } 937 938 switch (cmd) { 939 940 case DIOCSTART: 941 if (pf_status.running) 942 error = EEXIST; 943 else { 944 #ifdef __NetBSD__ 945 error = pf_pfil_attach(); 946 if (error) 947 break; 948 #endif 949 pf_status.running = 1; 950 pf_status.since = time.tv_sec; 951 if (pf_status.stateid == 0) { 952 pf_status.stateid = time.tv_sec; 953 pf_status.stateid = pf_status.stateid << 32; 954 } 955 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 956 } 957 break; 958 959 case DIOCSTOP: 960 if (!pf_status.running) 961 error = ENOENT; 962 else { 963 #ifdef __NetBSD__ 964 error = pf_pfil_detach(); 965 if (error) 966 break; 967 #endif 968 pf_status.running = 0; 969 pf_status.since = time.tv_sec; 970 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 971 } 972 break; 973 974 case DIOCBEGINRULES: { 975 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 976 977 error = pf_begin_rules(&pr->ticket, pf_get_ruleset_number( 978 pr->rule.action), pr->anchor, pr->ruleset); 979 break; 980 } 981 982 case DIOCADDRULE: { 983 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 984 struct pf_ruleset *ruleset; 985 struct pf_rule *rule, *tail; 986 struct pf_pooladdr *pa; 987 int rs_num; 988 989 ruleset = pf_find_ruleset(pr->anchor, pr->ruleset); 990 if (ruleset == NULL) { 991 error = EINVAL; 992 break; 993 } 994 rs_num = pf_get_ruleset_number(pr->rule.action); 995 if (rs_num >= PF_RULESET_MAX) { 996 error = EINVAL; 997 break; 998 } 999 if (pr->rule.anchorname[0] && ruleset != &pf_main_ruleset) { 1000 error = EINVAL; 1001 break; 1002 } 1003 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1004 error = EINVAL; 1005 break; 1006 } 1007 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1008 error = EBUSY; 1009 break; 1010 } 1011 if (pr->pool_ticket != ticket_pabuf) { 1012 error = EBUSY; 1013 break; 1014 } 1015 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1016 if (rule == NULL) { 1017 error = ENOMEM; 1018 break; 1019 } 1020 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1021 rule->anchor = NULL; 1022 rule->kif = NULL; 1023 TAILQ_INIT(&rule->rpool.list); 1024 /* initialize refcounting */ 1025 rule->states = 0; 1026 rule->src_nodes = 0; 1027 rule->entries.tqe_prev = NULL; 1028 #ifndef INET 1029 if (rule->af == AF_INET) { 1030 pool_put(&pf_rule_pl, rule); 1031 error = EAFNOSUPPORT; 1032 break; 1033 } 1034 #endif /* INET */ 1035 #ifndef INET6 1036 if (rule->af == AF_INET6) { 1037 pool_put(&pf_rule_pl, rule); 1038 error = EAFNOSUPPORT; 1039 break; 1040 } 1041 #endif /* INET6 */ 1042 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1043 pf_rulequeue); 1044 if (tail) 1045 rule->nr = tail->nr + 1; 1046 else 1047 rule->nr = 0; 1048 if (rule->ifname[0]) { 1049 rule->kif = pfi_attach_rule(rule->ifname); 1050 if (rule->kif == NULL) { 1051 pool_put(&pf_rule_pl, rule); 1052 error = EINVAL; 1053 break; 1054 } 1055 } 1056 1057 #ifdef ALTQ 1058 /* set queue IDs */ 1059 if (rule->qname[0] != 0) { 1060 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1061 error = EBUSY; 1062 else if (rule->pqname[0] != 0) { 1063 if ((rule->pqid = 1064 pf_qname2qid(rule->pqname)) == 0) 1065 error = EBUSY; 1066 } else 1067 rule->pqid = rule->qid; 1068 } 1069 #endif 1070 if (rule->tagname[0]) 1071 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1072 error = EBUSY; 1073 if (rule->match_tagname[0]) 1074 if ((rule->match_tag = 1075 pf_tagname2tag(rule->match_tagname)) == 0) 1076 error = EBUSY; 1077 if (rule->rt && !rule->direction) 1078 error = EINVAL; 1079 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1080 error = EINVAL; 1081 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1082 error = EINVAL; 1083 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1084 error = EINVAL; 1085 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1086 error = EINVAL; 1087 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1088 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1089 error = EINVAL; 1090 1091 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1092 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1093 (rule->action == PF_BINAT)) && !rule->anchorname[0]) || 1094 (rule->rt > PF_FASTROUTE)) && 1095 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1096 error = EINVAL; 1097 1098 if (error) { 1099 pf_rm_rule(NULL, rule); 1100 break; 1101 } 1102 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1103 rule->evaluations = rule->packets = rule->bytes = 0; 1104 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1105 rule, entries); 1106 break; 1107 } 1108 1109 case DIOCCOMMITRULES: { 1110 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1111 1112 error = pf_commit_rules(pr->ticket, pf_get_ruleset_number( 1113 pr->rule.action), pr->anchor, pr->ruleset); 1114 break; 1115 } 1116 1117 case DIOCGETRULES: { 1118 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1119 struct pf_ruleset *ruleset; 1120 struct pf_rule *tail; 1121 int rs_num; 1122 1123 ruleset = pf_find_ruleset(pr->anchor, pr->ruleset); 1124 if (ruleset == NULL) { 1125 error = EINVAL; 1126 break; 1127 } 1128 rs_num = pf_get_ruleset_number(pr->rule.action); 1129 if (rs_num >= PF_RULESET_MAX) { 1130 error = EINVAL; 1131 break; 1132 } 1133 s = splsoftnet(); 1134 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1135 pf_rulequeue); 1136 if (tail) 1137 pr->nr = tail->nr + 1; 1138 else 1139 pr->nr = 0; 1140 pr->ticket = ruleset->rules[rs_num].active.ticket; 1141 splx(s); 1142 break; 1143 } 1144 1145 case DIOCGETRULE: { 1146 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1147 struct pf_ruleset *ruleset; 1148 struct pf_rule *rule; 1149 int rs_num, i; 1150 1151 ruleset = pf_find_ruleset(pr->anchor, pr->ruleset); 1152 if (ruleset == NULL) { 1153 error = EINVAL; 1154 break; 1155 } 1156 rs_num = pf_get_ruleset_number(pr->rule.action); 1157 if (rs_num >= PF_RULESET_MAX) { 1158 error = EINVAL; 1159 break; 1160 } 1161 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1162 error = EBUSY; 1163 break; 1164 } 1165 s = splsoftnet(); 1166 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1167 while ((rule != NULL) && (rule->nr != pr->nr)) 1168 rule = TAILQ_NEXT(rule, entries); 1169 if (rule == NULL) { 1170 error = EBUSY; 1171 splx(s); 1172 break; 1173 } 1174 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1175 pfi_dynaddr_copyout(&pr->rule.src.addr); 1176 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1177 pf_tbladdr_copyout(&pr->rule.src.addr); 1178 pf_tbladdr_copyout(&pr->rule.dst.addr); 1179 for (i = 0; i < PF_SKIP_COUNT; ++i) 1180 if (rule->skip[i].ptr == NULL) 1181 pr->rule.skip[i].nr = -1; 1182 else 1183 pr->rule.skip[i].nr = 1184 rule->skip[i].ptr->nr; 1185 splx(s); 1186 break; 1187 } 1188 1189 case DIOCCHANGERULE: { 1190 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1191 struct pf_ruleset *ruleset; 1192 struct pf_rule *oldrule = NULL, *newrule = NULL; 1193 u_int32_t nr = 0; 1194 int rs_num; 1195 1196 if (!(pcr->action == PF_CHANGE_REMOVE || 1197 pcr->action == PF_CHANGE_GET_TICKET) && 1198 pcr->pool_ticket != ticket_pabuf) { 1199 error = EBUSY; 1200 break; 1201 } 1202 1203 if (pcr->action < PF_CHANGE_ADD_HEAD || 1204 pcr->action > PF_CHANGE_GET_TICKET) { 1205 error = EINVAL; 1206 break; 1207 } 1208 ruleset = pf_find_ruleset(pcr->anchor, pcr->ruleset); 1209 if (ruleset == NULL) { 1210 error = EINVAL; 1211 break; 1212 } 1213 rs_num = pf_get_ruleset_number(pcr->rule.action); 1214 if (rs_num >= PF_RULESET_MAX) { 1215 error = EINVAL; 1216 break; 1217 } 1218 1219 if (pcr->action == PF_CHANGE_GET_TICKET) { 1220 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1221 break; 1222 } else { 1223 if (pcr->ticket != 1224 ruleset->rules[rs_num].active.ticket) { 1225 error = EINVAL; 1226 break; 1227 } 1228 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1229 error = EINVAL; 1230 break; 1231 } 1232 } 1233 1234 if (pcr->action != PF_CHANGE_REMOVE) { 1235 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1236 if (newrule == NULL) { 1237 error = ENOMEM; 1238 break; 1239 } 1240 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1241 TAILQ_INIT(&newrule->rpool.list); 1242 /* initialize refcounting */ 1243 newrule->states = 0; 1244 newrule->entries.tqe_prev = NULL; 1245 #ifndef INET 1246 if (newrule->af == AF_INET) { 1247 pool_put(&pf_rule_pl, newrule); 1248 error = EAFNOSUPPORT; 1249 break; 1250 } 1251 #endif /* INET */ 1252 #ifndef INET6 1253 if (newrule->af == AF_INET6) { 1254 pool_put(&pf_rule_pl, newrule); 1255 error = EAFNOSUPPORT; 1256 break; 1257 } 1258 #endif /* INET6 */ 1259 if (newrule->ifname[0]) { 1260 newrule->kif = pfi_attach_rule(newrule->ifname); 1261 if (newrule->kif == NULL) { 1262 pool_put(&pf_rule_pl, newrule); 1263 error = EINVAL; 1264 break; 1265 } 1266 } else 1267 newrule->kif = NULL; 1268 1269 #ifdef ALTQ 1270 /* set queue IDs */ 1271 if (newrule->qname[0] != 0) { 1272 if ((newrule->qid = 1273 pf_qname2qid(newrule->qname)) == 0) 1274 error = EBUSY; 1275 else if (newrule->pqname[0] != 0) { 1276 if ((newrule->pqid = 1277 pf_qname2qid(newrule->pqname)) == 0) 1278 error = EBUSY; 1279 } else 1280 newrule->pqid = newrule->qid; 1281 } 1282 #endif 1283 if (newrule->tagname[0]) 1284 if ((newrule->tag = 1285 pf_tagname2tag(newrule->tagname)) == 0) 1286 error = EBUSY; 1287 if (newrule->match_tagname[0]) 1288 if ((newrule->match_tag = pf_tagname2tag( 1289 newrule->match_tagname)) == 0) 1290 error = EBUSY; 1291 1292 if (newrule->rt && !newrule->direction) 1293 error = EINVAL; 1294 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1295 error = EINVAL; 1296 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1297 error = EINVAL; 1298 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1299 error = EINVAL; 1300 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1301 error = EINVAL; 1302 1303 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1304 if (((((newrule->action == PF_NAT) || 1305 (newrule->action == PF_RDR) || 1306 (newrule->action == PF_BINAT) || 1307 (newrule->rt > PF_FASTROUTE)) && 1308 !newrule->anchorname[0])) && 1309 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1310 error = EINVAL; 1311 1312 if (error) { 1313 pf_rm_rule(NULL, newrule); 1314 break; 1315 } 1316 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1317 newrule->evaluations = newrule->packets = 0; 1318 newrule->bytes = 0; 1319 } 1320 pf_empty_pool(&pf_pabuf); 1321 1322 s = splsoftnet(); 1323 1324 if (pcr->action == PF_CHANGE_ADD_HEAD) 1325 oldrule = TAILQ_FIRST( 1326 ruleset->rules[rs_num].active.ptr); 1327 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1328 oldrule = TAILQ_LAST( 1329 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1330 else { 1331 oldrule = TAILQ_FIRST( 1332 ruleset->rules[rs_num].active.ptr); 1333 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1334 oldrule = TAILQ_NEXT(oldrule, entries); 1335 if (oldrule == NULL) { 1336 pf_rm_rule(NULL, newrule); 1337 error = EINVAL; 1338 splx(s); 1339 break; 1340 } 1341 } 1342 1343 if (pcr->action == PF_CHANGE_REMOVE) 1344 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1345 else { 1346 if (oldrule == NULL) 1347 TAILQ_INSERT_TAIL( 1348 ruleset->rules[rs_num].active.ptr, 1349 newrule, entries); 1350 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1351 pcr->action == PF_CHANGE_ADD_BEFORE) 1352 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1353 else 1354 TAILQ_INSERT_AFTER( 1355 ruleset->rules[rs_num].active.ptr, 1356 oldrule, newrule, entries); 1357 } 1358 1359 nr = 0; 1360 TAILQ_FOREACH(oldrule, 1361 ruleset->rules[rs_num].active.ptr, entries) 1362 oldrule->nr = nr++; 1363 1364 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1365 pf_remove_if_empty_ruleset(ruleset); 1366 pf_update_anchor_rules(); 1367 1368 ruleset->rules[rs_num].active.ticket++; 1369 splx(s); 1370 break; 1371 } 1372 1373 case DIOCCLRSTATES: { 1374 struct pf_state *state; 1375 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1376 int killed = 0; 1377 1378 s = splsoftnet(); 1379 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1380 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1381 state->u.s.kif->pfik_name)) { 1382 state->timeout = PFTM_PURGE; 1383 #if NPFSYNC 1384 /* don't send out individual delete messages */ 1385 state->sync_flags = PFSTATE_NOSYNC; 1386 #endif 1387 killed++; 1388 } 1389 } 1390 pf_purge_expired_states(); 1391 pf_status.states = 0; 1392 psk->psk_af = killed; 1393 #if NPFSYNC 1394 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1395 #endif 1396 splx(s); 1397 break; 1398 } 1399 1400 case DIOCKILLSTATES: { 1401 struct pf_state *state; 1402 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1403 int killed = 0; 1404 1405 s = splsoftnet(); 1406 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1407 if ((!psk->psk_af || state->af == psk->psk_af) 1408 && (!psk->psk_proto || psk->psk_proto == 1409 state->proto) && 1410 PF_MATCHA(psk->psk_src.not, 1411 &psk->psk_src.addr.v.a.addr, 1412 &psk->psk_src.addr.v.a.mask, 1413 &state->lan.addr, state->af) && 1414 PF_MATCHA(psk->psk_dst.not, 1415 &psk->psk_dst.addr.v.a.addr, 1416 &psk->psk_dst.addr.v.a.mask, 1417 &state->ext.addr, state->af) && 1418 (psk->psk_src.port_op == 0 || 1419 pf_match_port(psk->psk_src.port_op, 1420 psk->psk_src.port[0], psk->psk_src.port[1], 1421 state->lan.port)) && 1422 (psk->psk_dst.port_op == 0 || 1423 pf_match_port(psk->psk_dst.port_op, 1424 psk->psk_dst.port[0], psk->psk_dst.port[1], 1425 state->ext.port)) && 1426 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1427 state->u.s.kif->pfik_name))) { 1428 state->timeout = PFTM_PURGE; 1429 killed++; 1430 } 1431 } 1432 pf_purge_expired_states(); 1433 splx(s); 1434 psk->psk_af = killed; 1435 break; 1436 } 1437 1438 case DIOCADDSTATE: { 1439 struct pfioc_state *ps = (struct pfioc_state *)addr; 1440 struct pf_state *state; 1441 struct pfi_kif *kif; 1442 1443 if (ps->state.timeout >= PFTM_MAX && 1444 ps->state.timeout != PFTM_UNTIL_PACKET) { 1445 error = EINVAL; 1446 break; 1447 } 1448 state = pool_get(&pf_state_pl, PR_NOWAIT); 1449 if (state == NULL) { 1450 error = ENOMEM; 1451 break; 1452 } 1453 s = splsoftnet(); 1454 kif = pfi_lookup_create(ps->state.u.ifname); 1455 if (kif == NULL) { 1456 pool_put(&pf_state_pl, state); 1457 error = ENOENT; 1458 splx(s); 1459 break; 1460 } 1461 bcopy(&ps->state, state, sizeof(struct pf_state)); 1462 bzero(&state->u, sizeof(state->u)); 1463 state->rule.ptr = &pf_default_rule; 1464 state->nat_rule.ptr = NULL; 1465 state->anchor.ptr = NULL; 1466 state->rt_kif = NULL; 1467 state->creation = time.tv_sec; 1468 state->pfsync_time = 0; 1469 state->packets[0] = state->packets[1] = 0; 1470 state->bytes[0] = state->bytes[1] = 0; 1471 1472 if (pf_insert_state(kif, state)) { 1473 pfi_maybe_destroy(kif); 1474 pool_put(&pf_state_pl, state); 1475 error = ENOMEM; 1476 } 1477 splx(s); 1478 break; 1479 } 1480 1481 case DIOCGETSTATE: { 1482 struct pfioc_state *ps = (struct pfioc_state *)addr; 1483 struct pf_state *state; 1484 u_int32_t nr; 1485 1486 nr = 0; 1487 s = splsoftnet(); 1488 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1489 if (nr >= ps->nr) 1490 break; 1491 nr++; 1492 } 1493 if (state == NULL) { 1494 error = EBUSY; 1495 splx(s); 1496 break; 1497 } 1498 bcopy(state, &ps->state, sizeof(struct pf_state)); 1499 ps->state.rule.nr = state->rule.ptr->nr; 1500 ps->state.nat_rule.nr = (state->nat_rule.ptr == NULL) ? 1501 -1 : state->nat_rule.ptr->nr; 1502 ps->state.anchor.nr = (state->anchor.ptr == NULL) ? 1503 -1 : state->anchor.ptr->nr; 1504 splx(s); 1505 ps->state.expire = pf_state_expires(state); 1506 if (ps->state.expire > time.tv_sec) 1507 ps->state.expire -= time.tv_sec; 1508 else 1509 ps->state.expire = 0; 1510 break; 1511 } 1512 1513 case DIOCGETSTATES: { 1514 struct pfioc_states *ps = (struct pfioc_states *)addr; 1515 struct pf_state *state; 1516 struct pf_state *p, pstore; 1517 struct pfi_kif *kif; 1518 u_int32_t nr = 0; 1519 int space = ps->ps_len; 1520 1521 if (space == 0) { 1522 s = splsoftnet(); 1523 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1524 nr += kif->pfik_states; 1525 splx(s); 1526 ps->ps_len = sizeof(struct pf_state) * nr; 1527 return (0); 1528 } 1529 1530 s = splsoftnet(); 1531 p = ps->ps_states; 1532 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1533 RB_FOREACH(state, pf_state_tree_ext_gwy, 1534 &kif->pfik_ext_gwy) { 1535 int secs = time.tv_sec; 1536 1537 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1538 break; 1539 1540 bcopy(state, &pstore, sizeof(pstore)); 1541 strlcpy(pstore.u.ifname, kif->pfik_name, 1542 sizeof(pstore.u.ifname)); 1543 pstore.rule.nr = state->rule.ptr->nr; 1544 pstore.nat_rule.nr = (state->nat_rule.ptr == 1545 NULL) ? -1 : state->nat_rule.ptr->nr; 1546 pstore.anchor.nr = (state->anchor.ptr == 1547 NULL) ? -1 : state->anchor.ptr->nr; 1548 pstore.creation = secs - pstore.creation; 1549 pstore.expire = pf_state_expires(state); 1550 if (pstore.expire > secs) 1551 pstore.expire -= secs; 1552 else 1553 pstore.expire = 0; 1554 error = copyout(&pstore, p, sizeof(*p)); 1555 if (error) { 1556 splx(s); 1557 goto fail; 1558 } 1559 p++; 1560 nr++; 1561 } 1562 ps->ps_len = sizeof(struct pf_state) * nr; 1563 splx(s); 1564 break; 1565 } 1566 1567 case DIOCGETSTATUS: { 1568 struct pf_status *s = (struct pf_status *)addr; 1569 bcopy(&pf_status, s, sizeof(struct pf_status)); 1570 pfi_fill_oldstatus(s); 1571 break; 1572 } 1573 1574 case DIOCSETSTATUSIF: { 1575 struct pfioc_if *pi = (struct pfioc_if *)addr; 1576 1577 if (pi->ifname[0] == 0) { 1578 bzero(pf_status.ifname, IFNAMSIZ); 1579 break; 1580 } 1581 if (ifunit(pi->ifname) == NULL) { 1582 error = EINVAL; 1583 break; 1584 } 1585 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 1586 break; 1587 } 1588 1589 case DIOCCLRSTATUS: { 1590 bzero(pf_status.counters, sizeof(pf_status.counters)); 1591 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 1592 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 1593 if (*pf_status.ifname) 1594 pfi_clr_istats(pf_status.ifname, NULL, 1595 PFI_FLAG_INSTANCE); 1596 break; 1597 } 1598 1599 case DIOCNATLOOK: { 1600 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1601 struct pf_state *state; 1602 struct pf_state key; 1603 int m = 0, direction = pnl->direction; 1604 1605 key.af = pnl->af; 1606 key.proto = pnl->proto; 1607 1608 if (!pnl->proto || 1609 PF_AZERO(&pnl->saddr, pnl->af) || 1610 PF_AZERO(&pnl->daddr, pnl->af) || 1611 !pnl->dport || !pnl->sport) 1612 error = EINVAL; 1613 else { 1614 s = splsoftnet(); 1615 1616 /* 1617 * userland gives us source and dest of connection, 1618 * reverse the lookup so we ask for what happens with 1619 * the return traffic, enabling us to find it in the 1620 * state tree. 1621 */ 1622 if (direction == PF_IN) { 1623 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 1624 key.ext.port = pnl->dport; 1625 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 1626 key.gwy.port = pnl->sport; 1627 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 1628 } else { 1629 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 1630 key.lan.port = pnl->dport; 1631 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 1632 key.ext.port = pnl->sport; 1633 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 1634 } 1635 if (m > 1) 1636 error = E2BIG; /* more than one state */ 1637 else if (state != NULL) { 1638 if (direction == PF_IN) { 1639 PF_ACPY(&pnl->rsaddr, &state->lan.addr, 1640 state->af); 1641 pnl->rsport = state->lan.port; 1642 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 1643 pnl->af); 1644 pnl->rdport = pnl->dport; 1645 } else { 1646 PF_ACPY(&pnl->rdaddr, &state->gwy.addr, 1647 state->af); 1648 pnl->rdport = state->gwy.port; 1649 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 1650 pnl->af); 1651 pnl->rsport = pnl->sport; 1652 } 1653 } else 1654 error = ENOENT; 1655 splx(s); 1656 } 1657 break; 1658 } 1659 1660 case DIOCSETTIMEOUT: { 1661 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1662 int old; 1663 1664 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1665 pt->seconds < 0) { 1666 error = EINVAL; 1667 goto fail; 1668 } 1669 old = pf_default_rule.timeout[pt->timeout]; 1670 pf_default_rule.timeout[pt->timeout] = pt->seconds; 1671 pt->seconds = old; 1672 break; 1673 } 1674 1675 case DIOCGETTIMEOUT: { 1676 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1677 1678 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1679 error = EINVAL; 1680 goto fail; 1681 } 1682 pt->seconds = pf_default_rule.timeout[pt->timeout]; 1683 break; 1684 } 1685 1686 case DIOCGETLIMIT: { 1687 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1688 1689 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1690 error = EINVAL; 1691 goto fail; 1692 } 1693 pl->limit = pf_pool_limits[pl->index].limit; 1694 break; 1695 } 1696 1697 case DIOCSETLIMIT: { 1698 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1699 int old_limit; 1700 1701 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1702 pf_pool_limits[pl->index].pp == NULL) { 1703 error = EINVAL; 1704 goto fail; 1705 } 1706 #ifdef __OpenBSD__ 1707 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 1708 pl->limit, NULL, 0) != 0) { 1709 error = EBUSY; 1710 goto fail; 1711 } 1712 #else 1713 pool_sethardlimit(pf_pool_limits[pl->index].pp, 1714 pl->limit, NULL, 0); 1715 #endif 1716 old_limit = pf_pool_limits[pl->index].limit; 1717 pf_pool_limits[pl->index].limit = pl->limit; 1718 pl->limit = old_limit; 1719 break; 1720 } 1721 1722 case DIOCSETDEBUG: { 1723 u_int32_t *level = (u_int32_t *)addr; 1724 1725 pf_status.debug = *level; 1726 break; 1727 } 1728 1729 case DIOCCLRRULECTRS: { 1730 struct pf_ruleset *ruleset = &pf_main_ruleset; 1731 struct pf_rule *rule; 1732 1733 s = splsoftnet(); 1734 TAILQ_FOREACH(rule, 1735 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) 1736 rule->evaluations = rule->packets = 1737 rule->bytes = 0; 1738 splx(s); 1739 break; 1740 } 1741 1742 #ifdef ALTQ 1743 case DIOCSTARTALTQ: { 1744 struct pf_altq *altq; 1745 struct ifnet *ifp; 1746 struct tb_profile tb; 1747 1748 /* enable all altq interfaces on active list */ 1749 s = splsoftnet(); 1750 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1751 if (altq->qname[0] == 0) { 1752 if ((ifp = ifunit(altq->ifname)) == NULL) { 1753 error = EINVAL; 1754 break; 1755 } 1756 if (ifp->if_snd.altq_type != ALTQT_NONE) 1757 error = altq_enable(&ifp->if_snd); 1758 if (error != 0) 1759 break; 1760 /* set tokenbucket regulator */ 1761 tb.rate = altq->ifbandwidth; 1762 tb.depth = altq->tbrsize; 1763 error = tbr_set(&ifp->if_snd, &tb); 1764 if (error != 0) 1765 break; 1766 } 1767 } 1768 if (error == 0) 1769 pfaltq_running = 1; 1770 splx(s); 1771 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 1772 break; 1773 } 1774 1775 case DIOCSTOPALTQ: { 1776 struct pf_altq *altq; 1777 struct ifnet *ifp; 1778 struct tb_profile tb; 1779 int err; 1780 1781 /* disable all altq interfaces on active list */ 1782 s = splsoftnet(); 1783 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1784 if (altq->qname[0] == 0) { 1785 if ((ifp = ifunit(altq->ifname)) == NULL) { 1786 error = EINVAL; 1787 break; 1788 } 1789 if (ifp->if_snd.altq_type != ALTQT_NONE) { 1790 err = altq_disable(&ifp->if_snd); 1791 if (err != 0 && error == 0) 1792 error = err; 1793 } 1794 /* clear tokenbucket regulator */ 1795 tb.rate = 0; 1796 err = tbr_set(&ifp->if_snd, &tb); 1797 if (err != 0 && error == 0) 1798 error = err; 1799 } 1800 } 1801 if (error == 0) 1802 pfaltq_running = 0; 1803 splx(s); 1804 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 1805 break; 1806 } 1807 1808 case DIOCBEGINALTQS: { 1809 u_int32_t *ticket = (u_int32_t *)addr; 1810 1811 error = pf_begin_altq(ticket); 1812 break; 1813 } 1814 1815 case DIOCADDALTQ: { 1816 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1817 struct pf_altq *altq, *a; 1818 1819 if (pa->ticket != ticket_altqs_inactive) { 1820 error = EBUSY; 1821 break; 1822 } 1823 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 1824 if (altq == NULL) { 1825 error = ENOMEM; 1826 break; 1827 } 1828 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 1829 1830 /* 1831 * if this is for a queue, find the discipline and 1832 * copy the necessary fields 1833 */ 1834 if (altq->qname[0] != 0) { 1835 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 1836 error = EBUSY; 1837 pool_put(&pf_altq_pl, altq); 1838 break; 1839 } 1840 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 1841 if (strncmp(a->ifname, altq->ifname, 1842 IFNAMSIZ) == 0 && a->qname[0] == 0) { 1843 altq->altq_disc = a->altq_disc; 1844 break; 1845 } 1846 } 1847 } 1848 1849 error = altq_add(altq); 1850 if (error) { 1851 pool_put(&pf_altq_pl, altq); 1852 break; 1853 } 1854 1855 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 1856 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1857 break; 1858 } 1859 1860 case DIOCCOMMITALTQS: { 1861 u_int32_t ticket = *(u_int32_t *)addr; 1862 1863 error = pf_commit_altq(ticket); 1864 break; 1865 } 1866 1867 case DIOCGETALTQS: { 1868 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1869 struct pf_altq *altq; 1870 1871 pa->nr = 0; 1872 s = splsoftnet(); 1873 TAILQ_FOREACH(altq, pf_altqs_active, entries) 1874 pa->nr++; 1875 pa->ticket = ticket_altqs_active; 1876 splx(s); 1877 break; 1878 } 1879 1880 case DIOCGETALTQ: { 1881 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1882 struct pf_altq *altq; 1883 u_int32_t nr; 1884 1885 if (pa->ticket != ticket_altqs_active) { 1886 error = EBUSY; 1887 break; 1888 } 1889 nr = 0; 1890 s = splsoftnet(); 1891 altq = TAILQ_FIRST(pf_altqs_active); 1892 while ((altq != NULL) && (nr < pa->nr)) { 1893 altq = TAILQ_NEXT(altq, entries); 1894 nr++; 1895 } 1896 if (altq == NULL) { 1897 error = EBUSY; 1898 splx(s); 1899 break; 1900 } 1901 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1902 splx(s); 1903 break; 1904 } 1905 1906 case DIOCCHANGEALTQ: 1907 /* CHANGEALTQ not supported yet! */ 1908 error = ENODEV; 1909 break; 1910 1911 case DIOCGETQSTATS: { 1912 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 1913 struct pf_altq *altq; 1914 u_int32_t nr; 1915 int nbytes; 1916 1917 if (pq->ticket != ticket_altqs_active) { 1918 error = EBUSY; 1919 break; 1920 } 1921 nbytes = pq->nbytes; 1922 nr = 0; 1923 s = splsoftnet(); 1924 altq = TAILQ_FIRST(pf_altqs_active); 1925 while ((altq != NULL) && (nr < pq->nr)) { 1926 altq = TAILQ_NEXT(altq, entries); 1927 nr++; 1928 } 1929 if (altq == NULL) { 1930 error = EBUSY; 1931 splx(s); 1932 break; 1933 } 1934 error = altq_getqstats(altq, pq->buf, &nbytes); 1935 splx(s); 1936 if (error == 0) { 1937 pq->scheduler = altq->scheduler; 1938 pq->nbytes = nbytes; 1939 } 1940 break; 1941 } 1942 #endif /* ALTQ */ 1943 1944 case DIOCBEGINADDRS: { 1945 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 1946 1947 pf_empty_pool(&pf_pabuf); 1948 pp->ticket = ++ticket_pabuf; 1949 break; 1950 } 1951 1952 case DIOCADDADDR: { 1953 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 1954 1955 #ifndef INET 1956 if (pp->af == AF_INET) { 1957 error = EAFNOSUPPORT; 1958 break; 1959 } 1960 #endif /* INET */ 1961 #ifndef INET6 1962 if (pp->af == AF_INET6) { 1963 error = EAFNOSUPPORT; 1964 break; 1965 } 1966 #endif /* INET6 */ 1967 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 1968 pp->addr.addr.type != PF_ADDR_DYNIFTL && 1969 pp->addr.addr.type != PF_ADDR_TABLE) { 1970 error = EINVAL; 1971 break; 1972 } 1973 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 1974 if (pa == NULL) { 1975 error = ENOMEM; 1976 break; 1977 } 1978 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 1979 if (pa->ifname[0]) { 1980 pa->kif = pfi_attach_rule(pa->ifname); 1981 if (pa->kif == NULL) { 1982 pool_put(&pf_pooladdr_pl, pa); 1983 error = EINVAL; 1984 break; 1985 } 1986 } 1987 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 1988 pfi_dynaddr_remove(&pa->addr); 1989 pfi_detach_rule(pa->kif); 1990 pool_put(&pf_pooladdr_pl, pa); 1991 error = EINVAL; 1992 break; 1993 } 1994 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 1995 break; 1996 } 1997 1998 case DIOCGETADDRS: { 1999 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2000 2001 pp->nr = 0; 2002 s = splsoftnet(); 2003 pool = pf_get_pool(pp->anchor, pp->ruleset, pp->ticket, 2004 pp->r_action, pp->r_num, 0, 1, 0); 2005 if (pool == NULL) { 2006 error = EBUSY; 2007 splx(s); 2008 break; 2009 } 2010 TAILQ_FOREACH(pa, &pool->list, entries) 2011 pp->nr++; 2012 splx(s); 2013 break; 2014 } 2015 2016 case DIOCGETADDR: { 2017 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2018 u_int32_t nr = 0; 2019 2020 s = splsoftnet(); 2021 pool = pf_get_pool(pp->anchor, pp->ruleset, pp->ticket, 2022 pp->r_action, pp->r_num, 0, 1, 1); 2023 if (pool == NULL) { 2024 error = EBUSY; 2025 splx(s); 2026 break; 2027 } 2028 pa = TAILQ_FIRST(&pool->list); 2029 while ((pa != NULL) && (nr < pp->nr)) { 2030 pa = TAILQ_NEXT(pa, entries); 2031 nr++; 2032 } 2033 if (pa == NULL) { 2034 error = EBUSY; 2035 splx(s); 2036 break; 2037 } 2038 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2039 pfi_dynaddr_copyout(&pp->addr.addr); 2040 pf_tbladdr_copyout(&pp->addr.addr); 2041 splx(s); 2042 break; 2043 } 2044 2045 case DIOCCHANGEADDR: { 2046 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2047 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2048 struct pf_ruleset *ruleset; 2049 2050 if (pca->action < PF_CHANGE_ADD_HEAD || 2051 pca->action > PF_CHANGE_REMOVE) { 2052 error = EINVAL; 2053 break; 2054 } 2055 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2056 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2057 pca->addr.addr.type != PF_ADDR_TABLE) { 2058 error = EINVAL; 2059 break; 2060 } 2061 2062 ruleset = pf_find_ruleset(pca->anchor, pca->ruleset); 2063 if (ruleset == NULL) { 2064 error = EBUSY; 2065 break; 2066 } 2067 pool = pf_get_pool(pca->anchor, pca->ruleset, pca->ticket, 2068 pca->r_action, pca->r_num, pca->r_last, 1, 1); 2069 if (pool == NULL) { 2070 error = EBUSY; 2071 break; 2072 } 2073 if (pca->action != PF_CHANGE_REMOVE) { 2074 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2075 if (newpa == NULL) { 2076 error = ENOMEM; 2077 break; 2078 } 2079 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2080 #ifndef INET 2081 if (pca->af == AF_INET) { 2082 pool_put(&pf_pooladdr_pl, newpa); 2083 error = EAFNOSUPPORT; 2084 break; 2085 } 2086 #endif /* INET */ 2087 #ifndef INET6 2088 if (pca->af == AF_INET6) { 2089 pool_put(&pf_pooladdr_pl, newpa); 2090 error = EAFNOSUPPORT; 2091 break; 2092 } 2093 #endif /* INET6 */ 2094 if (newpa->ifname[0]) { 2095 newpa->kif = pfi_attach_rule(newpa->ifname); 2096 if (newpa->kif == NULL) { 2097 pool_put(&pf_pooladdr_pl, newpa); 2098 error = EINVAL; 2099 break; 2100 } 2101 } else 2102 newpa->kif = NULL; 2103 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2104 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2105 pfi_dynaddr_remove(&newpa->addr); 2106 pfi_detach_rule(newpa->kif); 2107 pool_put(&pf_pooladdr_pl, newpa); 2108 error = EINVAL; 2109 break; 2110 } 2111 } 2112 2113 s = splsoftnet(); 2114 2115 if (pca->action == PF_CHANGE_ADD_HEAD) 2116 oldpa = TAILQ_FIRST(&pool->list); 2117 else if (pca->action == PF_CHANGE_ADD_TAIL) 2118 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2119 else { 2120 int i = 0; 2121 2122 oldpa = TAILQ_FIRST(&pool->list); 2123 while ((oldpa != NULL) && (i < pca->nr)) { 2124 oldpa = TAILQ_NEXT(oldpa, entries); 2125 i++; 2126 } 2127 if (oldpa == NULL) { 2128 error = EINVAL; 2129 splx(s); 2130 break; 2131 } 2132 } 2133 2134 if (pca->action == PF_CHANGE_REMOVE) { 2135 TAILQ_REMOVE(&pool->list, oldpa, entries); 2136 pfi_dynaddr_remove(&oldpa->addr); 2137 pf_tbladdr_remove(&oldpa->addr); 2138 pfi_detach_rule(oldpa->kif); 2139 pool_put(&pf_pooladdr_pl, oldpa); 2140 } else { 2141 if (oldpa == NULL) 2142 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2143 else if (pca->action == PF_CHANGE_ADD_HEAD || 2144 pca->action == PF_CHANGE_ADD_BEFORE) 2145 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2146 else 2147 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2148 newpa, entries); 2149 } 2150 2151 pool->cur = TAILQ_FIRST(&pool->list); 2152 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2153 pca->af); 2154 splx(s); 2155 break; 2156 } 2157 2158 case DIOCGETANCHORS: { 2159 struct pfioc_anchor *pa = (struct pfioc_anchor *)addr; 2160 struct pf_anchor *anchor; 2161 2162 pa->nr = 0; 2163 TAILQ_FOREACH(anchor, &pf_anchors, entries) 2164 pa->nr++; 2165 break; 2166 } 2167 2168 case DIOCGETANCHOR: { 2169 struct pfioc_anchor *pa = (struct pfioc_anchor *)addr; 2170 struct pf_anchor *anchor; 2171 u_int32_t nr = 0; 2172 2173 anchor = TAILQ_FIRST(&pf_anchors); 2174 while (anchor != NULL && nr < pa->nr) { 2175 anchor = TAILQ_NEXT(anchor, entries); 2176 nr++; 2177 } 2178 if (anchor == NULL) 2179 error = EBUSY; 2180 else 2181 bcopy(anchor->name, pa->name, sizeof(pa->name)); 2182 break; 2183 } 2184 2185 case DIOCGETRULESETS: { 2186 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2187 struct pf_anchor *anchor; 2188 struct pf_ruleset *ruleset; 2189 2190 pr->anchor[PF_ANCHOR_NAME_SIZE-1] = 0; 2191 if ((anchor = pf_find_anchor(pr->anchor)) == NULL) { 2192 error = EINVAL; 2193 break; 2194 } 2195 pr->nr = 0; 2196 TAILQ_FOREACH(ruleset, &anchor->rulesets, entries) 2197 pr->nr++; 2198 break; 2199 } 2200 2201 case DIOCGETRULESET: { 2202 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2203 struct pf_anchor *anchor; 2204 struct pf_ruleset *ruleset; 2205 u_int32_t nr = 0; 2206 2207 if ((anchor = pf_find_anchor(pr->anchor)) == NULL) { 2208 error = EINVAL; 2209 break; 2210 } 2211 ruleset = TAILQ_FIRST(&anchor->rulesets); 2212 while (ruleset != NULL && nr < pr->nr) { 2213 ruleset = TAILQ_NEXT(ruleset, entries); 2214 nr++; 2215 } 2216 if (ruleset == NULL) 2217 error = EBUSY; 2218 else 2219 bcopy(ruleset->name, pr->name, sizeof(pr->name)); 2220 break; 2221 } 2222 2223 case DIOCRCLRTABLES: { 2224 struct pfioc_table *io = (struct pfioc_table *)addr; 2225 2226 if (io->pfrio_esize != 0) { 2227 error = ENODEV; 2228 break; 2229 } 2230 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2231 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2232 break; 2233 } 2234 2235 case DIOCRADDTABLES: { 2236 struct pfioc_table *io = (struct pfioc_table *)addr; 2237 2238 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2239 error = ENODEV; 2240 break; 2241 } 2242 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2243 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2244 break; 2245 } 2246 2247 case DIOCRDELTABLES: { 2248 struct pfioc_table *io = (struct pfioc_table *)addr; 2249 2250 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2251 error = ENODEV; 2252 break; 2253 } 2254 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2255 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2256 break; 2257 } 2258 2259 case DIOCRGETTABLES: { 2260 struct pfioc_table *io = (struct pfioc_table *)addr; 2261 2262 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2263 error = ENODEV; 2264 break; 2265 } 2266 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2267 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2268 break; 2269 } 2270 2271 case DIOCRGETTSTATS: { 2272 struct pfioc_table *io = (struct pfioc_table *)addr; 2273 2274 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2275 error = ENODEV; 2276 break; 2277 } 2278 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2279 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2280 break; 2281 } 2282 2283 case DIOCRCLRTSTATS: { 2284 struct pfioc_table *io = (struct pfioc_table *)addr; 2285 2286 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2287 error = ENODEV; 2288 break; 2289 } 2290 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2291 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2292 break; 2293 } 2294 2295 case DIOCRSETTFLAGS: { 2296 struct pfioc_table *io = (struct pfioc_table *)addr; 2297 2298 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2299 error = ENODEV; 2300 break; 2301 } 2302 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2303 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2304 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2305 break; 2306 } 2307 2308 case DIOCRCLRADDRS: { 2309 struct pfioc_table *io = (struct pfioc_table *)addr; 2310 2311 if (io->pfrio_esize != 0) { 2312 error = ENODEV; 2313 break; 2314 } 2315 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2316 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2317 break; 2318 } 2319 2320 case DIOCRADDADDRS: { 2321 struct pfioc_table *io = (struct pfioc_table *)addr; 2322 2323 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2324 error = ENODEV; 2325 break; 2326 } 2327 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2328 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2329 PFR_FLAG_USERIOCTL); 2330 break; 2331 } 2332 2333 case DIOCRDELADDRS: { 2334 struct pfioc_table *io = (struct pfioc_table *)addr; 2335 2336 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2337 error = ENODEV; 2338 break; 2339 } 2340 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2341 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2342 PFR_FLAG_USERIOCTL); 2343 break; 2344 } 2345 2346 case DIOCRSETADDRS: { 2347 struct pfioc_table *io = (struct pfioc_table *)addr; 2348 2349 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2350 error = ENODEV; 2351 break; 2352 } 2353 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2354 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2355 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2356 PFR_FLAG_USERIOCTL); 2357 break; 2358 } 2359 2360 case DIOCRGETADDRS: { 2361 struct pfioc_table *io = (struct pfioc_table *)addr; 2362 2363 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2364 error = ENODEV; 2365 break; 2366 } 2367 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2368 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2369 break; 2370 } 2371 2372 case DIOCRGETASTATS: { 2373 struct pfioc_table *io = (struct pfioc_table *)addr; 2374 2375 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2376 error = ENODEV; 2377 break; 2378 } 2379 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2380 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2381 break; 2382 } 2383 2384 case DIOCRCLRASTATS: { 2385 struct pfioc_table *io = (struct pfioc_table *)addr; 2386 2387 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2388 error = ENODEV; 2389 break; 2390 } 2391 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2392 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2393 PFR_FLAG_USERIOCTL); 2394 break; 2395 } 2396 2397 case DIOCRTSTADDRS: { 2398 struct pfioc_table *io = (struct pfioc_table *)addr; 2399 2400 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2401 error = ENODEV; 2402 break; 2403 } 2404 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2405 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2406 PFR_FLAG_USERIOCTL); 2407 break; 2408 } 2409 2410 case DIOCRINABEGIN: { 2411 struct pfioc_table *io = (struct pfioc_table *)addr; 2412 2413 if (io->pfrio_esize != 0) { 2414 error = ENODEV; 2415 break; 2416 } 2417 error = pfr_ina_begin(&io->pfrio_table, &io->pfrio_ticket, 2418 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2419 break; 2420 } 2421 2422 case DIOCRINACOMMIT: { 2423 struct pfioc_table *io = (struct pfioc_table *)addr; 2424 2425 if (io->pfrio_esize != 0) { 2426 error = ENODEV; 2427 break; 2428 } 2429 error = pfr_ina_commit(&io->pfrio_table, io->pfrio_ticket, 2430 &io->pfrio_nadd, &io->pfrio_nchange, io->pfrio_flags | 2431 PFR_FLAG_USERIOCTL); 2432 break; 2433 } 2434 2435 case DIOCRINADEFINE: { 2436 struct pfioc_table *io = (struct pfioc_table *)addr; 2437 2438 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2439 error = ENODEV; 2440 break; 2441 } 2442 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2443 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2444 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2445 break; 2446 } 2447 2448 case DIOCOSFPADD: { 2449 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2450 s = splsoftnet(); 2451 error = pf_osfp_add(io); 2452 splx(s); 2453 break; 2454 } 2455 2456 case DIOCOSFPGET: { 2457 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2458 s = splsoftnet(); 2459 error = pf_osfp_get(io); 2460 splx(s); 2461 break; 2462 } 2463 2464 case DIOCXBEGIN: { 2465 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2466 struct pfioc_trans_e ioe; 2467 struct pfr_table table; 2468 int i; 2469 2470 if (io->esize != sizeof(ioe)) { 2471 error = ENODEV; 2472 goto fail; 2473 } 2474 for (i = 0; i < io->size; i++) { 2475 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2476 error = EFAULT; 2477 goto fail; 2478 } 2479 switch (ioe.rs_num) { 2480 #ifdef ALTQ 2481 case PF_RULESET_ALTQ: 2482 if (ioe.anchor[0] || ioe.ruleset[0]) { 2483 error = EINVAL; 2484 goto fail; 2485 } 2486 if ((error = pf_begin_altq(&ioe.ticket))) 2487 goto fail; 2488 break; 2489 #endif /* ALTQ */ 2490 case PF_RULESET_TABLE: 2491 bzero(&table, sizeof(table)); 2492 strlcpy(table.pfrt_anchor, ioe.anchor, 2493 sizeof(table.pfrt_anchor)); 2494 strlcpy(table.pfrt_ruleset, ioe.ruleset, 2495 sizeof(table.pfrt_ruleset)); 2496 if ((error = pfr_ina_begin(&table, 2497 &ioe.ticket, NULL, 0))) 2498 goto fail; 2499 break; 2500 default: 2501 if ((error = pf_begin_rules(&ioe.ticket, 2502 ioe.rs_num, ioe.anchor, ioe.ruleset))) 2503 goto fail; 2504 break; 2505 } 2506 if (copyout(&ioe, io->array+i, sizeof(io->array[i]))) { 2507 error = EFAULT; 2508 goto fail; 2509 } 2510 } 2511 break; 2512 } 2513 2514 case DIOCXROLLBACK: { 2515 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2516 struct pfioc_trans_e ioe; 2517 struct pfr_table table; 2518 int i; 2519 2520 if (io->esize != sizeof(ioe)) { 2521 error = ENODEV; 2522 goto fail; 2523 } 2524 for (i = 0; i < io->size; i++) { 2525 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2526 error = EFAULT; 2527 goto fail; 2528 } 2529 switch (ioe.rs_num) { 2530 #ifdef ALTQ 2531 case PF_RULESET_ALTQ: 2532 if (ioe.anchor[0] || ioe.ruleset[0]) { 2533 error = EINVAL; 2534 goto fail; 2535 } 2536 if ((error = pf_rollback_altq(ioe.ticket))) 2537 goto fail; /* really bad */ 2538 break; 2539 #endif /* ALTQ */ 2540 case PF_RULESET_TABLE: 2541 bzero(&table, sizeof(table)); 2542 strlcpy(table.pfrt_anchor, ioe.anchor, 2543 sizeof(table.pfrt_anchor)); 2544 strlcpy(table.pfrt_ruleset, ioe.ruleset, 2545 sizeof(table.pfrt_ruleset)); 2546 if ((error = pfr_ina_rollback(&table, 2547 ioe.ticket, NULL, 0))) 2548 goto fail; /* really bad */ 2549 break; 2550 default: 2551 if ((error = pf_rollback_rules(ioe.ticket, 2552 ioe.rs_num, ioe.anchor, ioe.ruleset))) 2553 goto fail; /* really bad */ 2554 break; 2555 } 2556 } 2557 break; 2558 } 2559 2560 case DIOCXCOMMIT: { 2561 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2562 struct pfioc_trans_e ioe; 2563 struct pfr_table table; 2564 struct pf_ruleset *rs; 2565 int i; 2566 2567 if (io->esize != sizeof(ioe)) { 2568 error = ENODEV; 2569 goto fail; 2570 } 2571 /* first makes sure everything will succeed */ 2572 for (i = 0; i < io->size; i++) { 2573 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2574 error = EFAULT; 2575 goto fail; 2576 } 2577 switch (ioe.rs_num) { 2578 #ifdef ALTQ 2579 case PF_RULESET_ALTQ: 2580 if (ioe.anchor[0] || ioe.ruleset[0]) { 2581 error = EINVAL; 2582 goto fail; 2583 } 2584 if (!altqs_inactive_open || ioe.ticket != 2585 ticket_altqs_inactive) { 2586 error = EBUSY; 2587 goto fail; 2588 } 2589 break; 2590 #endif /* ALTQ */ 2591 case PF_RULESET_TABLE: 2592 rs = pf_find_ruleset(ioe.anchor, ioe.ruleset); 2593 if (rs == NULL || !rs->topen || ioe.ticket != 2594 rs->tticket) { 2595 error = EBUSY; 2596 goto fail; 2597 } 2598 break; 2599 default: 2600 if (ioe.rs_num < 0 || ioe.rs_num >= 2601 PF_RULESET_MAX) { 2602 error = EINVAL; 2603 goto fail; 2604 } 2605 rs = pf_find_ruleset(ioe.anchor, ioe.ruleset); 2606 if (rs == NULL || 2607 !rs->rules[ioe.rs_num].inactive.open || 2608 rs->rules[ioe.rs_num].inactive.ticket != 2609 ioe.ticket) { 2610 error = EBUSY; 2611 goto fail; 2612 } 2613 break; 2614 } 2615 } 2616 /* now do the commit - no errors should happen here */ 2617 for (i = 0; i < io->size; i++) { 2618 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2619 error = EFAULT; 2620 goto fail; 2621 } 2622 switch (ioe.rs_num) { 2623 #ifdef ALTQ 2624 case PF_RULESET_ALTQ: 2625 if ((error = pf_commit_altq(ioe.ticket))) 2626 goto fail; /* really bad */ 2627 break; 2628 #endif /* ALTQ */ 2629 case PF_RULESET_TABLE: 2630 bzero(&table, sizeof(table)); 2631 strlcpy(table.pfrt_anchor, ioe.anchor, 2632 sizeof(table.pfrt_anchor)); 2633 strlcpy(table.pfrt_ruleset, ioe.ruleset, 2634 sizeof(table.pfrt_ruleset)); 2635 if ((error = pfr_ina_commit(&table, ioe.ticket, 2636 NULL, NULL, 0))) 2637 goto fail; /* really bad */ 2638 break; 2639 default: 2640 if ((error = pf_commit_rules(ioe.ticket, 2641 ioe.rs_num, ioe.anchor, ioe.ruleset))) 2642 goto fail; /* really bad */ 2643 break; 2644 } 2645 } 2646 break; 2647 } 2648 2649 case DIOCGETSRCNODES: { 2650 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 2651 struct pf_src_node *n; 2652 struct pf_src_node *p, pstore; 2653 u_int32_t nr = 0; 2654 int space = psn->psn_len; 2655 2656 if (space == 0) { 2657 s = splsoftnet(); 2658 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 2659 nr++; 2660 splx(s); 2661 psn->psn_len = sizeof(struct pf_src_node) * nr; 2662 return (0); 2663 } 2664 2665 s = splsoftnet(); 2666 p = psn->psn_src_nodes; 2667 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2668 int secs = time.tv_sec; 2669 2670 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 2671 break; 2672 2673 bcopy(n, &pstore, sizeof(pstore)); 2674 if (n->rule.ptr != NULL) 2675 pstore.rule.nr = n->rule.ptr->nr; 2676 pstore.creation = secs - pstore.creation; 2677 if (pstore.expire > secs) 2678 pstore.expire -= secs; 2679 else 2680 pstore.expire = 0; 2681 error = copyout(&pstore, p, sizeof(*p)); 2682 if (error) { 2683 splx(s); 2684 goto fail; 2685 } 2686 p++; 2687 nr++; 2688 } 2689 psn->psn_len = sizeof(struct pf_src_node) * nr; 2690 splx(s); 2691 break; 2692 } 2693 2694 case DIOCCLRSRCNODES: { 2695 struct pf_src_node *n; 2696 struct pf_state *state; 2697 2698 s = splsoftnet(); 2699 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 2700 state->src_node = NULL; 2701 state->nat_src_node = NULL; 2702 } 2703 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2704 n->expire = 1; 2705 n->states = 0; 2706 } 2707 pf_purge_expired_src_nodes(); 2708 pf_status.src_nodes = 0; 2709 splx(s); 2710 break; 2711 } 2712 2713 case DIOCSETHOSTID: { 2714 u_int32_t *hostid = (u_int32_t *)addr; 2715 2716 if (*hostid == 0) { 2717 error = EINVAL; 2718 goto fail; 2719 } 2720 pf_status.hostid = *hostid; 2721 break; 2722 } 2723 2724 case DIOCOSFPFLUSH: 2725 s = splsoftnet(); 2726 pf_osfp_flush(); 2727 splx(s); 2728 break; 2729 2730 case DIOCIGETIFACES: { 2731 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2732 2733 if (io->pfiio_esize != sizeof(struct pfi_if)) { 2734 error = ENODEV; 2735 break; 2736 } 2737 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 2738 &io->pfiio_size, io->pfiio_flags); 2739 break; 2740 } 2741 2742 case DIOCICLRISTATS: { 2743 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2744 2745 error = pfi_clr_istats(io->pfiio_name, &io->pfiio_nzero, 2746 io->pfiio_flags); 2747 break; 2748 } 2749 2750 default: 2751 error = ENODEV; 2752 break; 2753 } 2754 fail: 2755 2756 return (error); 2757 } 2758 2759 #ifdef __NetBSD__ 2760 int 2761 pfil4_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2762 { 2763 int error; 2764 2765 /* 2766 * ensure that mbufs are writable beforehand 2767 * as it's assumed by pf code. 2768 * ip hdr (60 bytes) + tcp hdr (60 bytes) should be enough. 2769 * XXX inefficient 2770 */ 2771 error = m_makewritable(mp, 0, 60 + 60, M_DONTWAIT); 2772 if (error) { 2773 m_freem(*mp); 2774 *mp = NULL; 2775 return error; 2776 } 2777 2778 /* 2779 * If the packet is out-bound, we can't delay checksums 2780 * here. For in-bound, the checksum has already been 2781 * validated. 2782 */ 2783 if (dir == PFIL_OUT) { 2784 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 2785 in_delayed_cksum(*mp); 2786 (*mp)->m_pkthdr.csum_flags &= 2787 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 2788 } 2789 } 2790 2791 if (pf_test(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp) != PF_PASS) { 2792 m_freem(*mp); 2793 *mp = NULL; 2794 return EHOSTUNREACH; 2795 } else 2796 return (0); 2797 } 2798 2799 #ifdef INET6 2800 int 2801 pfil6_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2802 { 2803 int error; 2804 2805 /* 2806 * ensure that mbufs are writable beforehand 2807 * as it's assumed by pf code. 2808 * XXX inefficient 2809 */ 2810 error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 2811 if (error) { 2812 m_freem(*mp); 2813 *mp = NULL; 2814 return error; 2815 } 2816 2817 if (pf_test6(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp) != PF_PASS) { 2818 m_freem(*mp); 2819 *mp = NULL; 2820 return EHOSTUNREACH; 2821 } else 2822 return (0); 2823 } 2824 #endif 2825 2826 int 2827 pfil_ifnet_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2828 { 2829 u_long cmd = (u_long)mp; 2830 2831 switch (cmd) { 2832 case PFIL_IFNET_ATTACH: 2833 pfi_attach_ifnet(ifp); 2834 break; 2835 case PFIL_IFNET_DETACH: 2836 pfi_detach_ifnet(ifp); 2837 break; 2838 } 2839 2840 return (0); 2841 } 2842 2843 int 2844 pfil_ifaddr_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2845 { 2846 extern void pfi_kifaddr_update_if(struct ifnet *); 2847 2848 u_long cmd = (u_long)mp; 2849 2850 switch (cmd) { 2851 case SIOCSIFADDR: 2852 case SIOCAIFADDR: 2853 case SIOCDIFADDR: 2854 #ifdef INET6 2855 case SIOCAIFADDR_IN6: 2856 case SIOCDIFADDR_IN6: 2857 #endif 2858 pfi_kifaddr_update_if(ifp); 2859 break; 2860 default: 2861 panic("unexpected ioctl"); 2862 } 2863 2864 return (0); 2865 } 2866 2867 static int 2868 pf_pfil_attach(void) 2869 { 2870 struct pfil_head *ph_inet; 2871 #ifdef INET6 2872 struct pfil_head *ph_inet6; 2873 #endif 2874 int error; 2875 int i; 2876 2877 if (pf_pfil_attached) 2878 return (0); 2879 2880 error = pfil_add_hook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, &if_pfil); 2881 if (error) 2882 goto bad1; 2883 error = pfil_add_hook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, &if_pfil); 2884 if (error) 2885 goto bad2; 2886 2887 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 2888 if (ph_inet) 2889 error = pfil_add_hook((void *)pfil4_wrapper, NULL, 2890 PFIL_IN|PFIL_OUT, ph_inet); 2891 else 2892 error = ENOENT; 2893 if (error) 2894 goto bad3; 2895 2896 #ifdef INET6 2897 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 2898 if (ph_inet6) 2899 error = pfil_add_hook((void *)pfil6_wrapper, NULL, 2900 PFIL_IN|PFIL_OUT, ph_inet6); 2901 else 2902 error = ENOENT; 2903 if (error) 2904 goto bad4; 2905 #endif 2906 2907 for (i = 0; i < if_indexlim; i++) 2908 if (ifindex2ifnet[i]) 2909 pfi_attach_ifnet(ifindex2ifnet[i]); 2910 pf_pfil_attached = 1; 2911 2912 return (0); 2913 2914 #ifdef INET6 2915 bad4: 2916 pfil_remove_hook(pfil4_wrapper, NULL, PFIL_IN|PFIL_OUT, ph_inet); 2917 #endif 2918 bad3: 2919 pfil_remove_hook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, &if_pfil); 2920 bad2: 2921 pfil_remove_hook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, &if_pfil); 2922 bad1: 2923 return (error); 2924 } 2925 2926 static int 2927 pf_pfil_detach(void) 2928 { 2929 struct pfil_head *ph_inet; 2930 #ifdef INET6 2931 struct pfil_head *ph_inet6; 2932 #endif 2933 int i; 2934 2935 if (pf_pfil_attached == 0) 2936 return (0); 2937 2938 for (i = 0; i < if_indexlim; i++) 2939 if (pfi_index2kif[i]) 2940 pfi_detach_ifnet(ifindex2ifnet[i]); 2941 2942 pfil_remove_hook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, &if_pfil); 2943 pfil_remove_hook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, &if_pfil); 2944 2945 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 2946 if (ph_inet) 2947 pfil_remove_hook((void *)pfil4_wrapper, NULL, 2948 PFIL_IN|PFIL_OUT, ph_inet); 2949 #ifdef INET6 2950 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 2951 if (ph_inet6) 2952 pfil_remove_hook((void *)pfil6_wrapper, NULL, 2953 PFIL_IN|PFIL_OUT, ph_inet6); 2954 #endif 2955 pf_pfil_attached = 0; 2956 2957 return (0); 2958 } 2959 #endif 2960
Indexes created Sun Sep 28 16:09:52 GMT 2025