pf_ioctl.c revision 1.32.10.3
1 /* $NetBSD: pf_ioctl.c,v 1.32.10.3 2008/04/23 19:25:18 peter Exp $ */ 2 /* $OpenBSD: pf_ioctl.c,v 1.182 2007/06/24 11:17:13 mcbride Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: pf_ioctl.c,v 1.32.10.3 2008/04/23 19:25:18 peter Exp $"); 41 42 #ifdef _KERNEL_OPT 43 #include "opt_inet.h" 44 #include "opt_pfil_hooks.h" 45 #endif 46 47 #ifndef __NetBSD__ 48 #include "pfsync.h" 49 #else 50 #define NPFSYNC 0 51 #endif /* __NetBSD__ */ 52 53 #include <sys/param.h> 54 #include <sys/systm.h> 55 #include <sys/mbuf.h> 56 #include <sys/filio.h> 57 #include <sys/fcntl.h> 58 #include <sys/socket.h> 59 #include <sys/socketvar.h> 60 #include <sys/kernel.h> 61 #include <sys/time.h> 62 #include <sys/pool.h> 63 #include <sys/proc.h> 64 #include <sys/malloc.h> 65 #include <sys/kthread.h> 66 #include <sys/rwlock.h> 67 #include <uvm/uvm_extern.h> 68 #ifdef __NetBSD__ 69 #include <sys/conf.h> 70 #include <sys/lwp.h> 71 #include <sys/kauth.h> 72 #endif /* __NetBSD__ */ 73 74 #include <net/if.h> 75 #include <net/if_types.h> 76 #include <net/route.h> 77 78 #include <netinet/in.h> 79 #include <netinet/in_var.h> 80 #include <netinet/in_systm.h> 81 #include <netinet/ip.h> 82 #include <netinet/ip_var.h> 83 #include <netinet/ip_icmp.h> 84 85 #ifndef __NetBSD__ 86 #include <dev/rndvar.h> 87 #include <crypto/md5.h> 88 #else 89 #include <sys/md5.h> 90 #endif /* __NetBSD__ */ 91 #include <net/pfvar.h> 92 93 #if NPFSYNC > 0 94 #include <net/if_pfsync.h> 95 #endif /* NPFSYNC > 0 */ 96 97 #if NPFLOG > 0 98 #include <net/if_pflog.h> 99 #endif /* NPFLOG > 0 */ 100 101 #ifdef INET6 102 #include <netinet/ip6.h> 103 #include <netinet/in_pcb.h> 104 #endif /* INET6 */ 105 106 #ifdef ALTQ 107 #include <altq/altq.h> 108 #endif 109 110 void pfattach(int); 111 #ifdef _LKM 112 void pfdetach(void); 113 #endif /* _LKM */ 114 #ifndef __NetBSD__ 115 void pf_thread_create(void *); 116 #endif /* !__NetBSD__ */ 117 int pfopen(dev_t, int, int, struct lwp *); 118 int pfclose(dev_t, int, int, struct lwp *); 119 struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 120 u_int8_t, u_int8_t, u_int8_t); 121 122 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 123 void pf_empty_pool(struct pf_palist *); 124 int pfioctl(dev_t, u_long, void *, int, struct lwp *); 125 #ifdef ALTQ 126 int pf_begin_altq(u_int32_t *); 127 int pf_rollback_altq(u_int32_t); 128 int pf_commit_altq(u_int32_t); 129 int pf_enable_altq(struct pf_altq *); 130 int pf_disable_altq(struct pf_altq *); 131 #endif /* ALTQ */ 132 int pf_begin_rules(u_int32_t *, int, const char *); 133 int pf_rollback_rules(u_int32_t, int, char *); 134 int pf_setup_pfsync_matching(struct pf_ruleset *); 135 void pf_hash_rule(MD5_CTX *, struct pf_rule *); 136 void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 137 int pf_commit_rules(u_int32_t, int, char *); 138 void pf_state_export(struct pfsync_state *, 139 struct pf_state_key *, struct pf_state *); 140 void pf_state_import(struct pfsync_state *, 141 struct pf_state_key *, struct pf_state *); 142 143 struct pf_rule pf_default_rule; 144 #ifdef __NetBSD__ 145 krwlock_t pf_consistency_lock; 146 #else 147 struct rwlock pf_consistency_lock = RWLOCK_INITIALIZER("pfcnslk"); 148 #endif /* __NetBSD__ */ 149 #ifdef ALTQ 150 static int pf_altq_running; 151 #endif 152 153 #define TAGID_MAX 50000 154 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 155 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 156 157 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 158 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 159 #endif 160 u_int16_t tagname2tag(struct pf_tags *, char *); 161 void tag2tagname(struct pf_tags *, u_int16_t, char *); 162 void tag_unref(struct pf_tags *, u_int16_t); 163 int pf_rtlabel_add(struct pf_addr_wrap *); 164 void pf_rtlabel_remove(struct pf_addr_wrap *); 165 void pf_rtlabel_copyout(struct pf_addr_wrap *); 166 167 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 168 169 #ifdef __NetBSD__ 170 const struct cdevsw pf_cdevsw = { 171 pfopen, pfclose, noread, nowrite, pfioctl, 172 nostop, notty, nopoll, nommap, nokqfilter, D_OTHER 173 }; 174 175 static int pfil4_wrapper(void *, struct mbuf **, struct ifnet *, int); 176 static int pfil6_wrapper(void *, struct mbuf **, struct ifnet *, int); 177 178 static int pf_pfil_attach(void); 179 static int pf_pfil_detach(void); 180 181 static int pf_pfil_attached; 182 #endif /* __NetBSD__ */ 183 184 void 185 pfattach(int num) 186 { 187 u_int32_t *timeout = pf_default_rule.timeout; 188 189 #ifdef __NetBSD__ 190 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 191 &pool_allocator_nointr, IPL_NONE); 192 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 193 "pfsrctrpl", NULL, IPL_SOFTNET); 194 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 195 NULL, IPL_SOFTNET); 196 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 197 "pfstatekeypl", NULL, IPL_SOFTNET); 198 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 199 &pool_allocator_nointr, IPL_NONE); 200 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 201 "pfpooladdrpl", &pool_allocator_nointr, IPL_NONE); 202 #else 203 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 204 &pool_allocator_nointr); 205 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 206 "pfsrctrpl", NULL); 207 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 208 NULL); 209 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 210 "pfstatekeypl", NULL); 211 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 212 &pool_allocator_nointr); 213 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 214 "pfpooladdrpl", &pool_allocator_nointr); 215 #endif /* !__NetBSD__ */ 216 217 pfr_initialize(); 218 pfi_initialize(); 219 pf_osfp_initialize(); 220 221 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 222 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 223 224 if (ctob(physmem) <= 100*1024*1024) 225 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit = 226 PFR_KENTRY_HIWAT_SMALL; 227 228 RB_INIT(&tree_src_tracking); 229 RB_INIT(&pf_anchors); 230 pf_init_ruleset(&pf_main_ruleset); 231 TAILQ_INIT(&pf_altqs[0]); 232 TAILQ_INIT(&pf_altqs[1]); 233 TAILQ_INIT(&pf_pabuf); 234 pf_altqs_active = &pf_altqs[0]; 235 pf_altqs_inactive = &pf_altqs[1]; 236 TAILQ_INIT(&state_list); 237 238 #ifdef __NetBSD__ 239 rw_init(&pf_consistency_lock); 240 #endif /* __NetBSD__ */ 241 242 /* default rule should never be garbage collected */ 243 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 244 pf_default_rule.action = PF_PASS; 245 pf_default_rule.nr = -1; 246 pf_default_rule.rtableid = -1; 247 248 /* initialize default timeouts */ 249 timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 250 timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 251 timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 252 timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 253 timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 254 timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 255 timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 256 timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 257 timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 258 timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 259 timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 260 timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 261 timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 262 timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 263 timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 264 timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 265 timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 266 timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 267 timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 268 timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 269 270 pf_normalize_init(); 271 bzero(&pf_status, sizeof(pf_status)); 272 pf_status.debug = PF_DEBUG_URGENT; 273 274 /* XXX do our best to avoid a conflict */ 275 pf_status.hostid = arc4random(); 276 277 /* require process context to purge states, so perform in a thread */ 278 #ifdef __NetBSD__ 279 if (kthread_create(PRI_NONE, 0, NULL, pf_purge_thread, NULL, NULL, 280 "pfpurge")) 281 panic("pfpurge thread"); 282 #else 283 kthread_create_deferred(pf_thread_create, NULL); 284 #endif /* !__NetBSD__ */ 285 } 286 287 #ifdef _LKM 288 void 289 pfdetach(void) 290 { 291 extern int pf_purge_thread_running; 292 extern int pf_purge_thread_stop; 293 struct pf_anchor *anchor; 294 struct pf_state *state; 295 struct pf_src_node *node; 296 struct pfioc_table pt; 297 u_int32_t ticket; 298 int i; 299 char r = '\0'; 300 301 pf_purge_thread_stop = 1; 302 wakeup(pf_purge_thread); 303 304 /* wait until the kthread exits */ 305 while (pf_purge_thread_running) 306 tsleep(&pf_purge_thread_running, PWAIT, "pfdown", 0); 307 308 (void)pf_pfil_detach(); 309 310 pf_status.running = 0; 311 312 /* clear the rulesets */ 313 for (i = 0; i < PF_RULESET_MAX; i++) 314 if (pf_begin_rules(&ticket, i, &r) == 0) 315 pf_commit_rules(ticket, i, &r); 316 #ifdef ALTQ 317 if (pf_begin_altq(&ticket) == 0) 318 pf_commit_altq(ticket); 319 #endif /* ALTQ */ 320 321 /* clear states */ 322 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 323 state->timeout = PFTM_PURGE; 324 #if NPFSYNC > 0 325 state->sync_flags = PFSTATE_NOSYNC; 326 #endif /* NPFSYNC > 0 */ 327 } 328 pf_purge_expired_states(1); 329 #if NPFSYNC > 0 330 pfsync_clear_states(pf_status.hostid, NULL); 331 #endif /* NPFSYNC > 0 */ 332 333 /* clear source nodes */ 334 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 335 state->src_node = NULL; 336 state->nat_src_node = NULL; 337 } 338 RB_FOREACH(node, pf_src_tree, &tree_src_tracking) { 339 node->expire = 1; 340 node->states = 0; 341 } 342 pf_purge_expired_src_nodes(0); 343 344 /* clear tables */ 345 memset(&pt, '\0', sizeof(pt)); 346 pfr_clr_tables(&pt.pfrio_table, &pt.pfrio_ndel, pt.pfrio_flags); 347 348 /* destroy anchors */ 349 while ((anchor = RB_MIN(pf_anchor_global, &pf_anchors)) != NULL) { 350 for (i = 0; i < PF_RULESET_MAX; i++) 351 if (pf_begin_rules(&ticket, i, anchor->name) == 0) 352 pf_commit_rules(ticket, i, anchor->name); 353 } 354 355 /* destroy main ruleset */ 356 pf_remove_if_empty_ruleset(&pf_main_ruleset); 357 358 /* destroy the pools */ 359 pool_destroy(&pf_pooladdr_pl); 360 pool_destroy(&pf_altq_pl); 361 pool_destroy(&pf_state_key_pl); 362 pool_destroy(&pf_state_pl); 363 pool_destroy(&pf_rule_pl); 364 pool_destroy(&pf_src_tree_pl); 365 366 rw_destroy(&pf_consistency_lock); 367 368 /* destroy subsystems */ 369 pf_normalize_destroy(); 370 pf_osfp_destroy(); 371 pfr_destroy(); 372 pfi_destroy(); 373 } 374 #endif /* _LKM */ 375 376 #ifndef __NetBSD__ 377 void 378 pf_thread_create(void *v) 379 { 380 if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge")) 381 panic("pfpurge thread"); 382 } 383 #endif /* !__NetBSD__ */ 384 385 int 386 pfopen(dev_t dev, int flags, int fmt, struct lwp *l) 387 { 388 if (minor(dev) >= 1) 389 return (ENXIO); 390 return (0); 391 } 392 393 int 394 pfclose(dev_t dev, int flags, int fmt, struct lwp *l) 395 { 396 if (minor(dev) >= 1) 397 return (ENXIO); 398 return (0); 399 } 400 401 struct pf_pool * 402 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 403 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 404 u_int8_t check_ticket) 405 { 406 struct pf_ruleset *ruleset; 407 struct pf_rule *rule; 408 int rs_num; 409 410 ruleset = pf_find_ruleset(anchor); 411 if (ruleset == NULL) 412 return (NULL); 413 rs_num = pf_get_ruleset_number(rule_action); 414 if (rs_num >= PF_RULESET_MAX) 415 return (NULL); 416 if (active) { 417 if (check_ticket && ticket != 418 ruleset->rules[rs_num].active.ticket) 419 return (NULL); 420 if (r_last) 421 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 422 pf_rulequeue); 423 else 424 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 425 } else { 426 if (check_ticket && ticket != 427 ruleset->rules[rs_num].inactive.ticket) 428 return (NULL); 429 if (r_last) 430 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 431 pf_rulequeue); 432 else 433 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 434 } 435 if (!r_last) { 436 while ((rule != NULL) && (rule->nr != rule_number)) 437 rule = TAILQ_NEXT(rule, entries); 438 } 439 if (rule == NULL) 440 return (NULL); 441 442 return (&rule->rpool); 443 } 444 445 void 446 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 447 { 448 struct pf_pooladdr *mv_pool_pa; 449 450 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 451 TAILQ_REMOVE(poola, mv_pool_pa, entries); 452 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 453 } 454 } 455 456 void 457 pf_empty_pool(struct pf_palist *poola) 458 { 459 struct pf_pooladdr *empty_pool_pa; 460 461 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 462 pfi_dynaddr_remove(&empty_pool_pa->addr); 463 pf_tbladdr_remove(&empty_pool_pa->addr); 464 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE); 465 TAILQ_REMOVE(poola, empty_pool_pa, entries); 466 pool_put(&pf_pooladdr_pl, empty_pool_pa); 467 } 468 } 469 470 void 471 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 472 { 473 if (rulequeue != NULL) { 474 if (rule->states <= 0) { 475 /* 476 * XXX - we need to remove the table *before* detaching 477 * the rule to make sure the table code does not delete 478 * the anchor under our feet. 479 */ 480 pf_tbladdr_remove(&rule->src.addr); 481 pf_tbladdr_remove(&rule->dst.addr); 482 if (rule->overload_tbl) 483 pfr_detach_table(rule->overload_tbl); 484 } 485 TAILQ_REMOVE(rulequeue, rule, entries); 486 rule->entries.tqe_prev = NULL; 487 rule->nr = -1; 488 } 489 490 if (rule->states > 0 || rule->src_nodes > 0 || 491 rule->entries.tqe_prev != NULL) 492 return; 493 pf_tag_unref(rule->tag); 494 pf_tag_unref(rule->match_tag); 495 #ifdef ALTQ 496 if (rule->pqid != rule->qid) 497 pf_qid_unref(rule->pqid); 498 pf_qid_unref(rule->qid); 499 #endif 500 pf_rtlabel_remove(&rule->src.addr); 501 pf_rtlabel_remove(&rule->dst.addr); 502 pfi_dynaddr_remove(&rule->src.addr); 503 pfi_dynaddr_remove(&rule->dst.addr); 504 if (rulequeue == NULL) { 505 pf_tbladdr_remove(&rule->src.addr); 506 pf_tbladdr_remove(&rule->dst.addr); 507 if (rule->overload_tbl) 508 pfr_detach_table(rule->overload_tbl); 509 } 510 pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE); 511 pf_anchor_remove(rule); 512 pf_empty_pool(&rule->rpool.list); 513 pool_put(&pf_rule_pl, rule); 514 } 515 516 u_int16_t 517 tagname2tag(struct pf_tags *head, char *tagname) 518 { 519 struct pf_tagname *tag, *p = NULL; 520 u_int16_t new_tagid = 1; 521 522 TAILQ_FOREACH(tag, head, entries) 523 if (strcmp(tagname, tag->name) == 0) { 524 tag->ref++; 525 return (tag->tag); 526 } 527 528 /* 529 * to avoid fragmentation, we do a linear search from the beginning 530 * and take the first free slot we find. if there is none or the list 531 * is empty, append a new entry at the end. 532 */ 533 534 /* new entry */ 535 if (!TAILQ_EMPTY(head)) 536 for (p = TAILQ_FIRST(head); p != NULL && 537 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 538 new_tagid = p->tag + 1; 539 540 if (new_tagid > TAGID_MAX) 541 return (0); 542 543 /* allocate and fill new struct pf_tagname */ 544 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 545 M_TEMP, M_NOWAIT); 546 if (tag == NULL) 547 return (0); 548 bzero(tag, sizeof(struct pf_tagname)); 549 strlcpy(tag->name, tagname, sizeof(tag->name)); 550 tag->tag = new_tagid; 551 tag->ref++; 552 553 if (p != NULL) /* insert new entry before p */ 554 TAILQ_INSERT_BEFORE(p, tag, entries); 555 else /* either list empty or no free slot in between */ 556 TAILQ_INSERT_TAIL(head, tag, entries); 557 558 return (tag->tag); 559 } 560 561 void 562 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 563 { 564 struct pf_tagname *tag; 565 566 TAILQ_FOREACH(tag, head, entries) 567 if (tag->tag == tagid) { 568 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 569 return; 570 } 571 } 572 573 void 574 tag_unref(struct pf_tags *head, u_int16_t tag) 575 { 576 struct pf_tagname *p, *next; 577 578 if (tag == 0) 579 return; 580 581 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 582 next = TAILQ_NEXT(p, entries); 583 if (tag == p->tag) { 584 if (--p->ref == 0) { 585 TAILQ_REMOVE(head, p, entries); 586 free(p, M_TEMP); 587 } 588 break; 589 } 590 } 591 } 592 593 u_int16_t 594 pf_tagname2tag(char *tagname) 595 { 596 return (tagname2tag(&pf_tags, tagname)); 597 } 598 599 void 600 pf_tag2tagname(u_int16_t tagid, char *p) 601 { 602 tag2tagname(&pf_tags, tagid, p); 603 } 604 605 void 606 pf_tag_ref(u_int16_t tag) 607 { 608 struct pf_tagname *t; 609 610 TAILQ_FOREACH(t, &pf_tags, entries) 611 if (t->tag == tag) 612 break; 613 if (t != NULL) 614 t->ref++; 615 } 616 617 void 618 pf_tag_unref(u_int16_t tag) 619 { 620 tag_unref(&pf_tags, tag); 621 } 622 623 int 624 pf_rtlabel_add(struct pf_addr_wrap *a) 625 { 626 #ifndef __NetBSD__ 627 if (a->type == PF_ADDR_RTLABEL && 628 (a->v.rtlabel = rtlabel_name2id(a->v.rtlabelname)) == 0) 629 return (-1); 630 #endif /* !__NetBSD__ */ 631 return (0); 632 } 633 634 void 635 pf_rtlabel_remove(struct pf_addr_wrap *a) 636 { 637 #ifndef __NetBSD__ 638 if (a->type == PF_ADDR_RTLABEL) 639 rtlabel_unref(a->v.rtlabel); 640 #endif /* !__NetBSD__ */ 641 } 642 643 void 644 pf_rtlabel_copyout(struct pf_addr_wrap *a) 645 { 646 #ifndef __NetBSD__ 647 const char *name; 648 649 if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel) { 650 if ((name = rtlabel_id2name(a->v.rtlabel)) == NULL) 651 strlcpy(a->v.rtlabelname, "?", 652 sizeof(a->v.rtlabelname)); 653 else 654 strlcpy(a->v.rtlabelname, name, 655 sizeof(a->v.rtlabelname)); 656 } 657 #endif /* !__NetBSD__ */ 658 } 659 660 #ifdef ALTQ 661 u_int32_t 662 pf_qname2qid(char *qname) 663 { 664 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 665 } 666 667 void 668 pf_qid2qname(u_int32_t qid, char *p) 669 { 670 tag2tagname(&pf_qids, (u_int16_t)qid, p); 671 } 672 673 void 674 pf_qid_unref(u_int32_t qid) 675 { 676 tag_unref(&pf_qids, (u_int16_t)qid); 677 } 678 679 int 680 pf_begin_altq(u_int32_t *ticket) 681 { 682 struct pf_altq *altq; 683 int error = 0; 684 685 /* Purge the old altq list */ 686 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 687 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 688 if (altq->qname[0] == 0) { 689 /* detach and destroy the discipline */ 690 error = altq_remove(altq); 691 } else 692 pf_qid_unref(altq->qid); 693 pool_put(&pf_altq_pl, altq); 694 } 695 if (error) 696 return (error); 697 *ticket = ++ticket_altqs_inactive; 698 altqs_inactive_open = 1; 699 return (0); 700 } 701 702 int 703 pf_rollback_altq(u_int32_t ticket) 704 { 705 struct pf_altq *altq; 706 int error = 0; 707 708 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 709 return (0); 710 /* Purge the old altq list */ 711 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 712 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 713 if (altq->qname[0] == 0) { 714 /* detach and destroy the discipline */ 715 error = altq_remove(altq); 716 } else 717 pf_qid_unref(altq->qid); 718 pool_put(&pf_altq_pl, altq); 719 } 720 altqs_inactive_open = 0; 721 return (error); 722 } 723 724 int 725 pf_commit_altq(u_int32_t ticket) 726 { 727 struct pf_altqqueue *old_altqs; 728 struct pf_altq *altq; 729 int s, err, error = 0; 730 731 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 732 return (EBUSY); 733 734 /* swap altqs, keep the old. */ 735 s = splsoftnet(); 736 old_altqs = pf_altqs_active; 737 pf_altqs_active = pf_altqs_inactive; 738 pf_altqs_inactive = old_altqs; 739 ticket_altqs_active = ticket_altqs_inactive; 740 741 /* Attach new disciplines */ 742 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 743 if (altq->qname[0] == 0) { 744 /* attach the discipline */ 745 error = altq_pfattach(altq); 746 if (error == 0 && pf_altq_running) 747 error = pf_enable_altq(altq); 748 if (error != 0) { 749 splx(s); 750 return (error); 751 } 752 } 753 } 754 755 /* Purge the old altq list */ 756 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 757 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 758 if (altq->qname[0] == 0) { 759 /* detach and destroy the discipline */ 760 if (pf_altq_running) 761 error = pf_disable_altq(altq); 762 err = altq_pfdetach(altq); 763 if (err != 0 && error == 0) 764 error = err; 765 err = altq_remove(altq); 766 if (err != 0 && error == 0) 767 error = err; 768 } else 769 pf_qid_unref(altq->qid); 770 pool_put(&pf_altq_pl, altq); 771 } 772 splx(s); 773 774 altqs_inactive_open = 0; 775 return (error); 776 } 777 778 int 779 pf_enable_altq(struct pf_altq *altq) 780 { 781 struct ifnet *ifp; 782 struct tb_profile tb; 783 int s, error = 0; 784 785 if ((ifp = ifunit(altq->ifname)) == NULL) 786 return (EINVAL); 787 788 if (ifp->if_snd.altq_type != ALTQT_NONE) 789 error = altq_enable(&ifp->if_snd); 790 791 /* set tokenbucket regulator */ 792 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 793 tb.rate = altq->ifbandwidth; 794 tb.depth = altq->tbrsize; 795 s = splnet(); 796 error = tbr_set(&ifp->if_snd, &tb); 797 splx(s); 798 } 799 800 return (error); 801 } 802 803 int 804 pf_disable_altq(struct pf_altq *altq) 805 { 806 struct ifnet *ifp; 807 struct tb_profile tb; 808 int s, error; 809 810 if ((ifp = ifunit(altq->ifname)) == NULL) 811 return (EINVAL); 812 813 /* 814 * when the discipline is no longer referenced, it was overridden 815 * by a new one. if so, just return. 816 */ 817 if (altq->altq_disc != ifp->if_snd.altq_disc) 818 return (0); 819 820 error = altq_disable(&ifp->if_snd); 821 822 if (error == 0) { 823 /* clear tokenbucket regulator */ 824 tb.rate = 0; 825 s = splnet(); 826 error = tbr_set(&ifp->if_snd, &tb); 827 splx(s); 828 } 829 830 return (error); 831 } 832 #endif /* ALTQ */ 833 834 int 835 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 836 { 837 struct pf_ruleset *rs; 838 struct pf_rule *rule; 839 840 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 841 return (EINVAL); 842 rs = pf_find_or_create_ruleset(anchor); 843 if (rs == NULL) 844 return (EINVAL); 845 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 846 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 847 rs->rules[rs_num].inactive.rcount--; 848 } 849 *ticket = ++rs->rules[rs_num].inactive.ticket; 850 rs->rules[rs_num].inactive.open = 1; 851 return (0); 852 } 853 854 int 855 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 856 { 857 struct pf_ruleset *rs; 858 struct pf_rule *rule; 859 860 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 861 return (EINVAL); 862 rs = pf_find_ruleset(anchor); 863 if (rs == NULL || !rs->rules[rs_num].inactive.open || 864 rs->rules[rs_num].inactive.ticket != ticket) 865 return (0); 866 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 867 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 868 rs->rules[rs_num].inactive.rcount--; 869 } 870 rs->rules[rs_num].inactive.open = 0; 871 return (0); 872 } 873 874 #define PF_MD5_UPD(st, elm) \ 875 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 876 877 #define PF_MD5_UPD_STR(st, elm) \ 878 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 879 880 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 881 (stor) = htonl((st)->elm); \ 882 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 883 } while (0) 884 885 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 886 (stor) = htons((st)->elm); \ 887 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 888 } while (0) 889 890 void 891 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 892 { 893 PF_MD5_UPD(pfr, addr.type); 894 switch (pfr->addr.type) { 895 case PF_ADDR_DYNIFTL: 896 PF_MD5_UPD(pfr, addr.v.ifname); 897 PF_MD5_UPD(pfr, addr.iflags); 898 break; 899 case PF_ADDR_TABLE: 900 PF_MD5_UPD(pfr, addr.v.tblname); 901 break; 902 case PF_ADDR_ADDRMASK: 903 /* XXX ignore af? */ 904 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 905 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 906 break; 907 case PF_ADDR_RTLABEL: 908 PF_MD5_UPD(pfr, addr.v.rtlabelname); 909 break; 910 } 911 912 PF_MD5_UPD(pfr, port[0]); 913 PF_MD5_UPD(pfr, port[1]); 914 PF_MD5_UPD(pfr, neg); 915 PF_MD5_UPD(pfr, port_op); 916 } 917 918 void 919 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule) 920 { 921 u_int16_t x; 922 u_int32_t y; 923 924 pf_hash_rule_addr(ctx, &rule->src); 925 pf_hash_rule_addr(ctx, &rule->dst); 926 PF_MD5_UPD_STR(rule, label); 927 PF_MD5_UPD_STR(rule, ifname); 928 PF_MD5_UPD_STR(rule, match_tagname); 929 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 930 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 931 PF_MD5_UPD_HTONL(rule, prob, y); 932 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 933 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 934 PF_MD5_UPD(rule, uid.op); 935 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 936 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 937 PF_MD5_UPD(rule, gid.op); 938 PF_MD5_UPD_HTONL(rule, rule_flag, y); 939 PF_MD5_UPD(rule, action); 940 PF_MD5_UPD(rule, direction); 941 PF_MD5_UPD(rule, af); 942 PF_MD5_UPD(rule, quick); 943 PF_MD5_UPD(rule, ifnot); 944 PF_MD5_UPD(rule, match_tag_not); 945 PF_MD5_UPD(rule, natpass); 946 PF_MD5_UPD(rule, keep_state); 947 PF_MD5_UPD(rule, proto); 948 PF_MD5_UPD(rule, type); 949 PF_MD5_UPD(rule, code); 950 PF_MD5_UPD(rule, flags); 951 PF_MD5_UPD(rule, flagset); 952 PF_MD5_UPD(rule, allow_opts); 953 PF_MD5_UPD(rule, rt); 954 PF_MD5_UPD(rule, tos); 955 } 956 957 int 958 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 959 { 960 struct pf_ruleset *rs; 961 struct pf_rule *rule, **old_array; 962 struct pf_rulequeue *old_rules; 963 int s, error; 964 u_int32_t old_rcount; 965 966 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 967 return (EINVAL); 968 rs = pf_find_ruleset(anchor); 969 if (rs == NULL || !rs->rules[rs_num].inactive.open || 970 ticket != rs->rules[rs_num].inactive.ticket) 971 return (EBUSY); 972 973 /* Calculate checksum for the main ruleset */ 974 if (rs == &pf_main_ruleset) { 975 error = pf_setup_pfsync_matching(rs); 976 if (error != 0) 977 return (error); 978 } 979 980 /* Swap rules, keep the old. */ 981 s = splsoftnet(); 982 old_rules = rs->rules[rs_num].active.ptr; 983 old_rcount = rs->rules[rs_num].active.rcount; 984 old_array = rs->rules[rs_num].active.ptr_array; 985 986 rs->rules[rs_num].active.ptr = 987 rs->rules[rs_num].inactive.ptr; 988 rs->rules[rs_num].active.ptr_array = 989 rs->rules[rs_num].inactive.ptr_array; 990 rs->rules[rs_num].active.rcount = 991 rs->rules[rs_num].inactive.rcount; 992 rs->rules[rs_num].inactive.ptr = old_rules; 993 rs->rules[rs_num].inactive.ptr_array = old_array; 994 rs->rules[rs_num].inactive.rcount = old_rcount; 995 996 rs->rules[rs_num].active.ticket = 997 rs->rules[rs_num].inactive.ticket; 998 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 999 1000 1001 /* Purge the old rule list. */ 1002 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 1003 pf_rm_rule(old_rules, rule); 1004 if (rs->rules[rs_num].inactive.ptr_array) 1005 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 1006 rs->rules[rs_num].inactive.ptr_array = NULL; 1007 rs->rules[rs_num].inactive.rcount = 0; 1008 rs->rules[rs_num].inactive.open = 0; 1009 pf_remove_if_empty_ruleset(rs); 1010 splx(s); 1011 return (0); 1012 } 1013 1014 void 1015 pf_state_export(struct pfsync_state *sp, struct pf_state_key *sk, 1016 struct pf_state *s) 1017 { 1018 int secs = time_second; 1019 bzero(sp, sizeof(struct pfsync_state)); 1020 1021 /* copy from state key */ 1022 sp->lan.addr = sk->lan.addr; 1023 sp->lan.port = sk->lan.port; 1024 sp->gwy.addr = sk->gwy.addr; 1025 sp->gwy.port = sk->gwy.port; 1026 sp->ext.addr = sk->ext.addr; 1027 sp->ext.port = sk->ext.port; 1028 sp->proto = sk->proto; 1029 sp->af = sk->af; 1030 sp->direction = sk->direction; 1031 1032 /* copy from state */ 1033 memcpy(&sp->id, &s->id, sizeof(sp->id)); 1034 sp->creatorid = s->creatorid; 1035 strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname)); 1036 pf_state_peer_to_pfsync(&s->src, &sp->src); 1037 pf_state_peer_to_pfsync(&s->dst, &sp->dst); 1038 1039 sp->rule = s->rule.ptr->nr; 1040 sp->nat_rule = (s->nat_rule.ptr == NULL) ? -1 : s->nat_rule.ptr->nr; 1041 sp->anchor = (s->anchor.ptr == NULL) ? -1 : s->anchor.ptr->nr; 1042 1043 pf_state_counter_to_pfsync(s->bytes[0], sp->bytes[0]); 1044 pf_state_counter_to_pfsync(s->bytes[1], sp->bytes[1]); 1045 pf_state_counter_to_pfsync(s->packets[0], sp->packets[0]); 1046 pf_state_counter_to_pfsync(s->packets[1], sp->packets[1]); 1047 sp->creation = secs - s->creation; 1048 sp->expire = pf_state_expires(s); 1049 sp->log = s->log; 1050 sp->allow_opts = s->allow_opts; 1051 sp->timeout = s->timeout; 1052 1053 if (s->src_node) 1054 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 1055 if (s->nat_src_node) 1056 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 1057 1058 if (sp->expire > secs) 1059 sp->expire -= secs; 1060 else 1061 sp->expire = 0; 1062 1063 } 1064 1065 void 1066 pf_state_import(struct pfsync_state *sp, struct pf_state_key *sk, 1067 struct pf_state *s) 1068 { 1069 /* copy to state key */ 1070 sk->lan.addr = sp->lan.addr; 1071 sk->lan.port = sp->lan.port; 1072 sk->gwy.addr = sp->gwy.addr; 1073 sk->gwy.port = sp->gwy.port; 1074 sk->ext.addr = sp->ext.addr; 1075 sk->ext.port = sp->ext.port; 1076 sk->proto = sp->proto; 1077 sk->af = sp->af; 1078 sk->direction = sp->direction; 1079 1080 /* copy to state */ 1081 memcpy(&s->id, &sp->id, sizeof(sp->id)); 1082 s->creatorid = sp->creatorid; 1083 strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname)); 1084 pf_state_peer_from_pfsync(&sp->src, &s->src); 1085 pf_state_peer_from_pfsync(&sp->dst, &s->dst); 1086 1087 s->rule.ptr = &pf_default_rule; 1088 s->nat_rule.ptr = NULL; 1089 s->anchor.ptr = NULL; 1090 s->rt_kif = NULL; 1091 s->creation = time_second; 1092 s->pfsync_time = 0; 1093 s->packets[0] = s->packets[1] = 0; 1094 s->bytes[0] = s->bytes[1] = 0; 1095 } 1096 1097 int 1098 pf_setup_pfsync_matching(struct pf_ruleset *rs) 1099 { 1100 MD5_CTX ctx; 1101 struct pf_rule *rule; 1102 int rs_cnt; 1103 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 1104 1105 MD5Init(&ctx); 1106 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 1107 /* XXX PF_RULESET_SCRUB as well? */ 1108 if (rs_cnt == PF_RULESET_SCRUB) 1109 continue; 1110 1111 if (rs->rules[rs_cnt].inactive.ptr_array) 1112 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 1113 rs->rules[rs_cnt].inactive.ptr_array = NULL; 1114 1115 if (rs->rules[rs_cnt].inactive.rcount) { 1116 rs->rules[rs_cnt].inactive.ptr_array = 1117 malloc(sizeof(void *) * 1118 rs->rules[rs_cnt].inactive.rcount, 1119 M_TEMP, M_NOWAIT); 1120 1121 if (!rs->rules[rs_cnt].inactive.ptr_array) 1122 return (ENOMEM); 1123 } 1124 1125 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 1126 entries) { 1127 pf_hash_rule(&ctx, rule); 1128 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 1129 } 1130 } 1131 1132 MD5Final(digest, &ctx); 1133 memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum)); 1134 return (0); 1135 } 1136 1137 int 1138 pfioctl(dev_t dev, u_long cmd, void *addr, int flags, struct lwp *l) 1139 { 1140 struct pf_pooladdr *pa = NULL; 1141 struct pf_pool *pool = NULL; 1142 int s; 1143 int error = 0; 1144 1145 /* XXX keep in sync with switch() below */ 1146 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 1147 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) 1148 switch (cmd) { 1149 case DIOCGETRULES: 1150 case DIOCGETRULE: 1151 case DIOCGETADDRS: 1152 case DIOCGETADDR: 1153 case DIOCGETSTATE: 1154 case DIOCSETSTATUSIF: 1155 case DIOCGETSTATUS: 1156 case DIOCCLRSTATUS: 1157 case DIOCNATLOOK: 1158 case DIOCSETDEBUG: 1159 case DIOCGETSTATES: 1160 case DIOCGETTIMEOUT: 1161 case DIOCCLRRULECTRS: 1162 case DIOCGETLIMIT: 1163 case DIOCGETALTQS: 1164 case DIOCGETALTQ: 1165 case DIOCGETQSTATS: 1166 case DIOCGETRULESETS: 1167 case DIOCGETRULESET: 1168 case DIOCRGETTABLES: 1169 case DIOCRGETTSTATS: 1170 case DIOCRCLRTSTATS: 1171 case DIOCRCLRADDRS: 1172 case DIOCRADDADDRS: 1173 case DIOCRDELADDRS: 1174 case DIOCRSETADDRS: 1175 case DIOCRGETADDRS: 1176 case DIOCRGETASTATS: 1177 case DIOCRCLRASTATS: 1178 case DIOCRTSTADDRS: 1179 case DIOCOSFPGET: 1180 case DIOCGETSRCNODES: 1181 case DIOCCLRSRCNODES: 1182 case DIOCIGETIFACES: 1183 case DIOCSETIFFLAG: 1184 case DIOCCLRIFFLAG: 1185 break; 1186 case DIOCRCLRTABLES: 1187 case DIOCRADDTABLES: 1188 case DIOCRDELTABLES: 1189 case DIOCRSETTFLAGS: 1190 if (((struct pfioc_table *)addr)->pfrio_flags & 1191 PFR_FLAG_DUMMY) 1192 break; /* dummy operation ok */ 1193 return (EPERM); 1194 default: 1195 return (EPERM); 1196 } 1197 1198 if (!(flags & FWRITE)) 1199 switch (cmd) { 1200 case DIOCGETRULES: 1201 case DIOCGETADDRS: 1202 case DIOCGETADDR: 1203 case DIOCGETSTATE: 1204 case DIOCGETSTATUS: 1205 case DIOCGETSTATES: 1206 case DIOCGETTIMEOUT: 1207 case DIOCGETLIMIT: 1208 case DIOCGETALTQS: 1209 case DIOCGETALTQ: 1210 case DIOCGETQSTATS: 1211 case DIOCGETRULESETS: 1212 case DIOCGETRULESET: 1213 case DIOCNATLOOK: 1214 case DIOCRGETTABLES: 1215 case DIOCRGETTSTATS: 1216 case DIOCRGETADDRS: 1217 case DIOCRGETASTATS: 1218 case DIOCRTSTADDRS: 1219 case DIOCOSFPGET: 1220 case DIOCGETSRCNODES: 1221 case DIOCIGETIFACES: 1222 break; 1223 case DIOCRCLRTABLES: 1224 case DIOCRADDTABLES: 1225 case DIOCRDELTABLES: 1226 case DIOCRCLRTSTATS: 1227 case DIOCRCLRADDRS: 1228 case DIOCRADDADDRS: 1229 case DIOCRDELADDRS: 1230 case DIOCRSETADDRS: 1231 case DIOCRSETTFLAGS: 1232 if (((struct pfioc_table *)addr)->pfrio_flags & 1233 PFR_FLAG_DUMMY) { 1234 flags |= FWRITE; /* need write lock for dummy */ 1235 break; /* dummy operation ok */ 1236 } 1237 return (EACCES); 1238 case DIOCGETRULE: 1239 if (((struct pfioc_rule *)addr)->action == PF_GET_CLR_CNTR) 1240 return (EACCES); 1241 break; 1242 default: 1243 return (EACCES); 1244 } 1245 1246 if (flags & FWRITE) 1247 rw_enter_write(&pf_consistency_lock); 1248 else 1249 rw_enter_read(&pf_consistency_lock); 1250 1251 s = splsoftnet(); 1252 switch (cmd) { 1253 1254 case DIOCSTART: 1255 if (pf_status.running) 1256 error = EEXIST; 1257 else { 1258 #ifdef __NetBSD__ 1259 error = pf_pfil_attach(); 1260 if (error) 1261 break; 1262 #endif /* __NetBSD__ */ 1263 pf_status.running = 1; 1264 pf_status.since = time_second; 1265 if (pf_status.stateid == 0) { 1266 pf_status.stateid = time_second; 1267 pf_status.stateid = pf_status.stateid << 32; 1268 } 1269 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1270 } 1271 break; 1272 1273 case DIOCSTOP: 1274 if (!pf_status.running) 1275 error = ENOENT; 1276 else { 1277 #ifdef __NetBSD__ 1278 error = pf_pfil_detach(); 1279 if (error) 1280 break; 1281 #endif /* __NetBSD__ */ 1282 pf_status.running = 0; 1283 pf_status.since = time_second; 1284 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1285 } 1286 break; 1287 1288 case DIOCADDRULE: { 1289 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1290 struct pf_ruleset *ruleset; 1291 struct pf_rule *rule, *tail; 1292 struct pf_pooladdr *pa; 1293 int rs_num; 1294 1295 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1296 ruleset = pf_find_ruleset(pr->anchor); 1297 if (ruleset == NULL) { 1298 error = EINVAL; 1299 break; 1300 } 1301 rs_num = pf_get_ruleset_number(pr->rule.action); 1302 if (rs_num >= PF_RULESET_MAX) { 1303 error = EINVAL; 1304 break; 1305 } 1306 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1307 error = EINVAL; 1308 break; 1309 } 1310 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1311 error = EBUSY; 1312 break; 1313 } 1314 if (pr->pool_ticket != ticket_pabuf) { 1315 error = EBUSY; 1316 break; 1317 } 1318 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1319 if (rule == NULL) { 1320 error = ENOMEM; 1321 break; 1322 } 1323 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1324 #ifdef __NetBSD__ 1325 rule->cuid = kauth_cred_getuid(l->l_cred); 1326 rule->cpid = l->l_proc->p_pid; 1327 #else 1328 rule->cuid = p->p_cred->p_ruid; 1329 rule->cpid = p->p_pid; 1330 #endif /* !__NetBSD__ */ 1331 rule->anchor = NULL; 1332 rule->kif = NULL; 1333 TAILQ_INIT(&rule->rpool.list); 1334 /* initialize refcounting */ 1335 rule->states = 0; 1336 rule->src_nodes = 0; 1337 rule->entries.tqe_prev = NULL; 1338 #ifndef INET 1339 if (rule->af == AF_INET) { 1340 pool_put(&pf_rule_pl, rule); 1341 error = EAFNOSUPPORT; 1342 break; 1343 } 1344 #endif /* INET */ 1345 #ifndef INET6 1346 if (rule->af == AF_INET6) { 1347 pool_put(&pf_rule_pl, rule); 1348 error = EAFNOSUPPORT; 1349 break; 1350 } 1351 #endif /* INET6 */ 1352 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1353 pf_rulequeue); 1354 if (tail) 1355 rule->nr = tail->nr + 1; 1356 else 1357 rule->nr = 0; 1358 if (rule->ifname[0]) { 1359 rule->kif = pfi_kif_get(rule->ifname); 1360 if (rule->kif == NULL) { 1361 pool_put(&pf_rule_pl, rule); 1362 error = EINVAL; 1363 break; 1364 } 1365 pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE); 1366 } 1367 1368 #ifndef __NetBSD__ 1369 if (rule->rtableid > 0 && !rtable_exists(rule->rtableid)) 1370 error = EBUSY; 1371 #endif /* !__NetBSD__ */ 1372 1373 #ifdef ALTQ 1374 /* set queue IDs */ 1375 if (rule->qname[0] != 0) { 1376 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1377 error = EBUSY; 1378 else if (rule->pqname[0] != 0) { 1379 if ((rule->pqid = 1380 pf_qname2qid(rule->pqname)) == 0) 1381 error = EBUSY; 1382 } else 1383 rule->pqid = rule->qid; 1384 } 1385 #endif 1386 if (rule->tagname[0]) 1387 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1388 error = EBUSY; 1389 if (rule->match_tagname[0]) 1390 if ((rule->match_tag = 1391 pf_tagname2tag(rule->match_tagname)) == 0) 1392 error = EBUSY; 1393 if (rule->rt && !rule->direction) 1394 error = EINVAL; 1395 #if NPFLOG > 0 1396 if (!rule->log) 1397 rule->logif = 0; 1398 if (rule->logif >= PFLOGIFS_MAX) 1399 error = EINVAL; 1400 #endif 1401 if (pf_rtlabel_add(&rule->src.addr) || 1402 pf_rtlabel_add(&rule->dst.addr)) 1403 error = EBUSY; 1404 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1405 error = EINVAL; 1406 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1407 error = EINVAL; 1408 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1409 error = EINVAL; 1410 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1411 error = EINVAL; 1412 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1413 error = EINVAL; 1414 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1415 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1416 error = EINVAL; 1417 1418 if (rule->overload_tblname[0]) { 1419 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1420 rule->overload_tblname)) == NULL) 1421 error = EINVAL; 1422 else 1423 rule->overload_tbl->pfrkt_flags |= 1424 PFR_TFLAG_ACTIVE; 1425 } 1426 1427 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1428 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1429 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1430 (rule->rt > PF_FASTROUTE)) && 1431 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1432 error = EINVAL; 1433 1434 if (error) { 1435 pf_rm_rule(NULL, rule); 1436 break; 1437 } 1438 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1439 rule->evaluations = rule->packets[0] = rule->packets[1] = 1440 rule->bytes[0] = rule->bytes[1] = 0; 1441 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1442 rule, entries); 1443 ruleset->rules[rs_num].inactive.rcount++; 1444 break; 1445 } 1446 1447 case DIOCGETRULES: { 1448 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1449 struct pf_ruleset *ruleset; 1450 struct pf_rule *tail; 1451 int rs_num; 1452 1453 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1454 ruleset = pf_find_ruleset(pr->anchor); 1455 if (ruleset == NULL) { 1456 error = EINVAL; 1457 break; 1458 } 1459 rs_num = pf_get_ruleset_number(pr->rule.action); 1460 if (rs_num >= PF_RULESET_MAX) { 1461 error = EINVAL; 1462 break; 1463 } 1464 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1465 pf_rulequeue); 1466 if (tail) 1467 pr->nr = tail->nr + 1; 1468 else 1469 pr->nr = 0; 1470 pr->ticket = ruleset->rules[rs_num].active.ticket; 1471 break; 1472 } 1473 1474 case DIOCGETRULE: { 1475 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1476 struct pf_ruleset *ruleset; 1477 struct pf_rule *rule; 1478 int rs_num, i; 1479 1480 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1481 ruleset = pf_find_ruleset(pr->anchor); 1482 if (ruleset == NULL) { 1483 error = EINVAL; 1484 break; 1485 } 1486 rs_num = pf_get_ruleset_number(pr->rule.action); 1487 if (rs_num >= PF_RULESET_MAX) { 1488 error = EINVAL; 1489 break; 1490 } 1491 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1492 error = EBUSY; 1493 break; 1494 } 1495 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1496 while ((rule != NULL) && (rule->nr != pr->nr)) 1497 rule = TAILQ_NEXT(rule, entries); 1498 if (rule == NULL) { 1499 error = EBUSY; 1500 break; 1501 } 1502 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1503 if (pf_anchor_copyout(ruleset, rule, pr)) { 1504 error = EBUSY; 1505 break; 1506 } 1507 pfi_dynaddr_copyout(&pr->rule.src.addr); 1508 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1509 pf_tbladdr_copyout(&pr->rule.src.addr); 1510 pf_tbladdr_copyout(&pr->rule.dst.addr); 1511 pf_rtlabel_copyout(&pr->rule.src.addr); 1512 pf_rtlabel_copyout(&pr->rule.dst.addr); 1513 for (i = 0; i < PF_SKIP_COUNT; ++i) 1514 if (rule->skip[i].ptr == NULL) 1515 pr->rule.skip[i].nr = -1; 1516 else 1517 pr->rule.skip[i].nr = 1518 rule->skip[i].ptr->nr; 1519 1520 if (pr->action == PF_GET_CLR_CNTR) { 1521 rule->evaluations = 0; 1522 rule->packets[0] = rule->packets[1] = 0; 1523 rule->bytes[0] = rule->bytes[1] = 0; 1524 } 1525 break; 1526 } 1527 1528 case DIOCCHANGERULE: { 1529 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1530 struct pf_ruleset *ruleset; 1531 struct pf_rule *oldrule = NULL, *newrule = NULL; 1532 u_int32_t nr = 0; 1533 int rs_num; 1534 1535 if (!(pcr->action == PF_CHANGE_REMOVE || 1536 pcr->action == PF_CHANGE_GET_TICKET) && 1537 pcr->pool_ticket != ticket_pabuf) { 1538 error = EBUSY; 1539 break; 1540 } 1541 1542 if (pcr->action < PF_CHANGE_ADD_HEAD || 1543 pcr->action > PF_CHANGE_GET_TICKET) { 1544 error = EINVAL; 1545 break; 1546 } 1547 ruleset = pf_find_ruleset(pcr->anchor); 1548 if (ruleset == NULL) { 1549 error = EINVAL; 1550 break; 1551 } 1552 rs_num = pf_get_ruleset_number(pcr->rule.action); 1553 if (rs_num >= PF_RULESET_MAX) { 1554 error = EINVAL; 1555 break; 1556 } 1557 1558 if (pcr->action == PF_CHANGE_GET_TICKET) { 1559 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1560 break; 1561 } else { 1562 if (pcr->ticket != 1563 ruleset->rules[rs_num].active.ticket) { 1564 error = EINVAL; 1565 break; 1566 } 1567 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1568 error = EINVAL; 1569 break; 1570 } 1571 } 1572 1573 if (pcr->action != PF_CHANGE_REMOVE) { 1574 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1575 if (newrule == NULL) { 1576 error = ENOMEM; 1577 break; 1578 } 1579 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1580 #ifdef __NetBSD__ 1581 newrule->cuid = kauth_cred_getuid(l->l_cred); 1582 newrule->cpid = l->l_proc->p_pid; 1583 #else 1584 newrule->cuid = p->p_cred->p_ruid; 1585 newrule->cpid = p->p_pid; 1586 #endif /* !__NetBSD__ */ 1587 TAILQ_INIT(&newrule->rpool.list); 1588 /* initialize refcounting */ 1589 newrule->states = 0; 1590 newrule->entries.tqe_prev = NULL; 1591 #ifndef INET 1592 if (newrule->af == AF_INET) { 1593 pool_put(&pf_rule_pl, newrule); 1594 error = EAFNOSUPPORT; 1595 break; 1596 } 1597 #endif /* INET */ 1598 #ifndef INET6 1599 if (newrule->af == AF_INET6) { 1600 pool_put(&pf_rule_pl, newrule); 1601 error = EAFNOSUPPORT; 1602 break; 1603 } 1604 #endif /* INET6 */ 1605 if (newrule->ifname[0]) { 1606 newrule->kif = pfi_kif_get(newrule->ifname); 1607 if (newrule->kif == NULL) { 1608 pool_put(&pf_rule_pl, newrule); 1609 error = EINVAL; 1610 break; 1611 } 1612 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE); 1613 } else 1614 newrule->kif = NULL; 1615 1616 #ifndef __NetBSD__ 1617 if (newrule->rtableid > 0 && 1618 !rtable_exists(newrule->rtableid)) 1619 error = EBUSY; 1620 #endif /* !__NetBSD__ */ 1621 1622 #ifdef ALTQ 1623 /* set queue IDs */ 1624 if (newrule->qname[0] != 0) { 1625 if ((newrule->qid = 1626 pf_qname2qid(newrule->qname)) == 0) 1627 error = EBUSY; 1628 else if (newrule->pqname[0] != 0) { 1629 if ((newrule->pqid = 1630 pf_qname2qid(newrule->pqname)) == 0) 1631 error = EBUSY; 1632 } else 1633 newrule->pqid = newrule->qid; 1634 } 1635 #endif /* ALTQ */ 1636 if (newrule->tagname[0]) 1637 if ((newrule->tag = 1638 pf_tagname2tag(newrule->tagname)) == 0) 1639 error = EBUSY; 1640 if (newrule->match_tagname[0]) 1641 if ((newrule->match_tag = pf_tagname2tag( 1642 newrule->match_tagname)) == 0) 1643 error = EBUSY; 1644 if (newrule->rt && !newrule->direction) 1645 error = EINVAL; 1646 #if NPFLOG > 0 1647 if (!newrule->log) 1648 newrule->logif = 0; 1649 if (newrule->logif >= PFLOGIFS_MAX) 1650 error = EINVAL; 1651 #endif 1652 if (pf_rtlabel_add(&newrule->src.addr) || 1653 pf_rtlabel_add(&newrule->dst.addr)) 1654 error = EBUSY; 1655 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1656 error = EINVAL; 1657 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1658 error = EINVAL; 1659 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1660 error = EINVAL; 1661 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1662 error = EINVAL; 1663 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1664 error = EINVAL; 1665 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1666 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1667 error = EINVAL; 1668 1669 if (newrule->overload_tblname[0]) { 1670 if ((newrule->overload_tbl = pfr_attach_table( 1671 ruleset, newrule->overload_tblname)) == 1672 NULL) 1673 error = EINVAL; 1674 else 1675 newrule->overload_tbl->pfrkt_flags |= 1676 PFR_TFLAG_ACTIVE; 1677 } 1678 1679 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1680 if (((((newrule->action == PF_NAT) || 1681 (newrule->action == PF_RDR) || 1682 (newrule->action == PF_BINAT) || 1683 (newrule->rt > PF_FASTROUTE)) && 1684 !newrule->anchor)) && 1685 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1686 error = EINVAL; 1687 1688 if (error) { 1689 pf_rm_rule(NULL, newrule); 1690 break; 1691 } 1692 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1693 newrule->evaluations = 0; 1694 newrule->packets[0] = newrule->packets[1] = 0; 1695 newrule->bytes[0] = newrule->bytes[1] = 0; 1696 } 1697 pf_empty_pool(&pf_pabuf); 1698 1699 if (pcr->action == PF_CHANGE_ADD_HEAD) 1700 oldrule = TAILQ_FIRST( 1701 ruleset->rules[rs_num].active.ptr); 1702 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1703 oldrule = TAILQ_LAST( 1704 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1705 else { 1706 oldrule = TAILQ_FIRST( 1707 ruleset->rules[rs_num].active.ptr); 1708 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1709 oldrule = TAILQ_NEXT(oldrule, entries); 1710 if (oldrule == NULL) { 1711 if (newrule != NULL) 1712 pf_rm_rule(NULL, newrule); 1713 error = EINVAL; 1714 break; 1715 } 1716 } 1717 1718 if (pcr->action == PF_CHANGE_REMOVE) { 1719 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1720 ruleset->rules[rs_num].active.rcount--; 1721 } else { 1722 if (oldrule == NULL) 1723 TAILQ_INSERT_TAIL( 1724 ruleset->rules[rs_num].active.ptr, 1725 newrule, entries); 1726 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1727 pcr->action == PF_CHANGE_ADD_BEFORE) 1728 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1729 else 1730 TAILQ_INSERT_AFTER( 1731 ruleset->rules[rs_num].active.ptr, 1732 oldrule, newrule, entries); 1733 ruleset->rules[rs_num].active.rcount++; 1734 } 1735 1736 nr = 0; 1737 TAILQ_FOREACH(oldrule, 1738 ruleset->rules[rs_num].active.ptr, entries) 1739 oldrule->nr = nr++; 1740 1741 ruleset->rules[rs_num].active.ticket++; 1742 1743 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1744 pf_remove_if_empty_ruleset(ruleset); 1745 1746 break; 1747 } 1748 1749 case DIOCCLRSTATES: { 1750 struct pf_state *s, *nexts; 1751 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1752 int killed = 0; 1753 1754 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) { 1755 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s); 1756 1757 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1758 s->kif->pfik_name)) { 1759 #if NPFSYNC 1760 /* don't send out individual delete messages */ 1761 s->sync_flags = PFSTATE_NOSYNC; 1762 #endif 1763 pf_unlink_state(s); 1764 killed++; 1765 } 1766 } 1767 psk->psk_af = killed; 1768 #if NPFSYNC 1769 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1770 #endif 1771 break; 1772 } 1773 1774 case DIOCKILLSTATES: { 1775 struct pf_state *s, *nexts; 1776 struct pf_state_key *sk; 1777 struct pf_state_host *src, *dst; 1778 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1779 int killed = 0; 1780 1781 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; 1782 s = nexts) { 1783 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s); 1784 sk = s->state_key; 1785 1786 if (sk->direction == PF_OUT) { 1787 src = &sk->lan; 1788 dst = &sk->ext; 1789 } else { 1790 src = &sk->ext; 1791 dst = &sk->lan; 1792 } 1793 if ((!psk->psk_af || sk->af == psk->psk_af) 1794 && (!psk->psk_proto || psk->psk_proto == 1795 sk->proto) && 1796 PF_MATCHA(psk->psk_src.neg, 1797 &psk->psk_src.addr.v.a.addr, 1798 &psk->psk_src.addr.v.a.mask, 1799 &src->addr, sk->af) && 1800 PF_MATCHA(psk->psk_dst.neg, 1801 &psk->psk_dst.addr.v.a.addr, 1802 &psk->psk_dst.addr.v.a.mask, 1803 &dst->addr, sk->af) && 1804 (psk->psk_src.port_op == 0 || 1805 pf_match_port(psk->psk_src.port_op, 1806 psk->psk_src.port[0], psk->psk_src.port[1], 1807 src->port)) && 1808 (psk->psk_dst.port_op == 0 || 1809 pf_match_port(psk->psk_dst.port_op, 1810 psk->psk_dst.port[0], psk->psk_dst.port[1], 1811 dst->port)) && 1812 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1813 s->kif->pfik_name))) { 1814 #if NPFSYNC > 0 1815 /* send immediate delete of state */ 1816 pfsync_delete_state(s); 1817 s->sync_flags |= PFSTATE_NOSYNC; 1818 #endif 1819 pf_unlink_state(s); 1820 killed++; 1821 } 1822 } 1823 psk->psk_af = killed; 1824 break; 1825 } 1826 1827 case DIOCADDSTATE: { 1828 struct pfioc_state *ps = (struct pfioc_state *)addr; 1829 struct pfsync_state *sp = (struct pfsync_state *)ps->state; 1830 struct pf_state *s; 1831 struct pf_state_key *sk; 1832 struct pfi_kif *kif; 1833 1834 if (sp->timeout >= PFTM_MAX && 1835 sp->timeout != PFTM_UNTIL_PACKET) { 1836 error = EINVAL; 1837 break; 1838 } 1839 s = pool_get(&pf_state_pl, PR_NOWAIT); 1840 if (s == NULL) { 1841 error = ENOMEM; 1842 break; 1843 } 1844 bzero(s, sizeof(struct pf_state)); 1845 if ((sk = pf_alloc_state_key(s)) == NULL) { 1846 error = ENOMEM; 1847 break; 1848 } 1849 pf_state_import(sp, sk, s); 1850 kif = pfi_kif_get(sp->ifname); 1851 if (kif == NULL) { 1852 pool_put(&pf_state_pl, s); 1853 pool_put(&pf_state_key_pl, sk); 1854 error = ENOENT; 1855 break; 1856 } 1857 if (pf_insert_state(kif, s)) { 1858 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 1859 pool_put(&pf_state_pl, s); 1860 pool_put(&pf_state_key_pl, sk); 1861 error = ENOMEM; 1862 } 1863 break; 1864 } 1865 1866 case DIOCGETSTATE: { 1867 struct pfioc_state *ps = (struct pfioc_state *)addr; 1868 struct pf_state *s; 1869 u_int32_t nr; 1870 1871 nr = 0; 1872 RB_FOREACH(s, pf_state_tree_id, &tree_id) { 1873 if (nr >= ps->nr) 1874 break; 1875 nr++; 1876 } 1877 if (s == NULL) { 1878 error = EBUSY; 1879 break; 1880 } 1881 1882 pf_state_export((struct pfsync_state *)&ps->state, 1883 s->state_key, s); 1884 break; 1885 } 1886 1887 case DIOCGETSTATES: { 1888 struct pfioc_states *ps = (struct pfioc_states *)addr; 1889 struct pf_state *state; 1890 struct pfsync_state *p, *pstore; 1891 u_int32_t nr = 0; 1892 1893 if (ps->ps_len == 0) { 1894 nr = pf_status.states; 1895 ps->ps_len = sizeof(struct pfsync_state) * nr; 1896 break; 1897 } 1898 1899 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 1900 1901 p = ps->ps_states; 1902 1903 state = TAILQ_FIRST(&state_list); 1904 while (state) { 1905 if (state->timeout != PFTM_UNLINKED) { 1906 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1907 break; 1908 1909 pf_state_export(pstore, 1910 state->state_key, state); 1911 error = copyout(pstore, p, sizeof(*p)); 1912 if (error) { 1913 free(pstore, M_TEMP); 1914 goto fail; 1915 } 1916 p++; 1917 nr++; 1918 } 1919 state = TAILQ_NEXT(state, entry_list); 1920 } 1921 1922 ps->ps_len = sizeof(struct pfsync_state) * nr; 1923 1924 free(pstore, M_TEMP); 1925 break; 1926 } 1927 1928 case DIOCGETSTATUS: { 1929 struct pf_status *s = (struct pf_status *)addr; 1930 bcopy(&pf_status, s, sizeof(struct pf_status)); 1931 pfi_fill_oldstatus(s); 1932 break; 1933 } 1934 1935 case DIOCSETSTATUSIF: { 1936 struct pfioc_if *pi = (struct pfioc_if *)addr; 1937 1938 if (pi->ifname[0] == 0) { 1939 bzero(pf_status.ifname, IFNAMSIZ); 1940 break; 1941 } 1942 if (ifunit(pi->ifname) == NULL) { 1943 error = EINVAL; 1944 break; 1945 } 1946 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 1947 break; 1948 } 1949 1950 case DIOCCLRSTATUS: { 1951 bzero(pf_status.counters, sizeof(pf_status.counters)); 1952 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 1953 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 1954 pf_status.since = time_second; 1955 if (*pf_status.ifname) 1956 pfi_clr_istats(pf_status.ifname); 1957 break; 1958 } 1959 1960 case DIOCNATLOOK: { 1961 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1962 struct pf_state_key *sk; 1963 struct pf_state *state; 1964 struct pf_state_key_cmp key; 1965 int m = 0, direction = pnl->direction; 1966 1967 key.af = pnl->af; 1968 key.proto = pnl->proto; 1969 1970 if (!pnl->proto || 1971 PF_AZERO(&pnl->saddr, pnl->af) || 1972 PF_AZERO(&pnl->daddr, pnl->af) || 1973 ((pnl->proto == IPPROTO_TCP || 1974 pnl->proto == IPPROTO_UDP) && 1975 (!pnl->dport || !pnl->sport))) 1976 error = EINVAL; 1977 else { 1978 /* 1979 * userland gives us source and dest of connection, 1980 * reverse the lookup so we ask for what happens with 1981 * the return traffic, enabling us to find it in the 1982 * state tree. 1983 */ 1984 if (direction == PF_IN) { 1985 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 1986 key.ext.port = pnl->dport; 1987 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 1988 key.gwy.port = pnl->sport; 1989 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 1990 } else { 1991 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 1992 key.lan.port = pnl->dport; 1993 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 1994 key.ext.port = pnl->sport; 1995 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 1996 } 1997 if (m > 1) 1998 error = E2BIG; /* more than one state */ 1999 else if (state != NULL) { 2000 sk = state->state_key; 2001 if (direction == PF_IN) { 2002 PF_ACPY(&pnl->rsaddr, &sk->lan.addr, 2003 sk->af); 2004 pnl->rsport = sk->lan.port; 2005 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 2006 pnl->af); 2007 pnl->rdport = pnl->dport; 2008 } else { 2009 PF_ACPY(&pnl->rdaddr, &sk->gwy.addr, 2010 sk->af); 2011 pnl->rdport = sk->gwy.port; 2012 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 2013 pnl->af); 2014 pnl->rsport = pnl->sport; 2015 } 2016 } else 2017 error = ENOENT; 2018 } 2019 break; 2020 } 2021 2022 case DIOCSETTIMEOUT: { 2023 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 2024 int old; 2025 2026 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 2027 pt->seconds < 0) { 2028 error = EINVAL; 2029 goto fail; 2030 } 2031 old = pf_default_rule.timeout[pt->timeout]; 2032 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 2033 pt->seconds = 1; 2034 pf_default_rule.timeout[pt->timeout] = pt->seconds; 2035 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 2036 wakeup(pf_purge_thread); 2037 pt->seconds = old; 2038 break; 2039 } 2040 2041 case DIOCGETTIMEOUT: { 2042 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 2043 2044 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 2045 error = EINVAL; 2046 goto fail; 2047 } 2048 pt->seconds = pf_default_rule.timeout[pt->timeout]; 2049 break; 2050 } 2051 2052 case DIOCGETLIMIT: { 2053 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 2054 2055 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 2056 error = EINVAL; 2057 goto fail; 2058 } 2059 pl->limit = pf_pool_limits[pl->index].limit; 2060 break; 2061 } 2062 2063 case DIOCSETLIMIT: { 2064 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 2065 int old_limit; 2066 2067 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 2068 pf_pool_limits[pl->index].pp == NULL) { 2069 error = EINVAL; 2070 goto fail; 2071 } 2072 #ifdef __NetBSD__ 2073 pool_sethardlimit(pf_pool_limits[pl->index].pp, 2074 pl->limit, NULL, 0); 2075 #else 2076 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 2077 pl->limit, NULL, 0) != 0) { 2078 error = EBUSY; 2079 goto fail; 2080 } 2081 #endif /* !__NetBSD__ */ 2082 old_limit = pf_pool_limits[pl->index].limit; 2083 pf_pool_limits[pl->index].limit = pl->limit; 2084 pl->limit = old_limit; 2085 break; 2086 } 2087 2088 case DIOCSETDEBUG: { 2089 u_int32_t *level = (u_int32_t *)addr; 2090 2091 pf_status.debug = *level; 2092 break; 2093 } 2094 2095 case DIOCCLRRULECTRS: { 2096 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 2097 struct pf_ruleset *ruleset = &pf_main_ruleset; 2098 struct pf_rule *rule; 2099 2100 TAILQ_FOREACH(rule, 2101 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 2102 rule->evaluations = 0; 2103 rule->packets[0] = rule->packets[1] = 0; 2104 rule->bytes[0] = rule->bytes[1] = 0; 2105 } 2106 break; 2107 } 2108 2109 #ifdef ALTQ 2110 case DIOCSTARTALTQ: { 2111 struct pf_altq *altq; 2112 2113 /* enable all altq interfaces on active list */ 2114 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2115 if (altq->qname[0] == 0) { 2116 error = pf_enable_altq(altq); 2117 if (error != 0) 2118 break; 2119 } 2120 } 2121 if (error == 0) 2122 pf_altq_running = 1; 2123 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 2124 break; 2125 } 2126 2127 case DIOCSTOPALTQ: { 2128 struct pf_altq *altq; 2129 2130 /* disable all altq interfaces on active list */ 2131 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2132 if (altq->qname[0] == 0) { 2133 error = pf_disable_altq(altq); 2134 if (error != 0) 2135 break; 2136 } 2137 } 2138 if (error == 0) 2139 pf_altq_running = 0; 2140 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 2141 break; 2142 } 2143 2144 case DIOCADDALTQ: { 2145 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2146 struct pf_altq *altq, *a; 2147 2148 if (pa->ticket != ticket_altqs_inactive) { 2149 error = EBUSY; 2150 break; 2151 } 2152 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 2153 if (altq == NULL) { 2154 error = ENOMEM; 2155 break; 2156 } 2157 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 2158 2159 /* 2160 * if this is for a queue, find the discipline and 2161 * copy the necessary fields 2162 */ 2163 if (altq->qname[0] != 0) { 2164 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 2165 error = EBUSY; 2166 pool_put(&pf_altq_pl, altq); 2167 break; 2168 } 2169 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 2170 if (strncmp(a->ifname, altq->ifname, 2171 IFNAMSIZ) == 0 && a->qname[0] == 0) { 2172 altq->altq_disc = a->altq_disc; 2173 break; 2174 } 2175 } 2176 } 2177 2178 error = altq_add(altq); 2179 if (error) { 2180 pool_put(&pf_altq_pl, altq); 2181 break; 2182 } 2183 2184 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 2185 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2186 break; 2187 } 2188 2189 case DIOCGETALTQS: { 2190 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2191 struct pf_altq *altq; 2192 2193 pa->nr = 0; 2194 TAILQ_FOREACH(altq, pf_altqs_active, entries) 2195 pa->nr++; 2196 pa->ticket = ticket_altqs_active; 2197 break; 2198 } 2199 2200 case DIOCGETALTQ: { 2201 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2202 struct pf_altq *altq; 2203 u_int32_t nr; 2204 2205 if (pa->ticket != ticket_altqs_active) { 2206 error = EBUSY; 2207 break; 2208 } 2209 nr = 0; 2210 altq = TAILQ_FIRST(pf_altqs_active); 2211 while ((altq != NULL) && (nr < pa->nr)) { 2212 altq = TAILQ_NEXT(altq, entries); 2213 nr++; 2214 } 2215 if (altq == NULL) { 2216 error = EBUSY; 2217 break; 2218 } 2219 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2220 break; 2221 } 2222 2223 case DIOCCHANGEALTQ: 2224 /* CHANGEALTQ not supported yet! */ 2225 error = ENODEV; 2226 break; 2227 2228 case DIOCGETQSTATS: { 2229 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 2230 struct pf_altq *altq; 2231 u_int32_t nr; 2232 int nbytes; 2233 2234 if (pq->ticket != ticket_altqs_active) { 2235 error = EBUSY; 2236 break; 2237 } 2238 nbytes = pq->nbytes; 2239 nr = 0; 2240 altq = TAILQ_FIRST(pf_altqs_active); 2241 while ((altq != NULL) && (nr < pq->nr)) { 2242 altq = TAILQ_NEXT(altq, entries); 2243 nr++; 2244 } 2245 if (altq == NULL) { 2246 error = EBUSY; 2247 break; 2248 } 2249 error = altq_getqstats(altq, pq->buf, &nbytes); 2250 if (error == 0) { 2251 pq->scheduler = altq->scheduler; 2252 pq->nbytes = nbytes; 2253 } 2254 break; 2255 } 2256 #endif /* ALTQ */ 2257 2258 case DIOCBEGINADDRS: { 2259 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2260 2261 pf_empty_pool(&pf_pabuf); 2262 pp->ticket = ++ticket_pabuf; 2263 break; 2264 } 2265 2266 case DIOCADDADDR: { 2267 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2268 2269 if (pp->ticket != ticket_pabuf) { 2270 error = EBUSY; 2271 break; 2272 } 2273 #ifndef INET 2274 if (pp->af == AF_INET) { 2275 error = EAFNOSUPPORT; 2276 break; 2277 } 2278 #endif /* INET */ 2279 #ifndef INET6 2280 if (pp->af == AF_INET6) { 2281 error = EAFNOSUPPORT; 2282 break; 2283 } 2284 #endif /* INET6 */ 2285 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2286 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2287 pp->addr.addr.type != PF_ADDR_TABLE) { 2288 error = EINVAL; 2289 break; 2290 } 2291 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2292 if (pa == NULL) { 2293 error = ENOMEM; 2294 break; 2295 } 2296 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2297 if (pa->ifname[0]) { 2298 pa->kif = pfi_kif_get(pa->ifname); 2299 if (pa->kif == NULL) { 2300 pool_put(&pf_pooladdr_pl, pa); 2301 error = EINVAL; 2302 break; 2303 } 2304 pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE); 2305 } 2306 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 2307 pfi_dynaddr_remove(&pa->addr); 2308 pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE); 2309 pool_put(&pf_pooladdr_pl, pa); 2310 error = EINVAL; 2311 break; 2312 } 2313 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 2314 break; 2315 } 2316 2317 case DIOCGETADDRS: { 2318 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2319 2320 pp->nr = 0; 2321 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2322 pp->r_num, 0, 1, 0); 2323 if (pool == NULL) { 2324 error = EBUSY; 2325 break; 2326 } 2327 TAILQ_FOREACH(pa, &pool->list, entries) 2328 pp->nr++; 2329 break; 2330 } 2331 2332 case DIOCGETADDR: { 2333 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2334 u_int32_t nr = 0; 2335 2336 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2337 pp->r_num, 0, 1, 1); 2338 if (pool == NULL) { 2339 error = EBUSY; 2340 break; 2341 } 2342 pa = TAILQ_FIRST(&pool->list); 2343 while ((pa != NULL) && (nr < pp->nr)) { 2344 pa = TAILQ_NEXT(pa, entries); 2345 nr++; 2346 } 2347 if (pa == NULL) { 2348 error = EBUSY; 2349 break; 2350 } 2351 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2352 pfi_dynaddr_copyout(&pp->addr.addr); 2353 pf_tbladdr_copyout(&pp->addr.addr); 2354 pf_rtlabel_copyout(&pp->addr.addr); 2355 break; 2356 } 2357 2358 case DIOCCHANGEADDR: { 2359 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2360 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2361 struct pf_ruleset *ruleset; 2362 2363 if (pca->action < PF_CHANGE_ADD_HEAD || 2364 pca->action > PF_CHANGE_REMOVE) { 2365 error = EINVAL; 2366 break; 2367 } 2368 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2369 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2370 pca->addr.addr.type != PF_ADDR_TABLE) { 2371 error = EINVAL; 2372 break; 2373 } 2374 2375 ruleset = pf_find_ruleset(pca->anchor); 2376 if (ruleset == NULL) { 2377 error = EBUSY; 2378 break; 2379 } 2380 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2381 pca->r_num, pca->r_last, 1, 1); 2382 if (pool == NULL) { 2383 error = EBUSY; 2384 break; 2385 } 2386 if (pca->action != PF_CHANGE_REMOVE) { 2387 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2388 if (newpa == NULL) { 2389 error = ENOMEM; 2390 break; 2391 } 2392 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2393 #ifndef INET 2394 if (pca->af == AF_INET) { 2395 pool_put(&pf_pooladdr_pl, newpa); 2396 error = EAFNOSUPPORT; 2397 break; 2398 } 2399 #endif /* INET */ 2400 #ifndef INET6 2401 if (pca->af == AF_INET6) { 2402 pool_put(&pf_pooladdr_pl, newpa); 2403 error = EAFNOSUPPORT; 2404 break; 2405 } 2406 #endif /* INET6 */ 2407 if (newpa->ifname[0]) { 2408 newpa->kif = pfi_kif_get(newpa->ifname); 2409 if (newpa->kif == NULL) { 2410 pool_put(&pf_pooladdr_pl, newpa); 2411 error = EINVAL; 2412 break; 2413 } 2414 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE); 2415 } else 2416 newpa->kif = NULL; 2417 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2418 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2419 pfi_dynaddr_remove(&newpa->addr); 2420 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE); 2421 pool_put(&pf_pooladdr_pl, newpa); 2422 error = EINVAL; 2423 break; 2424 } 2425 } 2426 2427 if (pca->action == PF_CHANGE_ADD_HEAD) 2428 oldpa = TAILQ_FIRST(&pool->list); 2429 else if (pca->action == PF_CHANGE_ADD_TAIL) 2430 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2431 else { 2432 int i = 0; 2433 2434 oldpa = TAILQ_FIRST(&pool->list); 2435 while ((oldpa != NULL) && (i < pca->nr)) { 2436 oldpa = TAILQ_NEXT(oldpa, entries); 2437 i++; 2438 } 2439 if (oldpa == NULL) { 2440 error = EINVAL; 2441 break; 2442 } 2443 } 2444 2445 if (pca->action == PF_CHANGE_REMOVE) { 2446 TAILQ_REMOVE(&pool->list, oldpa, entries); 2447 pfi_dynaddr_remove(&oldpa->addr); 2448 pf_tbladdr_remove(&oldpa->addr); 2449 pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE); 2450 pool_put(&pf_pooladdr_pl, oldpa); 2451 } else { 2452 if (oldpa == NULL) 2453 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2454 else if (pca->action == PF_CHANGE_ADD_HEAD || 2455 pca->action == PF_CHANGE_ADD_BEFORE) 2456 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2457 else 2458 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2459 newpa, entries); 2460 } 2461 2462 pool->cur = TAILQ_FIRST(&pool->list); 2463 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2464 pca->af); 2465 break; 2466 } 2467 2468 case DIOCGETRULESETS: { 2469 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2470 struct pf_ruleset *ruleset; 2471 struct pf_anchor *anchor; 2472 2473 pr->path[sizeof(pr->path) - 1] = 0; 2474 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2475 error = EINVAL; 2476 break; 2477 } 2478 pr->nr = 0; 2479 if (ruleset->anchor == NULL) { 2480 /* XXX kludge for pf_main_ruleset */ 2481 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2482 if (anchor->parent == NULL) 2483 pr->nr++; 2484 } else { 2485 RB_FOREACH(anchor, pf_anchor_node, 2486 &ruleset->anchor->children) 2487 pr->nr++; 2488 } 2489 break; 2490 } 2491 2492 case DIOCGETRULESET: { 2493 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2494 struct pf_ruleset *ruleset; 2495 struct pf_anchor *anchor; 2496 u_int32_t nr = 0; 2497 2498 pr->path[sizeof(pr->path) - 1] = 0; 2499 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2500 error = EINVAL; 2501 break; 2502 } 2503 pr->name[0] = 0; 2504 if (ruleset->anchor == NULL) { 2505 /* XXX kludge for pf_main_ruleset */ 2506 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2507 if (anchor->parent == NULL && nr++ == pr->nr) { 2508 strlcpy(pr->name, anchor->name, 2509 sizeof(pr->name)); 2510 break; 2511 } 2512 } else { 2513 RB_FOREACH(anchor, pf_anchor_node, 2514 &ruleset->anchor->children) 2515 if (nr++ == pr->nr) { 2516 strlcpy(pr->name, anchor->name, 2517 sizeof(pr->name)); 2518 break; 2519 } 2520 } 2521 if (!pr->name[0]) 2522 error = EBUSY; 2523 break; 2524 } 2525 2526 case DIOCRCLRTABLES: { 2527 struct pfioc_table *io = (struct pfioc_table *)addr; 2528 2529 if (io->pfrio_esize != 0) { 2530 error = ENODEV; 2531 break; 2532 } 2533 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2534 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2535 break; 2536 } 2537 2538 case DIOCRADDTABLES: { 2539 struct pfioc_table *io = (struct pfioc_table *)addr; 2540 2541 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2542 error = ENODEV; 2543 break; 2544 } 2545 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2546 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2547 break; 2548 } 2549 2550 case DIOCRDELTABLES: { 2551 struct pfioc_table *io = (struct pfioc_table *)addr; 2552 2553 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2554 error = ENODEV; 2555 break; 2556 } 2557 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2558 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2559 break; 2560 } 2561 2562 case DIOCRGETTABLES: { 2563 struct pfioc_table *io = (struct pfioc_table *)addr; 2564 2565 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2566 error = ENODEV; 2567 break; 2568 } 2569 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2570 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2571 break; 2572 } 2573 2574 case DIOCRGETTSTATS: { 2575 struct pfioc_table *io = (struct pfioc_table *)addr; 2576 2577 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2578 error = ENODEV; 2579 break; 2580 } 2581 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2582 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2583 break; 2584 } 2585 2586 case DIOCRCLRTSTATS: { 2587 struct pfioc_table *io = (struct pfioc_table *)addr; 2588 2589 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2590 error = ENODEV; 2591 break; 2592 } 2593 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2594 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2595 break; 2596 } 2597 2598 case DIOCRSETTFLAGS: { 2599 struct pfioc_table *io = (struct pfioc_table *)addr; 2600 2601 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2602 error = ENODEV; 2603 break; 2604 } 2605 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2606 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2607 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2608 break; 2609 } 2610 2611 case DIOCRCLRADDRS: { 2612 struct pfioc_table *io = (struct pfioc_table *)addr; 2613 2614 if (io->pfrio_esize != 0) { 2615 error = ENODEV; 2616 break; 2617 } 2618 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2619 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2620 break; 2621 } 2622 2623 case DIOCRADDADDRS: { 2624 struct pfioc_table *io = (struct pfioc_table *)addr; 2625 2626 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2627 error = ENODEV; 2628 break; 2629 } 2630 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2631 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2632 PFR_FLAG_USERIOCTL); 2633 break; 2634 } 2635 2636 case DIOCRDELADDRS: { 2637 struct pfioc_table *io = (struct pfioc_table *)addr; 2638 2639 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2640 error = ENODEV; 2641 break; 2642 } 2643 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2644 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2645 PFR_FLAG_USERIOCTL); 2646 break; 2647 } 2648 2649 case DIOCRSETADDRS: { 2650 struct pfioc_table *io = (struct pfioc_table *)addr; 2651 2652 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2653 error = ENODEV; 2654 break; 2655 } 2656 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2657 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2658 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2659 PFR_FLAG_USERIOCTL, 0); 2660 break; 2661 } 2662 2663 case DIOCRGETADDRS: { 2664 struct pfioc_table *io = (struct pfioc_table *)addr; 2665 2666 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2667 error = ENODEV; 2668 break; 2669 } 2670 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2671 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2672 break; 2673 } 2674 2675 case DIOCRGETASTATS: { 2676 struct pfioc_table *io = (struct pfioc_table *)addr; 2677 2678 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2679 error = ENODEV; 2680 break; 2681 } 2682 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2683 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2684 break; 2685 } 2686 2687 case DIOCRCLRASTATS: { 2688 struct pfioc_table *io = (struct pfioc_table *)addr; 2689 2690 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2691 error = ENODEV; 2692 break; 2693 } 2694 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2695 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2696 PFR_FLAG_USERIOCTL); 2697 break; 2698 } 2699 2700 case DIOCRTSTADDRS: { 2701 struct pfioc_table *io = (struct pfioc_table *)addr; 2702 2703 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2704 error = ENODEV; 2705 break; 2706 } 2707 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2708 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2709 PFR_FLAG_USERIOCTL); 2710 break; 2711 } 2712 2713 case DIOCRINADEFINE: { 2714 struct pfioc_table *io = (struct pfioc_table *)addr; 2715 2716 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2717 error = ENODEV; 2718 break; 2719 } 2720 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2721 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2722 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2723 break; 2724 } 2725 2726 case DIOCOSFPADD: { 2727 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2728 error = pf_osfp_add(io); 2729 break; 2730 } 2731 2732 case DIOCOSFPGET: { 2733 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2734 error = pf_osfp_get(io); 2735 break; 2736 } 2737 2738 case DIOCXBEGIN: { 2739 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2740 struct pfioc_trans_e *ioe; 2741 struct pfr_table *table; 2742 int i; 2743 2744 if (io->esize != sizeof(*ioe)) { 2745 error = ENODEV; 2746 goto fail; 2747 } 2748 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2749 M_TEMP, M_WAITOK); 2750 table = (struct pfr_table *)malloc(sizeof(*table), 2751 M_TEMP, M_WAITOK); 2752 for (i = 0; i < io->size; i++) { 2753 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2754 free(table, M_TEMP); 2755 free(ioe, M_TEMP); 2756 error = EFAULT; 2757 goto fail; 2758 } 2759 switch (ioe->rs_num) { 2760 #ifdef ALTQ 2761 case PF_RULESET_ALTQ: 2762 if (ioe->anchor[0]) { 2763 free(table, M_TEMP); 2764 free(ioe, M_TEMP); 2765 error = EINVAL; 2766 goto fail; 2767 } 2768 if ((error = pf_begin_altq(&ioe->ticket))) { 2769 free(table, M_TEMP); 2770 free(ioe, M_TEMP); 2771 goto fail; 2772 } 2773 break; 2774 #endif /* ALTQ */ 2775 case PF_RULESET_TABLE: 2776 bzero(table, sizeof(*table)); 2777 strlcpy(table->pfrt_anchor, ioe->anchor, 2778 sizeof(table->pfrt_anchor)); 2779 if ((error = pfr_ina_begin(table, 2780 &ioe->ticket, NULL, 0))) { 2781 free(table, M_TEMP); 2782 free(ioe, M_TEMP); 2783 goto fail; 2784 } 2785 break; 2786 default: 2787 if ((error = pf_begin_rules(&ioe->ticket, 2788 ioe->rs_num, ioe->anchor))) { 2789 free(table, M_TEMP); 2790 free(ioe, M_TEMP); 2791 goto fail; 2792 } 2793 break; 2794 } 2795 if (copyout(ioe, io->array+i, sizeof(io->array[i]))) { 2796 free(table, M_TEMP); 2797 free(ioe, M_TEMP); 2798 error = EFAULT; 2799 goto fail; 2800 } 2801 } 2802 free(table, M_TEMP); 2803 free(ioe, M_TEMP); 2804 break; 2805 } 2806 2807 case DIOCXROLLBACK: { 2808 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2809 struct pfioc_trans_e *ioe; 2810 struct pfr_table *table; 2811 int i; 2812 2813 if (io->esize != sizeof(*ioe)) { 2814 error = ENODEV; 2815 goto fail; 2816 } 2817 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2818 M_TEMP, M_WAITOK); 2819 table = (struct pfr_table *)malloc(sizeof(*table), 2820 M_TEMP, M_WAITOK); 2821 for (i = 0; i < io->size; i++) { 2822 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2823 free(table, M_TEMP); 2824 free(ioe, M_TEMP); 2825 error = EFAULT; 2826 goto fail; 2827 } 2828 switch (ioe->rs_num) { 2829 #ifdef ALTQ 2830 case PF_RULESET_ALTQ: 2831 if (ioe->anchor[0]) { 2832 free(table, M_TEMP); 2833 free(ioe, M_TEMP); 2834 error = EINVAL; 2835 goto fail; 2836 } 2837 if ((error = pf_rollback_altq(ioe->ticket))) { 2838 free(table, M_TEMP); 2839 free(ioe, M_TEMP); 2840 goto fail; /* really bad */ 2841 } 2842 break; 2843 #endif /* ALTQ */ 2844 case PF_RULESET_TABLE: 2845 bzero(table, sizeof(*table)); 2846 strlcpy(table->pfrt_anchor, ioe->anchor, 2847 sizeof(table->pfrt_anchor)); 2848 if ((error = pfr_ina_rollback(table, 2849 ioe->ticket, NULL, 0))) { 2850 free(table, M_TEMP); 2851 free(ioe, M_TEMP); 2852 goto fail; /* really bad */ 2853 } 2854 break; 2855 default: 2856 if ((error = pf_rollback_rules(ioe->ticket, 2857 ioe->rs_num, ioe->anchor))) { 2858 free(table, M_TEMP); 2859 free(ioe, M_TEMP); 2860 goto fail; /* really bad */ 2861 } 2862 break; 2863 } 2864 } 2865 free(table, M_TEMP); 2866 free(ioe, M_TEMP); 2867 break; 2868 } 2869 2870 case DIOCXCOMMIT: { 2871 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2872 struct pfioc_trans_e *ioe; 2873 struct pfr_table *table; 2874 struct pf_ruleset *rs; 2875 int i; 2876 2877 if (io->esize != sizeof(*ioe)) { 2878 error = ENODEV; 2879 goto fail; 2880 } 2881 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2882 M_TEMP, M_WAITOK); 2883 table = (struct pfr_table *)malloc(sizeof(*table), 2884 M_TEMP, M_WAITOK); 2885 /* first makes sure everything will succeed */ 2886 for (i = 0; i < io->size; i++) { 2887 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2888 free(table, M_TEMP); 2889 free(ioe, M_TEMP); 2890 error = EFAULT; 2891 goto fail; 2892 } 2893 switch (ioe->rs_num) { 2894 #ifdef ALTQ 2895 case PF_RULESET_ALTQ: 2896 if (ioe->anchor[0]) { 2897 free(table, M_TEMP); 2898 free(ioe, M_TEMP); 2899 error = EINVAL; 2900 goto fail; 2901 } 2902 if (!altqs_inactive_open || ioe->ticket != 2903 ticket_altqs_inactive) { 2904 free(table, M_TEMP); 2905 free(ioe, M_TEMP); 2906 error = EBUSY; 2907 goto fail; 2908 } 2909 break; 2910 #endif /* ALTQ */ 2911 case PF_RULESET_TABLE: 2912 rs = pf_find_ruleset(ioe->anchor); 2913 if (rs == NULL || !rs->topen || ioe->ticket != 2914 rs->tticket) { 2915 free(table, M_TEMP); 2916 free(ioe, M_TEMP); 2917 error = EBUSY; 2918 goto fail; 2919 } 2920 break; 2921 default: 2922 if (ioe->rs_num < 0 || ioe->rs_num >= 2923 PF_RULESET_MAX) { 2924 free(table, M_TEMP); 2925 free(ioe, M_TEMP); 2926 error = EINVAL; 2927 goto fail; 2928 } 2929 rs = pf_find_ruleset(ioe->anchor); 2930 if (rs == NULL || 2931 !rs->rules[ioe->rs_num].inactive.open || 2932 rs->rules[ioe->rs_num].inactive.ticket != 2933 ioe->ticket) { 2934 free(table, M_TEMP); 2935 free(ioe, M_TEMP); 2936 error = EBUSY; 2937 goto fail; 2938 } 2939 break; 2940 } 2941 } 2942 /* now do the commit - no errors should happen here */ 2943 for (i = 0; i < io->size; i++) { 2944 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2945 free(table, M_TEMP); 2946 free(ioe, M_TEMP); 2947 error = EFAULT; 2948 goto fail; 2949 } 2950 switch (ioe->rs_num) { 2951 #ifdef ALTQ 2952 case PF_RULESET_ALTQ: 2953 if ((error = pf_commit_altq(ioe->ticket))) { 2954 free(table, M_TEMP); 2955 free(ioe, M_TEMP); 2956 goto fail; /* really bad */ 2957 } 2958 break; 2959 #endif /* ALTQ */ 2960 case PF_RULESET_TABLE: 2961 bzero(table, sizeof(*table)); 2962 strlcpy(table->pfrt_anchor, ioe->anchor, 2963 sizeof(table->pfrt_anchor)); 2964 if ((error = pfr_ina_commit(table, ioe->ticket, 2965 NULL, NULL, 0))) { 2966 free(table, M_TEMP); 2967 free(ioe, M_TEMP); 2968 goto fail; /* really bad */ 2969 } 2970 break; 2971 default: 2972 if ((error = pf_commit_rules(ioe->ticket, 2973 ioe->rs_num, ioe->anchor))) { 2974 free(table, M_TEMP); 2975 free(ioe, M_TEMP); 2976 goto fail; /* really bad */ 2977 } 2978 break; 2979 } 2980 } 2981 free(table, M_TEMP); 2982 free(ioe, M_TEMP); 2983 break; 2984 } 2985 2986 case DIOCGETSRCNODES: { 2987 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 2988 struct pf_src_node *n, *p, *pstore; 2989 u_int32_t nr = 0; 2990 int space = psn->psn_len; 2991 2992 if (space == 0) { 2993 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 2994 nr++; 2995 psn->psn_len = sizeof(struct pf_src_node) * nr; 2996 break; 2997 } 2998 2999 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 3000 3001 p = psn->psn_src_nodes; 3002 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 3003 int secs = time_second, diff; 3004 3005 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 3006 break; 3007 3008 bcopy(n, pstore, sizeof(*pstore)); 3009 if (n->rule.ptr != NULL) 3010 pstore->rule.nr = n->rule.ptr->nr; 3011 pstore->creation = secs - pstore->creation; 3012 if (pstore->expire > secs) 3013 pstore->expire -= secs; 3014 else 3015 pstore->expire = 0; 3016 3017 /* adjust the connection rate estimate */ 3018 diff = secs - n->conn_rate.last; 3019 if (diff >= n->conn_rate.seconds) 3020 pstore->conn_rate.count = 0; 3021 else 3022 pstore->conn_rate.count -= 3023 n->conn_rate.count * diff / 3024 n->conn_rate.seconds; 3025 3026 error = copyout(pstore, p, sizeof(*p)); 3027 if (error) { 3028 free(pstore, M_TEMP); 3029 goto fail; 3030 } 3031 p++; 3032 nr++; 3033 } 3034 psn->psn_len = sizeof(struct pf_src_node) * nr; 3035 3036 free(pstore, M_TEMP); 3037 break; 3038 } 3039 3040 case DIOCCLRSRCNODES: { 3041 struct pf_src_node *n; 3042 struct pf_state *state; 3043 3044 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 3045 state->src_node = NULL; 3046 state->nat_src_node = NULL; 3047 } 3048 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 3049 n->expire = 1; 3050 n->states = 0; 3051 } 3052 pf_purge_expired_src_nodes(1); 3053 pf_status.src_nodes = 0; 3054 break; 3055 } 3056 3057 case DIOCKILLSRCNODES: { 3058 struct pf_src_node *sn; 3059 struct pf_state *s; 3060 struct pfioc_src_node_kill *psnk = \ 3061 (struct pfioc_src_node_kill *) addr; 3062 int killed = 0; 3063 3064 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) { 3065 if (PF_MATCHA(psnk->psnk_src.neg, \ 3066 &psnk->psnk_src.addr.v.a.addr, \ 3067 &psnk->psnk_src.addr.v.a.mask, \ 3068 &sn->addr, sn->af) && 3069 PF_MATCHA(psnk->psnk_dst.neg, \ 3070 &psnk->psnk_dst.addr.v.a.addr, \ 3071 &psnk->psnk_dst.addr.v.a.mask, \ 3072 &sn->raddr, sn->af)) { 3073 /* Handle state to src_node linkage */ 3074 if (sn->states != 0) { 3075 RB_FOREACH(s, pf_state_tree_id, 3076 &tree_id) { 3077 if (s->src_node == sn) 3078 s->src_node = NULL; 3079 if (s->nat_src_node == sn) 3080 s->nat_src_node = NULL; 3081 } 3082 sn->states = 0; 3083 } 3084 sn->expire = 1; 3085 killed++; 3086 } 3087 } 3088 3089 if (killed > 0) 3090 pf_purge_expired_src_nodes(1); 3091 3092 psnk->psnk_af = killed; 3093 break; 3094 } 3095 3096 case DIOCSETHOSTID: { 3097 u_int32_t *hostid = (u_int32_t *)addr; 3098 3099 if (*hostid == 0) 3100 pf_status.hostid = arc4random(); 3101 else 3102 pf_status.hostid = *hostid; 3103 break; 3104 } 3105 3106 case DIOCOSFPFLUSH: 3107 pf_osfp_flush(); 3108 break; 3109 3110 case DIOCIGETIFACES: { 3111 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3112 3113 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 3114 error = ENODEV; 3115 break; 3116 } 3117 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 3118 &io->pfiio_size); 3119 break; 3120 } 3121 3122 case DIOCSETIFFLAG: { 3123 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3124 3125 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 3126 break; 3127 } 3128 3129 case DIOCCLRIFFLAG: { 3130 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3131 3132 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 3133 break; 3134 } 3135 3136 default: 3137 error = ENODEV; 3138 break; 3139 } 3140 fail: 3141 splx(s); 3142 if (flags & FWRITE) 3143 rw_exit_write(&pf_consistency_lock); 3144 else 3145 rw_exit_read(&pf_consistency_lock); 3146 return (error); 3147 } 3148 3149 #ifdef __NetBSD__ 3150 #ifdef INET 3151 static int 3152 pfil4_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3153 { 3154 int error; 3155 3156 /* 3157 * ensure that mbufs are writable beforehand 3158 * as it's assumed by pf code. 3159 * ip hdr (60 bytes) + tcp hdr (60 bytes) should be enough. 3160 * XXX inefficient 3161 */ 3162 error = m_makewritable(mp, 0, 60 + 60, M_DONTWAIT); 3163 if (error) { 3164 m_freem(*mp); 3165 *mp = NULL; 3166 return error; 3167 } 3168 3169 /* 3170 * If the packet is out-bound, we can't delay checksums 3171 * here. For in-bound, the checksum has already been 3172 * validated. 3173 */ 3174 if (dir == PFIL_OUT) { 3175 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 3176 in_delayed_cksum(*mp); 3177 (*mp)->m_pkthdr.csum_flags &= 3178 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 3179 } 3180 } 3181 3182 if (pf_test(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3183 != PF_PASS) { 3184 m_freem(*mp); 3185 *mp = NULL; 3186 return EHOSTUNREACH; 3187 } 3188 3189 /* 3190 * we're not compatible with fast-forward. 3191 */ 3192 3193 if (dir == PFIL_IN && *mp) { 3194 (*mp)->m_flags &= ~M_CANFASTFWD; 3195 } 3196 3197 return (0); 3198 } 3199 #endif /* INET */ 3200 3201 #ifdef INET6 3202 static int 3203 pfil6_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3204 { 3205 int error; 3206 3207 /* 3208 * ensure that mbufs are writable beforehand 3209 * as it's assumed by pf code. 3210 * XXX inefficient 3211 */ 3212 error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 3213 if (error) { 3214 m_freem(*mp); 3215 *mp = NULL; 3216 return error; 3217 } 3218 3219 /* 3220 * If the packet is out-bound, we can't delay checksums 3221 * here. For in-bound, the checksum has already been 3222 * validated. 3223 */ 3224 if (dir == PFIL_OUT) { 3225 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 3226 in6_delayed_cksum(*mp); 3227 (*mp)->m_pkthdr.csum_flags &= 3228 ~(M_CSUM_TCPv6|M_CSUM_UDPv6); 3229 } 3230 } 3231 3232 if (pf_test6(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3233 != PF_PASS) { 3234 m_freem(*mp); 3235 *mp = NULL; 3236 return EHOSTUNREACH; 3237 } else 3238 return (0); 3239 } 3240 #endif /* INET6 */ 3241 3242 static int 3243 pf_pfil_attach(void) 3244 { 3245 struct pfil_head *ph_inet; 3246 #ifdef INET6 3247 struct pfil_head *ph_inet6; 3248 #endif /* INET6 */ 3249 int error; 3250 3251 if (pf_pfil_attached) 3252 return (EBUSY); 3253 3254 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3255 if (ph_inet) 3256 error = pfil_add_hook((void *)pfil4_wrapper, NULL, 3257 PFIL_IN|PFIL_OUT, ph_inet); 3258 else 3259 error = ENOENT; 3260 if (error) 3261 return (error); 3262 3263 #ifdef INET6 3264 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3265 if (ph_inet6) 3266 error = pfil_add_hook((void *)pfil6_wrapper, NULL, 3267 PFIL_IN|PFIL_OUT, ph_inet6); 3268 else 3269 error = ENOENT; 3270 if (error) 3271 goto bad; 3272 #endif /* INET6 */ 3273 3274 pf_pfil_attached = 1; 3275 3276 return (0); 3277 3278 #ifdef INET6 3279 bad: 3280 pfil_remove_hook(pfil4_wrapper, NULL, PFIL_IN|PFIL_OUT, ph_inet); 3281 #endif /* INET6 */ 3282 3283 return (error); 3284 } 3285 3286 static int 3287 pf_pfil_detach(void) 3288 { 3289 struct pfil_head *ph_inet; 3290 #ifdef INET6 3291 struct pfil_head *ph_inet6; 3292 #endif /* INET6 */ 3293 3294 if (pf_pfil_attached == 0) 3295 return (EBUSY); 3296 3297 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3298 if (ph_inet) 3299 pfil_remove_hook((void *)pfil4_wrapper, NULL, 3300 PFIL_IN|PFIL_OUT, ph_inet); 3301 #ifdef INET6 3302 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3303 if (ph_inet6) 3304 pfil_remove_hook((void *)pfil6_wrapper, NULL, 3305 PFIL_IN|PFIL_OUT, ph_inet6); 3306 #endif /* INET6 */ 3307 pf_pfil_attached = 0; 3308 3309 return (0); 3310 } 3311 #endif /* __NetBSD__ */ 3312
Indexes created Thu Oct 02 14:10:14 GMT 2025