pf_ioctl.c revision 1.32.12.3
1 /* $NetBSD: pf_ioctl.c,v 1.32.12.3 2009/09/16 13:37:59 yamt Exp $ */ 2 /* $OpenBSD: pf_ioctl.c,v 1.182 2007/06/24 11:17:13 mcbride Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: pf_ioctl.c,v 1.32.12.3 2009/09/16 13:37:59 yamt Exp $"); 41 42 #ifdef _KERNEL_OPT 43 #include "opt_inet.h" 44 #include "opt_pfil_hooks.h" 45 #endif 46 47 #include "pfsync.h" 48 49 #include <sys/param.h> 50 #include <sys/systm.h> 51 #include <sys/mbuf.h> 52 #include <sys/filio.h> 53 #include <sys/fcntl.h> 54 #include <sys/socket.h> 55 #include <sys/socketvar.h> 56 #include <sys/kernel.h> 57 #include <sys/time.h> 58 #include <sys/pool.h> 59 #include <sys/proc.h> 60 #include <sys/malloc.h> 61 #include <sys/kthread.h> 62 #include <sys/rwlock.h> 63 #include <uvm/uvm_extern.h> 64 #ifdef __NetBSD__ 65 #include <sys/conf.h> 66 #include <sys/lwp.h> 67 #include <sys/kauth.h> 68 #endif /* __NetBSD__ */ 69 70 #include <net/if.h> 71 #include <net/if_types.h> 72 #include <net/route.h> 73 74 #include <netinet/in.h> 75 #include <netinet/in_var.h> 76 #include <netinet/in_systm.h> 77 #include <netinet/ip.h> 78 #include <netinet/ip_var.h> 79 #include <netinet/ip_icmp.h> 80 81 #ifndef __NetBSD__ 82 #include <dev/rndvar.h> 83 #include <crypto/md5.h> 84 #else 85 #include <sys/md5.h> 86 #endif /* __NetBSD__ */ 87 #include <net/pfvar.h> 88 89 #if NPFSYNC > 0 90 #include <net/if_pfsync.h> 91 #endif /* NPFSYNC > 0 */ 92 93 #if NPFLOG > 0 94 #include <net/if_pflog.h> 95 #endif /* NPFLOG > 0 */ 96 97 #ifdef INET6 98 #include <netinet/ip6.h> 99 #include <netinet/in_pcb.h> 100 #endif /* INET6 */ 101 102 #ifdef ALTQ 103 #include <altq/altq.h> 104 #endif 105 106 void pfattach(int); 107 #ifndef __NetBSD__ 108 void pf_thread_create(void *); 109 #endif /* !__NetBSD__ */ 110 int pfopen(dev_t, int, int, struct lwp *); 111 int pfclose(dev_t, int, int, struct lwp *); 112 struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 113 u_int8_t, u_int8_t, u_int8_t); 114 115 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 116 void pf_empty_pool(struct pf_palist *); 117 int pfioctl(dev_t, u_long, void *, int, struct lwp *); 118 #ifdef ALTQ 119 int pf_begin_altq(u_int32_t *); 120 int pf_rollback_altq(u_int32_t); 121 int pf_commit_altq(u_int32_t); 122 int pf_enable_altq(struct pf_altq *); 123 int pf_disable_altq(struct pf_altq *); 124 #endif /* ALTQ */ 125 int pf_begin_rules(u_int32_t *, int, const char *); 126 int pf_rollback_rules(u_int32_t, int, char *); 127 int pf_setup_pfsync_matching(struct pf_ruleset *); 128 void pf_hash_rule(MD5_CTX *, struct pf_rule *); 129 void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 130 int pf_commit_rules(u_int32_t, int, char *); 131 void pf_state_export(struct pfsync_state *, 132 struct pf_state_key *, struct pf_state *); 133 void pf_state_import(struct pfsync_state *, 134 struct pf_state_key *, struct pf_state *); 135 136 struct pf_rule pf_default_rule; 137 #ifdef __NetBSD__ 138 krwlock_t pf_consistency_lock; 139 #else 140 struct rwlock pf_consistency_lock = RWLOCK_INITIALIZER("pfcnslk"); 141 #endif /* __NetBSD__ */ 142 #ifdef ALTQ 143 static int pf_altq_running; 144 #endif 145 146 #define TAGID_MAX 50000 147 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 148 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 149 150 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 151 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 152 #endif 153 u_int16_t tagname2tag(struct pf_tags *, char *); 154 void tag2tagname(struct pf_tags *, u_int16_t, char *); 155 void tag_unref(struct pf_tags *, u_int16_t); 156 int pf_rtlabel_add(struct pf_addr_wrap *); 157 void pf_rtlabel_remove(struct pf_addr_wrap *); 158 void pf_rtlabel_copyout(struct pf_addr_wrap *); 159 160 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 161 162 #ifdef __NetBSD__ 163 const struct cdevsw pf_cdevsw = { 164 pfopen, pfclose, noread, nowrite, pfioctl, 165 nostop, notty, nopoll, nommap, nokqfilter, D_OTHER 166 }; 167 168 static int pfil4_wrapper(void *, struct mbuf **, struct ifnet *, int); 169 #ifdef INET6 170 static int pfil6_wrapper(void *, struct mbuf **, struct ifnet *, int); 171 #endif /* INET6 */ 172 173 static int pf_pfil_attach(void); 174 static int pf_pfil_detach(void); 175 176 static int pf_pfil_attached; 177 #endif /* __NetBSD__ */ 178 179 void 180 pfattach(int num) 181 { 182 u_int32_t *timeout = pf_default_rule.timeout; 183 184 #ifdef __NetBSD__ 185 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 186 &pool_allocator_nointr, IPL_NONE); 187 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 188 "pfsrctrpl", NULL, IPL_SOFTNET); 189 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 190 NULL, IPL_SOFTNET); 191 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 192 "pfstatekeypl", NULL, IPL_SOFTNET); 193 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 194 &pool_allocator_nointr, IPL_NONE); 195 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 196 "pfpooladdrpl", &pool_allocator_nointr, IPL_NONE); 197 #else 198 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 199 &pool_allocator_nointr); 200 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 201 "pfsrctrpl", NULL); 202 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 203 NULL); 204 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 205 "pfstatekeypl", NULL); 206 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 207 &pool_allocator_nointr); 208 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 209 "pfpooladdrpl", &pool_allocator_nointr); 210 #endif /* !__NetBSD__ */ 211 212 pfr_initialize(); 213 pfi_initialize(); 214 pf_osfp_initialize(); 215 216 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 217 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 218 219 if (ctob(physmem) <= 100*1024*1024) 220 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit = 221 PFR_KENTRY_HIWAT_SMALL; 222 223 RB_INIT(&tree_src_tracking); 224 RB_INIT(&pf_anchors); 225 pf_init_ruleset(&pf_main_ruleset); 226 TAILQ_INIT(&pf_altqs[0]); 227 TAILQ_INIT(&pf_altqs[1]); 228 TAILQ_INIT(&pf_pabuf); 229 pf_altqs_active = &pf_altqs[0]; 230 pf_altqs_inactive = &pf_altqs[1]; 231 TAILQ_INIT(&state_list); 232 233 #ifdef __NetBSD__ 234 rw_init(&pf_consistency_lock); 235 #endif /* __NetBSD__ */ 236 237 /* default rule should never be garbage collected */ 238 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 239 pf_default_rule.action = PF_PASS; 240 pf_default_rule.nr = -1; 241 pf_default_rule.rtableid = -1; 242 243 /* initialize default timeouts */ 244 timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 245 timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 246 timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 247 timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 248 timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 249 timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 250 timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 251 timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 252 timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 253 timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 254 timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 255 timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 256 timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 257 timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 258 timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 259 timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 260 timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 261 timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 262 timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 263 timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 264 265 pf_normalize_init(); 266 bzero(&pf_status, sizeof(pf_status)); 267 pf_status.debug = PF_DEBUG_URGENT; 268 269 /* XXX do our best to avoid a conflict */ 270 pf_status.hostid = arc4random(); 271 272 /* require process context to purge states, so perform in a thread */ 273 #ifdef __NetBSD__ 274 if (kthread_create(PRI_NONE, 0, NULL, pf_purge_thread, NULL, NULL, 275 "pfpurge")) 276 panic("pfpurge thread"); 277 #else 278 kthread_create_deferred(pf_thread_create, NULL); 279 #endif /* !__NetBSD__ */ 280 } 281 282 #ifndef __NetBSD__ 283 void 284 pf_thread_create(void *v) 285 { 286 if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge")) 287 panic("pfpurge thread"); 288 } 289 #endif /* !__NetBSD__ */ 290 291 int 292 pfopen(dev_t dev, int flags, int fmt, struct lwp *l) 293 { 294 if (minor(dev) >= 1) 295 return (ENXIO); 296 return (0); 297 } 298 299 int 300 pfclose(dev_t dev, int flags, int fmt, struct lwp *l) 301 { 302 if (minor(dev) >= 1) 303 return (ENXIO); 304 return (0); 305 } 306 307 struct pf_pool * 308 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 309 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 310 u_int8_t check_ticket) 311 { 312 struct pf_ruleset *ruleset; 313 struct pf_rule *rule; 314 int rs_num; 315 316 ruleset = pf_find_ruleset(anchor); 317 if (ruleset == NULL) 318 return (NULL); 319 rs_num = pf_get_ruleset_number(rule_action); 320 if (rs_num >= PF_RULESET_MAX) 321 return (NULL); 322 if (active) { 323 if (check_ticket && ticket != 324 ruleset->rules[rs_num].active.ticket) 325 return (NULL); 326 if (r_last) 327 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 328 pf_rulequeue); 329 else 330 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 331 } else { 332 if (check_ticket && ticket != 333 ruleset->rules[rs_num].inactive.ticket) 334 return (NULL); 335 if (r_last) 336 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 337 pf_rulequeue); 338 else 339 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 340 } 341 if (!r_last) { 342 while ((rule != NULL) && (rule->nr != rule_number)) 343 rule = TAILQ_NEXT(rule, entries); 344 } 345 if (rule == NULL) 346 return (NULL); 347 348 return (&rule->rpool); 349 } 350 351 void 352 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 353 { 354 struct pf_pooladdr *mv_pool_pa; 355 356 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 357 TAILQ_REMOVE(poola, mv_pool_pa, entries); 358 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 359 } 360 } 361 362 void 363 pf_empty_pool(struct pf_palist *poola) 364 { 365 struct pf_pooladdr *empty_pool_pa; 366 367 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 368 pfi_dynaddr_remove(&empty_pool_pa->addr); 369 pf_tbladdr_remove(&empty_pool_pa->addr); 370 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE); 371 TAILQ_REMOVE(poola, empty_pool_pa, entries); 372 pool_put(&pf_pooladdr_pl, empty_pool_pa); 373 } 374 } 375 376 void 377 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 378 { 379 if (rulequeue != NULL) { 380 if (rule->states <= 0) { 381 /* 382 * XXX - we need to remove the table *before* detaching 383 * the rule to make sure the table code does not delete 384 * the anchor under our feet. 385 */ 386 pf_tbladdr_remove(&rule->src.addr); 387 pf_tbladdr_remove(&rule->dst.addr); 388 if (rule->overload_tbl) 389 pfr_detach_table(rule->overload_tbl); 390 } 391 TAILQ_REMOVE(rulequeue, rule, entries); 392 rule->entries.tqe_prev = NULL; 393 rule->nr = -1; 394 } 395 396 if (rule->states > 0 || rule->src_nodes > 0 || 397 rule->entries.tqe_prev != NULL) 398 return; 399 pf_tag_unref(rule->tag); 400 pf_tag_unref(rule->match_tag); 401 #ifdef ALTQ 402 if (rule->pqid != rule->qid) 403 pf_qid_unref(rule->pqid); 404 pf_qid_unref(rule->qid); 405 #endif 406 pf_rtlabel_remove(&rule->src.addr); 407 pf_rtlabel_remove(&rule->dst.addr); 408 pfi_dynaddr_remove(&rule->src.addr); 409 pfi_dynaddr_remove(&rule->dst.addr); 410 if (rulequeue == NULL) { 411 pf_tbladdr_remove(&rule->src.addr); 412 pf_tbladdr_remove(&rule->dst.addr); 413 if (rule->overload_tbl) 414 pfr_detach_table(rule->overload_tbl); 415 } 416 pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE); 417 pf_anchor_remove(rule); 418 pf_empty_pool(&rule->rpool.list); 419 pool_put(&pf_rule_pl, rule); 420 } 421 422 u_int16_t 423 tagname2tag(struct pf_tags *head, char *tagname) 424 { 425 struct pf_tagname *tag, *p = NULL; 426 u_int16_t new_tagid = 1; 427 428 TAILQ_FOREACH(tag, head, entries) 429 if (strcmp(tagname, tag->name) == 0) { 430 tag->ref++; 431 return (tag->tag); 432 } 433 434 /* 435 * to avoid fragmentation, we do a linear search from the beginning 436 * and take the first free slot we find. if there is none or the list 437 * is empty, append a new entry at the end. 438 */ 439 440 /* new entry */ 441 if (!TAILQ_EMPTY(head)) 442 for (p = TAILQ_FIRST(head); p != NULL && 443 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 444 new_tagid = p->tag + 1; 445 446 if (new_tagid > TAGID_MAX) 447 return (0); 448 449 /* allocate and fill new struct pf_tagname */ 450 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 451 M_TEMP, M_NOWAIT); 452 if (tag == NULL) 453 return (0); 454 bzero(tag, sizeof(struct pf_tagname)); 455 strlcpy(tag->name, tagname, sizeof(tag->name)); 456 tag->tag = new_tagid; 457 tag->ref++; 458 459 if (p != NULL) /* insert new entry before p */ 460 TAILQ_INSERT_BEFORE(p, tag, entries); 461 else /* either list empty or no free slot in between */ 462 TAILQ_INSERT_TAIL(head, tag, entries); 463 464 return (tag->tag); 465 } 466 467 void 468 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 469 { 470 struct pf_tagname *tag; 471 472 TAILQ_FOREACH(tag, head, entries) 473 if (tag->tag == tagid) { 474 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 475 return; 476 } 477 } 478 479 void 480 tag_unref(struct pf_tags *head, u_int16_t tag) 481 { 482 struct pf_tagname *p, *next; 483 484 if (tag == 0) 485 return; 486 487 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 488 next = TAILQ_NEXT(p, entries); 489 if (tag == p->tag) { 490 if (--p->ref == 0) { 491 TAILQ_REMOVE(head, p, entries); 492 free(p, M_TEMP); 493 } 494 break; 495 } 496 } 497 } 498 499 u_int16_t 500 pf_tagname2tag(char *tagname) 501 { 502 return (tagname2tag(&pf_tags, tagname)); 503 } 504 505 void 506 pf_tag2tagname(u_int16_t tagid, char *p) 507 { 508 tag2tagname(&pf_tags, tagid, p); 509 } 510 511 void 512 pf_tag_ref(u_int16_t tag) 513 { 514 struct pf_tagname *t; 515 516 TAILQ_FOREACH(t, &pf_tags, entries) 517 if (t->tag == tag) 518 break; 519 if (t != NULL) 520 t->ref++; 521 } 522 523 void 524 pf_tag_unref(u_int16_t tag) 525 { 526 tag_unref(&pf_tags, tag); 527 } 528 529 int 530 pf_rtlabel_add(struct pf_addr_wrap *a) 531 { 532 #ifndef __NetBSD__ 533 if (a->type == PF_ADDR_RTLABEL && 534 (a->v.rtlabel = rtlabel_name2id(a->v.rtlabelname)) == 0) 535 return (-1); 536 #endif /* !__NetBSD__ */ 537 return (0); 538 } 539 540 void 541 pf_rtlabel_remove(struct pf_addr_wrap *a) 542 { 543 #ifndef __NetBSD__ 544 if (a->type == PF_ADDR_RTLABEL) 545 rtlabel_unref(a->v.rtlabel); 546 #endif /* !__NetBSD__ */ 547 } 548 549 void 550 pf_rtlabel_copyout(struct pf_addr_wrap *a) 551 { 552 #ifndef __NetBSD__ 553 const char *name; 554 555 if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel) { 556 if ((name = rtlabel_id2name(a->v.rtlabel)) == NULL) 557 strlcpy(a->v.rtlabelname, "?", 558 sizeof(a->v.rtlabelname)); 559 else 560 strlcpy(a->v.rtlabelname, name, 561 sizeof(a->v.rtlabelname)); 562 } 563 #endif /* !__NetBSD__ */ 564 } 565 566 #ifdef ALTQ 567 u_int32_t 568 pf_qname2qid(char *qname) 569 { 570 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 571 } 572 573 void 574 pf_qid2qname(u_int32_t qid, char *p) 575 { 576 tag2tagname(&pf_qids, (u_int16_t)qid, p); 577 } 578 579 void 580 pf_qid_unref(u_int32_t qid) 581 { 582 tag_unref(&pf_qids, (u_int16_t)qid); 583 } 584 585 int 586 pf_begin_altq(u_int32_t *ticket) 587 { 588 struct pf_altq *altq; 589 int error = 0; 590 591 /* Purge the old altq list */ 592 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 593 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 594 if (altq->qname[0] == 0) { 595 /* detach and destroy the discipline */ 596 error = altq_remove(altq); 597 } else 598 pf_qid_unref(altq->qid); 599 pool_put(&pf_altq_pl, altq); 600 } 601 if (error) 602 return (error); 603 *ticket = ++ticket_altqs_inactive; 604 altqs_inactive_open = 1; 605 return (0); 606 } 607 608 int 609 pf_rollback_altq(u_int32_t ticket) 610 { 611 struct pf_altq *altq; 612 int error = 0; 613 614 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 615 return (0); 616 /* Purge the old altq list */ 617 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 618 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 619 if (altq->qname[0] == 0) { 620 /* detach and destroy the discipline */ 621 error = altq_remove(altq); 622 } else 623 pf_qid_unref(altq->qid); 624 pool_put(&pf_altq_pl, altq); 625 } 626 altqs_inactive_open = 0; 627 return (error); 628 } 629 630 int 631 pf_commit_altq(u_int32_t ticket) 632 { 633 struct pf_altqqueue *old_altqs; 634 struct pf_altq *altq; 635 int s, err, error = 0; 636 637 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 638 return (EBUSY); 639 640 /* swap altqs, keep the old. */ 641 s = splsoftnet(); 642 old_altqs = pf_altqs_active; 643 pf_altqs_active = pf_altqs_inactive; 644 pf_altqs_inactive = old_altqs; 645 ticket_altqs_active = ticket_altqs_inactive; 646 647 /* Attach new disciplines */ 648 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 649 if (altq->qname[0] == 0) { 650 /* attach the discipline */ 651 error = altq_pfattach(altq); 652 if (error == 0 && pf_altq_running) 653 error = pf_enable_altq(altq); 654 if (error != 0) { 655 splx(s); 656 return (error); 657 } 658 } 659 } 660 661 /* Purge the old altq list */ 662 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 663 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 664 if (altq->qname[0] == 0) { 665 /* detach and destroy the discipline */ 666 if (pf_altq_running) 667 error = pf_disable_altq(altq); 668 err = altq_pfdetach(altq); 669 if (err != 0 && error == 0) 670 error = err; 671 err = altq_remove(altq); 672 if (err != 0 && error == 0) 673 error = err; 674 } else 675 pf_qid_unref(altq->qid); 676 pool_put(&pf_altq_pl, altq); 677 } 678 splx(s); 679 680 altqs_inactive_open = 0; 681 return (error); 682 } 683 684 int 685 pf_enable_altq(struct pf_altq *altq) 686 { 687 struct ifnet *ifp; 688 struct tb_profile tb; 689 int s, error = 0; 690 691 if ((ifp = ifunit(altq->ifname)) == NULL) 692 return (EINVAL); 693 694 if (ifp->if_snd.altq_type != ALTQT_NONE) 695 error = altq_enable(&ifp->if_snd); 696 697 /* set tokenbucket regulator */ 698 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 699 tb.rate = altq->ifbandwidth; 700 tb.depth = altq->tbrsize; 701 s = splnet(); 702 error = tbr_set(&ifp->if_snd, &tb); 703 splx(s); 704 } 705 706 return (error); 707 } 708 709 int 710 pf_disable_altq(struct pf_altq *altq) 711 { 712 struct ifnet *ifp; 713 struct tb_profile tb; 714 int s, error; 715 716 if ((ifp = ifunit(altq->ifname)) == NULL) 717 return (EINVAL); 718 719 /* 720 * when the discipline is no longer referenced, it was overridden 721 * by a new one. if so, just return. 722 */ 723 if (altq->altq_disc != ifp->if_snd.altq_disc) 724 return (0); 725 726 error = altq_disable(&ifp->if_snd); 727 728 if (error == 0) { 729 /* clear tokenbucket regulator */ 730 tb.rate = 0; 731 s = splnet(); 732 error = tbr_set(&ifp->if_snd, &tb); 733 splx(s); 734 } 735 736 return (error); 737 } 738 #endif /* ALTQ */ 739 740 int 741 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 742 { 743 struct pf_ruleset *rs; 744 struct pf_rule *rule; 745 746 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 747 return (EINVAL); 748 rs = pf_find_or_create_ruleset(anchor); 749 if (rs == NULL) 750 return (EINVAL); 751 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 752 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 753 rs->rules[rs_num].inactive.rcount--; 754 } 755 *ticket = ++rs->rules[rs_num].inactive.ticket; 756 rs->rules[rs_num].inactive.open = 1; 757 return (0); 758 } 759 760 int 761 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 762 { 763 struct pf_ruleset *rs; 764 struct pf_rule *rule; 765 766 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 767 return (EINVAL); 768 rs = pf_find_ruleset(anchor); 769 if (rs == NULL || !rs->rules[rs_num].inactive.open || 770 rs->rules[rs_num].inactive.ticket != ticket) 771 return (0); 772 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 773 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 774 rs->rules[rs_num].inactive.rcount--; 775 } 776 rs->rules[rs_num].inactive.open = 0; 777 return (0); 778 } 779 780 #define PF_MD5_UPD(st, elm) \ 781 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 782 783 #define PF_MD5_UPD_STR(st, elm) \ 784 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 785 786 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 787 (stor) = htonl((st)->elm); \ 788 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 789 } while (0) 790 791 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 792 (stor) = htons((st)->elm); \ 793 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 794 } while (0) 795 796 void 797 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 798 { 799 PF_MD5_UPD(pfr, addr.type); 800 switch (pfr->addr.type) { 801 case PF_ADDR_DYNIFTL: 802 PF_MD5_UPD(pfr, addr.v.ifname); 803 PF_MD5_UPD(pfr, addr.iflags); 804 break; 805 case PF_ADDR_TABLE: 806 PF_MD5_UPD(pfr, addr.v.tblname); 807 break; 808 case PF_ADDR_ADDRMASK: 809 /* XXX ignore af? */ 810 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 811 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 812 break; 813 case PF_ADDR_RTLABEL: 814 PF_MD5_UPD(pfr, addr.v.rtlabelname); 815 break; 816 } 817 818 PF_MD5_UPD(pfr, port[0]); 819 PF_MD5_UPD(pfr, port[1]); 820 PF_MD5_UPD(pfr, neg); 821 PF_MD5_UPD(pfr, port_op); 822 } 823 824 void 825 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule) 826 { 827 u_int16_t x; 828 u_int32_t y; 829 830 pf_hash_rule_addr(ctx, &rule->src); 831 pf_hash_rule_addr(ctx, &rule->dst); 832 PF_MD5_UPD_STR(rule, label); 833 PF_MD5_UPD_STR(rule, ifname); 834 PF_MD5_UPD_STR(rule, match_tagname); 835 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 836 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 837 PF_MD5_UPD_HTONL(rule, prob, y); 838 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 839 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 840 PF_MD5_UPD(rule, uid.op); 841 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 842 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 843 PF_MD5_UPD(rule, gid.op); 844 PF_MD5_UPD_HTONL(rule, rule_flag, y); 845 PF_MD5_UPD(rule, action); 846 PF_MD5_UPD(rule, direction); 847 PF_MD5_UPD(rule, af); 848 PF_MD5_UPD(rule, quick); 849 PF_MD5_UPD(rule, ifnot); 850 PF_MD5_UPD(rule, match_tag_not); 851 PF_MD5_UPD(rule, natpass); 852 PF_MD5_UPD(rule, keep_state); 853 PF_MD5_UPD(rule, proto); 854 PF_MD5_UPD(rule, type); 855 PF_MD5_UPD(rule, code); 856 PF_MD5_UPD(rule, flags); 857 PF_MD5_UPD(rule, flagset); 858 PF_MD5_UPD(rule, allow_opts); 859 PF_MD5_UPD(rule, rt); 860 PF_MD5_UPD(rule, tos); 861 } 862 863 int 864 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 865 { 866 struct pf_ruleset *rs; 867 struct pf_rule *rule, **old_array; 868 struct pf_rulequeue *old_rules; 869 int s, error; 870 u_int32_t old_rcount; 871 872 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 873 return (EINVAL); 874 rs = pf_find_ruleset(anchor); 875 if (rs == NULL || !rs->rules[rs_num].inactive.open || 876 ticket != rs->rules[rs_num].inactive.ticket) 877 return (EBUSY); 878 879 /* Calculate checksum for the main ruleset */ 880 if (rs == &pf_main_ruleset) { 881 error = pf_setup_pfsync_matching(rs); 882 if (error != 0) 883 return (error); 884 } 885 886 /* Swap rules, keep the old. */ 887 s = splsoftnet(); 888 old_rules = rs->rules[rs_num].active.ptr; 889 old_rcount = rs->rules[rs_num].active.rcount; 890 old_array = rs->rules[rs_num].active.ptr_array; 891 892 rs->rules[rs_num].active.ptr = 893 rs->rules[rs_num].inactive.ptr; 894 rs->rules[rs_num].active.ptr_array = 895 rs->rules[rs_num].inactive.ptr_array; 896 rs->rules[rs_num].active.rcount = 897 rs->rules[rs_num].inactive.rcount; 898 rs->rules[rs_num].inactive.ptr = old_rules; 899 rs->rules[rs_num].inactive.ptr_array = old_array; 900 rs->rules[rs_num].inactive.rcount = old_rcount; 901 902 rs->rules[rs_num].active.ticket = 903 rs->rules[rs_num].inactive.ticket; 904 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 905 906 907 /* Purge the old rule list. */ 908 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 909 pf_rm_rule(old_rules, rule); 910 if (rs->rules[rs_num].inactive.ptr_array) 911 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 912 rs->rules[rs_num].inactive.ptr_array = NULL; 913 rs->rules[rs_num].inactive.rcount = 0; 914 rs->rules[rs_num].inactive.open = 0; 915 pf_remove_if_empty_ruleset(rs); 916 splx(s); 917 return (0); 918 } 919 920 void 921 pf_state_export(struct pfsync_state *sp, struct pf_state_key *sk, 922 struct pf_state *s) 923 { 924 int secs = time_second; 925 bzero(sp, sizeof(struct pfsync_state)); 926 927 /* copy from state key */ 928 sp->lan.addr = sk->lan.addr; 929 sp->lan.port = sk->lan.port; 930 sp->gwy.addr = sk->gwy.addr; 931 sp->gwy.port = sk->gwy.port; 932 sp->ext.addr = sk->ext.addr; 933 sp->ext.port = sk->ext.port; 934 sp->proto = sk->proto; 935 sp->af = sk->af; 936 sp->direction = sk->direction; 937 938 /* copy from state */ 939 memcpy(&sp->id, &s->id, sizeof(sp->id)); 940 sp->creatorid = s->creatorid; 941 strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname)); 942 pf_state_peer_to_pfsync(&s->src, &sp->src); 943 pf_state_peer_to_pfsync(&s->dst, &sp->dst); 944 945 sp->rule = s->rule.ptr->nr; 946 sp->nat_rule = (s->nat_rule.ptr == NULL) ? -1 : s->nat_rule.ptr->nr; 947 sp->anchor = (s->anchor.ptr == NULL) ? -1 : s->anchor.ptr->nr; 948 949 pf_state_counter_to_pfsync(s->bytes[0], sp->bytes[0]); 950 pf_state_counter_to_pfsync(s->bytes[1], sp->bytes[1]); 951 pf_state_counter_to_pfsync(s->packets[0], sp->packets[0]); 952 pf_state_counter_to_pfsync(s->packets[1], sp->packets[1]); 953 sp->creation = secs - s->creation; 954 sp->expire = pf_state_expires(s); 955 sp->log = s->log; 956 sp->allow_opts = s->allow_opts; 957 sp->timeout = s->timeout; 958 959 if (s->src_node) 960 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 961 if (s->nat_src_node) 962 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 963 964 if (sp->expire > secs) 965 sp->expire -= secs; 966 else 967 sp->expire = 0; 968 969 } 970 971 void 972 pf_state_import(struct pfsync_state *sp, struct pf_state_key *sk, 973 struct pf_state *s) 974 { 975 /* copy to state key */ 976 sk->lan.addr = sp->lan.addr; 977 sk->lan.port = sp->lan.port; 978 sk->gwy.addr = sp->gwy.addr; 979 sk->gwy.port = sp->gwy.port; 980 sk->ext.addr = sp->ext.addr; 981 sk->ext.port = sp->ext.port; 982 sk->proto = sp->proto; 983 sk->af = sp->af; 984 sk->direction = sp->direction; 985 986 /* copy to state */ 987 memcpy(&s->id, &sp->id, sizeof(sp->id)); 988 s->creatorid = sp->creatorid; 989 strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname)); 990 pf_state_peer_from_pfsync(&sp->src, &s->src); 991 pf_state_peer_from_pfsync(&sp->dst, &s->dst); 992 993 s->rule.ptr = &pf_default_rule; 994 s->nat_rule.ptr = NULL; 995 s->anchor.ptr = NULL; 996 s->rt_kif = NULL; 997 s->creation = time_second; 998 s->pfsync_time = 0; 999 s->packets[0] = s->packets[1] = 0; 1000 s->bytes[0] = s->bytes[1] = 0; 1001 } 1002 1003 int 1004 pf_setup_pfsync_matching(struct pf_ruleset *rs) 1005 { 1006 MD5_CTX ctx; 1007 struct pf_rule *rule; 1008 int rs_cnt; 1009 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 1010 1011 MD5Init(&ctx); 1012 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 1013 /* XXX PF_RULESET_SCRUB as well? */ 1014 if (rs_cnt == PF_RULESET_SCRUB) 1015 continue; 1016 1017 if (rs->rules[rs_cnt].inactive.ptr_array) 1018 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 1019 rs->rules[rs_cnt].inactive.ptr_array = NULL; 1020 1021 if (rs->rules[rs_cnt].inactive.rcount) { 1022 rs->rules[rs_cnt].inactive.ptr_array = 1023 malloc(sizeof(void *) * 1024 rs->rules[rs_cnt].inactive.rcount, 1025 M_TEMP, M_NOWAIT); 1026 1027 if (!rs->rules[rs_cnt].inactive.ptr_array) 1028 return (ENOMEM); 1029 } 1030 1031 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 1032 entries) { 1033 pf_hash_rule(&ctx, rule); 1034 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 1035 } 1036 } 1037 1038 MD5Final(digest, &ctx); 1039 memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum)); 1040 return (0); 1041 } 1042 1043 int 1044 pfioctl(dev_t dev, u_long cmd, void *addr, int flags, struct lwp *l) 1045 { 1046 struct pf_pooladdr *pa = NULL; 1047 struct pf_pool *pool = NULL; 1048 int s; 1049 int error = 0; 1050 1051 /* XXX keep in sync with switch() below */ 1052 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 1053 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) 1054 switch (cmd) { 1055 case DIOCGETRULES: 1056 case DIOCGETRULE: 1057 case DIOCGETADDRS: 1058 case DIOCGETADDR: 1059 case DIOCGETSTATE: 1060 case DIOCSETSTATUSIF: 1061 case DIOCGETSTATUS: 1062 case DIOCCLRSTATUS: 1063 case DIOCNATLOOK: 1064 case DIOCSETDEBUG: 1065 case DIOCGETSTATES: 1066 case DIOCGETTIMEOUT: 1067 case DIOCCLRRULECTRS: 1068 case DIOCGETLIMIT: 1069 case DIOCGETALTQS: 1070 case DIOCGETALTQ: 1071 case DIOCGETQSTATS: 1072 case DIOCGETRULESETS: 1073 case DIOCGETRULESET: 1074 case DIOCRGETTABLES: 1075 case DIOCRGETTSTATS: 1076 case DIOCRCLRTSTATS: 1077 case DIOCRCLRADDRS: 1078 case DIOCRADDADDRS: 1079 case DIOCRDELADDRS: 1080 case DIOCRSETADDRS: 1081 case DIOCRGETADDRS: 1082 case DIOCRGETASTATS: 1083 case DIOCRCLRASTATS: 1084 case DIOCRTSTADDRS: 1085 case DIOCOSFPGET: 1086 case DIOCGETSRCNODES: 1087 case DIOCCLRSRCNODES: 1088 case DIOCIGETIFACES: 1089 case DIOCSETIFFLAG: 1090 case DIOCCLRIFFLAG: 1091 break; 1092 case DIOCRCLRTABLES: 1093 case DIOCRADDTABLES: 1094 case DIOCRDELTABLES: 1095 case DIOCRSETTFLAGS: 1096 if (((struct pfioc_table *)addr)->pfrio_flags & 1097 PFR_FLAG_DUMMY) 1098 break; /* dummy operation ok */ 1099 return (EPERM); 1100 default: 1101 return (EPERM); 1102 } 1103 1104 if (!(flags & FWRITE)) 1105 switch (cmd) { 1106 case DIOCGETRULES: 1107 case DIOCGETADDRS: 1108 case DIOCGETADDR: 1109 case DIOCGETSTATE: 1110 case DIOCGETSTATUS: 1111 case DIOCGETSTATES: 1112 case DIOCGETTIMEOUT: 1113 case DIOCGETLIMIT: 1114 case DIOCGETALTQS: 1115 case DIOCGETALTQ: 1116 case DIOCGETQSTATS: 1117 case DIOCGETRULESETS: 1118 case DIOCGETRULESET: 1119 case DIOCNATLOOK: 1120 case DIOCRGETTABLES: 1121 case DIOCRGETTSTATS: 1122 case DIOCRGETADDRS: 1123 case DIOCRGETASTATS: 1124 case DIOCRTSTADDRS: 1125 case DIOCOSFPGET: 1126 case DIOCGETSRCNODES: 1127 case DIOCIGETIFACES: 1128 break; 1129 case DIOCRCLRTABLES: 1130 case DIOCRADDTABLES: 1131 case DIOCRDELTABLES: 1132 case DIOCRCLRTSTATS: 1133 case DIOCRCLRADDRS: 1134 case DIOCRADDADDRS: 1135 case DIOCRDELADDRS: 1136 case DIOCRSETADDRS: 1137 case DIOCRSETTFLAGS: 1138 if (((struct pfioc_table *)addr)->pfrio_flags & 1139 PFR_FLAG_DUMMY) { 1140 flags |= FWRITE; /* need write lock for dummy */ 1141 break; /* dummy operation ok */ 1142 } 1143 return (EACCES); 1144 case DIOCGETRULE: 1145 if (((struct pfioc_rule *)addr)->action == PF_GET_CLR_CNTR) 1146 return (EACCES); 1147 break; 1148 default: 1149 return (EACCES); 1150 } 1151 1152 if (flags & FWRITE) 1153 rw_enter_write(&pf_consistency_lock); 1154 else 1155 rw_enter_read(&pf_consistency_lock); 1156 1157 s = splsoftnet(); 1158 switch (cmd) { 1159 1160 case DIOCSTART: 1161 if (pf_status.running) 1162 error = EEXIST; 1163 else { 1164 #ifdef __NetBSD__ 1165 error = pf_pfil_attach(); 1166 if (error) 1167 break; 1168 #endif /* __NetBSD__ */ 1169 pf_status.running = 1; 1170 pf_status.since = time_second; 1171 if (pf_status.stateid == 0) { 1172 pf_status.stateid = time_second; 1173 pf_status.stateid = pf_status.stateid << 32; 1174 } 1175 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1176 } 1177 break; 1178 1179 case DIOCSTOP: 1180 if (!pf_status.running) 1181 error = ENOENT; 1182 else { 1183 #ifdef __NetBSD__ 1184 error = pf_pfil_detach(); 1185 if (error) 1186 break; 1187 #endif /* __NetBSD__ */ 1188 pf_status.running = 0; 1189 pf_status.since = time_second; 1190 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1191 } 1192 break; 1193 1194 case DIOCADDRULE: { 1195 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1196 struct pf_ruleset *ruleset; 1197 struct pf_rule *rule, *tail; 1198 struct pf_pooladdr *pa; 1199 int rs_num; 1200 1201 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1202 ruleset = pf_find_ruleset(pr->anchor); 1203 if (ruleset == NULL) { 1204 error = EINVAL; 1205 break; 1206 } 1207 rs_num = pf_get_ruleset_number(pr->rule.action); 1208 if (rs_num >= PF_RULESET_MAX) { 1209 error = EINVAL; 1210 break; 1211 } 1212 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1213 error = EINVAL; 1214 break; 1215 } 1216 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1217 error = EBUSY; 1218 break; 1219 } 1220 if (pr->pool_ticket != ticket_pabuf) { 1221 error = EBUSY; 1222 break; 1223 } 1224 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1225 if (rule == NULL) { 1226 error = ENOMEM; 1227 break; 1228 } 1229 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1230 #ifdef __NetBSD__ 1231 rule->cuid = kauth_cred_getuid(l->l_cred); 1232 rule->cpid = l->l_proc->p_pid; 1233 #else 1234 rule->cuid = p->p_cred->p_ruid; 1235 rule->cpid = p->p_pid; 1236 #endif /* !__NetBSD__ */ 1237 rule->anchor = NULL; 1238 rule->kif = NULL; 1239 TAILQ_INIT(&rule->rpool.list); 1240 /* initialize refcounting */ 1241 rule->states = 0; 1242 rule->src_nodes = 0; 1243 rule->entries.tqe_prev = NULL; 1244 #ifndef INET 1245 if (rule->af == AF_INET) { 1246 pool_put(&pf_rule_pl, rule); 1247 error = EAFNOSUPPORT; 1248 break; 1249 } 1250 #endif /* INET */ 1251 #ifndef INET6 1252 if (rule->af == AF_INET6) { 1253 pool_put(&pf_rule_pl, rule); 1254 error = EAFNOSUPPORT; 1255 break; 1256 } 1257 #endif /* INET6 */ 1258 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1259 pf_rulequeue); 1260 if (tail) 1261 rule->nr = tail->nr + 1; 1262 else 1263 rule->nr = 0; 1264 if (rule->ifname[0]) { 1265 rule->kif = pfi_kif_get(rule->ifname); 1266 if (rule->kif == NULL) { 1267 pool_put(&pf_rule_pl, rule); 1268 error = EINVAL; 1269 break; 1270 } 1271 pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE); 1272 } 1273 1274 #ifndef __NetBSD__ 1275 if (rule->rtableid > 0 && !rtable_exists(rule->rtableid)) 1276 error = EBUSY; 1277 #endif /* !__NetBSD__ */ 1278 1279 #ifdef ALTQ 1280 /* set queue IDs */ 1281 if (rule->qname[0] != 0) { 1282 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1283 error = EBUSY; 1284 else if (rule->pqname[0] != 0) { 1285 if ((rule->pqid = 1286 pf_qname2qid(rule->pqname)) == 0) 1287 error = EBUSY; 1288 } else 1289 rule->pqid = rule->qid; 1290 } 1291 #endif 1292 if (rule->tagname[0]) 1293 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1294 error = EBUSY; 1295 if (rule->match_tagname[0]) 1296 if ((rule->match_tag = 1297 pf_tagname2tag(rule->match_tagname)) == 0) 1298 error = EBUSY; 1299 if (rule->rt && !rule->direction) 1300 error = EINVAL; 1301 #if NPFLOG > 0 1302 if (!rule->log) 1303 rule->logif = 0; 1304 if (rule->logif >= PFLOGIFS_MAX) 1305 error = EINVAL; 1306 #endif 1307 if (pf_rtlabel_add(&rule->src.addr) || 1308 pf_rtlabel_add(&rule->dst.addr)) 1309 error = EBUSY; 1310 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1311 error = EINVAL; 1312 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1313 error = EINVAL; 1314 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1315 error = EINVAL; 1316 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1317 error = EINVAL; 1318 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1319 error = EINVAL; 1320 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1321 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1322 error = EINVAL; 1323 1324 if (rule->overload_tblname[0]) { 1325 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1326 rule->overload_tblname)) == NULL) 1327 error = EINVAL; 1328 else 1329 rule->overload_tbl->pfrkt_flags |= 1330 PFR_TFLAG_ACTIVE; 1331 } 1332 1333 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1334 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1335 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1336 (rule->rt > PF_FASTROUTE)) && 1337 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1338 error = EINVAL; 1339 1340 if (error) { 1341 pf_rm_rule(NULL, rule); 1342 break; 1343 } 1344 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1345 rule->evaluations = rule->packets[0] = rule->packets[1] = 1346 rule->bytes[0] = rule->bytes[1] = 0; 1347 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1348 rule, entries); 1349 ruleset->rules[rs_num].inactive.rcount++; 1350 break; 1351 } 1352 1353 case DIOCGETRULES: { 1354 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1355 struct pf_ruleset *ruleset; 1356 struct pf_rule *tail; 1357 int rs_num; 1358 1359 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1360 ruleset = pf_find_ruleset(pr->anchor); 1361 if (ruleset == NULL) { 1362 error = EINVAL; 1363 break; 1364 } 1365 rs_num = pf_get_ruleset_number(pr->rule.action); 1366 if (rs_num >= PF_RULESET_MAX) { 1367 error = EINVAL; 1368 break; 1369 } 1370 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1371 pf_rulequeue); 1372 if (tail) 1373 pr->nr = tail->nr + 1; 1374 else 1375 pr->nr = 0; 1376 pr->ticket = ruleset->rules[rs_num].active.ticket; 1377 break; 1378 } 1379 1380 case DIOCGETRULE: { 1381 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1382 struct pf_ruleset *ruleset; 1383 struct pf_rule *rule; 1384 int rs_num, i; 1385 1386 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1387 ruleset = pf_find_ruleset(pr->anchor); 1388 if (ruleset == NULL) { 1389 error = EINVAL; 1390 break; 1391 } 1392 rs_num = pf_get_ruleset_number(pr->rule.action); 1393 if (rs_num >= PF_RULESET_MAX) { 1394 error = EINVAL; 1395 break; 1396 } 1397 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1398 error = EBUSY; 1399 break; 1400 } 1401 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1402 while ((rule != NULL) && (rule->nr != pr->nr)) 1403 rule = TAILQ_NEXT(rule, entries); 1404 if (rule == NULL) { 1405 error = EBUSY; 1406 break; 1407 } 1408 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1409 if (pf_anchor_copyout(ruleset, rule, pr)) { 1410 error = EBUSY; 1411 break; 1412 } 1413 pfi_dynaddr_copyout(&pr->rule.src.addr); 1414 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1415 pf_tbladdr_copyout(&pr->rule.src.addr); 1416 pf_tbladdr_copyout(&pr->rule.dst.addr); 1417 pf_rtlabel_copyout(&pr->rule.src.addr); 1418 pf_rtlabel_copyout(&pr->rule.dst.addr); 1419 for (i = 0; i < PF_SKIP_COUNT; ++i) 1420 if (rule->skip[i].ptr == NULL) 1421 pr->rule.skip[i].nr = -1; 1422 else 1423 pr->rule.skip[i].nr = 1424 rule->skip[i].ptr->nr; 1425 1426 if (pr->action == PF_GET_CLR_CNTR) { 1427 rule->evaluations = 0; 1428 rule->packets[0] = rule->packets[1] = 0; 1429 rule->bytes[0] = rule->bytes[1] = 0; 1430 } 1431 break; 1432 } 1433 1434 case DIOCCHANGERULE: { 1435 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1436 struct pf_ruleset *ruleset; 1437 struct pf_rule *oldrule = NULL, *newrule = NULL; 1438 u_int32_t nr = 0; 1439 int rs_num; 1440 1441 if (!(pcr->action == PF_CHANGE_REMOVE || 1442 pcr->action == PF_CHANGE_GET_TICKET) && 1443 pcr->pool_ticket != ticket_pabuf) { 1444 error = EBUSY; 1445 break; 1446 } 1447 1448 if (pcr->action < PF_CHANGE_ADD_HEAD || 1449 pcr->action > PF_CHANGE_GET_TICKET) { 1450 error = EINVAL; 1451 break; 1452 } 1453 ruleset = pf_find_ruleset(pcr->anchor); 1454 if (ruleset == NULL) { 1455 error = EINVAL; 1456 break; 1457 } 1458 rs_num = pf_get_ruleset_number(pcr->rule.action); 1459 if (rs_num >= PF_RULESET_MAX) { 1460 error = EINVAL; 1461 break; 1462 } 1463 1464 if (pcr->action == PF_CHANGE_GET_TICKET) { 1465 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1466 break; 1467 } else { 1468 if (pcr->ticket != 1469 ruleset->rules[rs_num].active.ticket) { 1470 error = EINVAL; 1471 break; 1472 } 1473 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1474 error = EINVAL; 1475 break; 1476 } 1477 } 1478 1479 if (pcr->action != PF_CHANGE_REMOVE) { 1480 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1481 if (newrule == NULL) { 1482 error = ENOMEM; 1483 break; 1484 } 1485 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1486 #ifdef __NetBSD__ 1487 newrule->cuid = kauth_cred_getuid(l->l_cred); 1488 newrule->cpid = l->l_proc->p_pid; 1489 #else 1490 newrule->cuid = p->p_cred->p_ruid; 1491 newrule->cpid = p->p_pid; 1492 #endif /* !__NetBSD__ */ 1493 TAILQ_INIT(&newrule->rpool.list); 1494 /* initialize refcounting */ 1495 newrule->states = 0; 1496 newrule->entries.tqe_prev = NULL; 1497 #ifndef INET 1498 if (newrule->af == AF_INET) { 1499 pool_put(&pf_rule_pl, newrule); 1500 error = EAFNOSUPPORT; 1501 break; 1502 } 1503 #endif /* INET */ 1504 #ifndef INET6 1505 if (newrule->af == AF_INET6) { 1506 pool_put(&pf_rule_pl, newrule); 1507 error = EAFNOSUPPORT; 1508 break; 1509 } 1510 #endif /* INET6 */ 1511 if (newrule->ifname[0]) { 1512 newrule->kif = pfi_kif_get(newrule->ifname); 1513 if (newrule->kif == NULL) { 1514 pool_put(&pf_rule_pl, newrule); 1515 error = EINVAL; 1516 break; 1517 } 1518 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE); 1519 } else 1520 newrule->kif = NULL; 1521 1522 #ifndef __NetBSD__ 1523 if (newrule->rtableid > 0 && 1524 !rtable_exists(newrule->rtableid)) 1525 error = EBUSY; 1526 #endif /* !__NetBSD__ */ 1527 1528 #ifdef ALTQ 1529 /* set queue IDs */ 1530 if (newrule->qname[0] != 0) { 1531 if ((newrule->qid = 1532 pf_qname2qid(newrule->qname)) == 0) 1533 error = EBUSY; 1534 else if (newrule->pqname[0] != 0) { 1535 if ((newrule->pqid = 1536 pf_qname2qid(newrule->pqname)) == 0) 1537 error = EBUSY; 1538 } else 1539 newrule->pqid = newrule->qid; 1540 } 1541 #endif /* ALTQ */ 1542 if (newrule->tagname[0]) 1543 if ((newrule->tag = 1544 pf_tagname2tag(newrule->tagname)) == 0) 1545 error = EBUSY; 1546 if (newrule->match_tagname[0]) 1547 if ((newrule->match_tag = pf_tagname2tag( 1548 newrule->match_tagname)) == 0) 1549 error = EBUSY; 1550 if (newrule->rt && !newrule->direction) 1551 error = EINVAL; 1552 #if NPFLOG > 0 1553 if (!newrule->log) 1554 newrule->logif = 0; 1555 if (newrule->logif >= PFLOGIFS_MAX) 1556 error = EINVAL; 1557 #endif 1558 if (pf_rtlabel_add(&newrule->src.addr) || 1559 pf_rtlabel_add(&newrule->dst.addr)) 1560 error = EBUSY; 1561 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1562 error = EINVAL; 1563 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1564 error = EINVAL; 1565 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1566 error = EINVAL; 1567 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1568 error = EINVAL; 1569 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1570 error = EINVAL; 1571 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1572 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1573 error = EINVAL; 1574 1575 if (newrule->overload_tblname[0]) { 1576 if ((newrule->overload_tbl = pfr_attach_table( 1577 ruleset, newrule->overload_tblname)) == 1578 NULL) 1579 error = EINVAL; 1580 else 1581 newrule->overload_tbl->pfrkt_flags |= 1582 PFR_TFLAG_ACTIVE; 1583 } 1584 1585 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1586 if (((((newrule->action == PF_NAT) || 1587 (newrule->action == PF_RDR) || 1588 (newrule->action == PF_BINAT) || 1589 (newrule->rt > PF_FASTROUTE)) && 1590 !newrule->anchor)) && 1591 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1592 error = EINVAL; 1593 1594 if (error) { 1595 pf_rm_rule(NULL, newrule); 1596 break; 1597 } 1598 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1599 newrule->evaluations = 0; 1600 newrule->packets[0] = newrule->packets[1] = 0; 1601 newrule->bytes[0] = newrule->bytes[1] = 0; 1602 } 1603 pf_empty_pool(&pf_pabuf); 1604 1605 if (pcr->action == PF_CHANGE_ADD_HEAD) 1606 oldrule = TAILQ_FIRST( 1607 ruleset->rules[rs_num].active.ptr); 1608 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1609 oldrule = TAILQ_LAST( 1610 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1611 else { 1612 oldrule = TAILQ_FIRST( 1613 ruleset->rules[rs_num].active.ptr); 1614 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1615 oldrule = TAILQ_NEXT(oldrule, entries); 1616 if (oldrule == NULL) { 1617 if (newrule != NULL) 1618 pf_rm_rule(NULL, newrule); 1619 error = EINVAL; 1620 break; 1621 } 1622 } 1623 1624 if (pcr->action == PF_CHANGE_REMOVE) { 1625 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1626 ruleset->rules[rs_num].active.rcount--; 1627 } else { 1628 if (oldrule == NULL) 1629 TAILQ_INSERT_TAIL( 1630 ruleset->rules[rs_num].active.ptr, 1631 newrule, entries); 1632 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1633 pcr->action == PF_CHANGE_ADD_BEFORE) 1634 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1635 else 1636 TAILQ_INSERT_AFTER( 1637 ruleset->rules[rs_num].active.ptr, 1638 oldrule, newrule, entries); 1639 ruleset->rules[rs_num].active.rcount++; 1640 } 1641 1642 nr = 0; 1643 TAILQ_FOREACH(oldrule, 1644 ruleset->rules[rs_num].active.ptr, entries) 1645 oldrule->nr = nr++; 1646 1647 ruleset->rules[rs_num].active.ticket++; 1648 1649 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1650 pf_remove_if_empty_ruleset(ruleset); 1651 1652 break; 1653 } 1654 1655 case DIOCCLRSTATES: { 1656 struct pf_state *s, *nexts; 1657 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1658 int killed = 0; 1659 1660 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) { 1661 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s); 1662 1663 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1664 s->kif->pfik_name)) { 1665 #if NPFSYNC 1666 /* don't send out individual delete messages */ 1667 s->sync_flags = PFSTATE_NOSYNC; 1668 #endif 1669 pf_unlink_state(s); 1670 killed++; 1671 } 1672 } 1673 psk->psk_af = killed; 1674 #if NPFSYNC 1675 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1676 #endif 1677 break; 1678 } 1679 1680 case DIOCKILLSTATES: { 1681 struct pf_state *s, *nexts; 1682 struct pf_state_key *sk; 1683 struct pf_state_host *src, *dst; 1684 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1685 int killed = 0; 1686 1687 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; 1688 s = nexts) { 1689 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s); 1690 sk = s->state_key; 1691 1692 if (sk->direction == PF_OUT) { 1693 src = &sk->lan; 1694 dst = &sk->ext; 1695 } else { 1696 src = &sk->ext; 1697 dst = &sk->lan; 1698 } 1699 if ((!psk->psk_af || sk->af == psk->psk_af) 1700 && (!psk->psk_proto || psk->psk_proto == 1701 sk->proto) && 1702 PF_MATCHA(psk->psk_src.neg, 1703 &psk->psk_src.addr.v.a.addr, 1704 &psk->psk_src.addr.v.a.mask, 1705 &src->addr, sk->af) && 1706 PF_MATCHA(psk->psk_dst.neg, 1707 &psk->psk_dst.addr.v.a.addr, 1708 &psk->psk_dst.addr.v.a.mask, 1709 &dst->addr, sk->af) && 1710 (psk->psk_src.port_op == 0 || 1711 pf_match_port(psk->psk_src.port_op, 1712 psk->psk_src.port[0], psk->psk_src.port[1], 1713 src->port)) && 1714 (psk->psk_dst.port_op == 0 || 1715 pf_match_port(psk->psk_dst.port_op, 1716 psk->psk_dst.port[0], psk->psk_dst.port[1], 1717 dst->port)) && 1718 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1719 s->kif->pfik_name))) { 1720 #if NPFSYNC > 0 1721 /* send immediate delete of state */ 1722 pfsync_delete_state(s); 1723 s->sync_flags |= PFSTATE_NOSYNC; 1724 #endif 1725 pf_unlink_state(s); 1726 killed++; 1727 } 1728 } 1729 psk->psk_af = killed; 1730 break; 1731 } 1732 1733 case DIOCADDSTATE: { 1734 struct pfioc_state *ps = (struct pfioc_state *)addr; 1735 struct pfsync_state *sp = (struct pfsync_state *)ps->state; 1736 struct pf_state *s; 1737 struct pf_state_key *sk; 1738 struct pfi_kif *kif; 1739 1740 if (sp->timeout >= PFTM_MAX && 1741 sp->timeout != PFTM_UNTIL_PACKET) { 1742 error = EINVAL; 1743 break; 1744 } 1745 s = pool_get(&pf_state_pl, PR_NOWAIT); 1746 if (s == NULL) { 1747 error = ENOMEM; 1748 break; 1749 } 1750 bzero(s, sizeof(struct pf_state)); 1751 if ((sk = pf_alloc_state_key(s)) == NULL) { 1752 error = ENOMEM; 1753 break; 1754 } 1755 pf_state_import(sp, sk, s); 1756 kif = pfi_kif_get(sp->ifname); 1757 if (kif == NULL) { 1758 pool_put(&pf_state_pl, s); 1759 pool_put(&pf_state_key_pl, sk); 1760 error = ENOENT; 1761 break; 1762 } 1763 if (pf_insert_state(kif, s)) { 1764 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 1765 pool_put(&pf_state_pl, s); 1766 pool_put(&pf_state_key_pl, sk); 1767 error = ENOMEM; 1768 } 1769 break; 1770 } 1771 1772 case DIOCGETSTATE: { 1773 struct pfioc_state *ps = (struct pfioc_state *)addr; 1774 struct pf_state *s; 1775 u_int32_t nr; 1776 1777 nr = 0; 1778 RB_FOREACH(s, pf_state_tree_id, &tree_id) { 1779 if (nr >= ps->nr) 1780 break; 1781 nr++; 1782 } 1783 if (s == NULL) { 1784 error = EBUSY; 1785 break; 1786 } 1787 1788 pf_state_export((struct pfsync_state *)&ps->state, 1789 s->state_key, s); 1790 break; 1791 } 1792 1793 case DIOCGETSTATES: { 1794 struct pfioc_states *ps = (struct pfioc_states *)addr; 1795 struct pf_state *state; 1796 struct pfsync_state *p, *pstore; 1797 u_int32_t nr = 0; 1798 1799 if (ps->ps_len == 0) { 1800 nr = pf_status.states; 1801 ps->ps_len = sizeof(struct pfsync_state) * nr; 1802 break; 1803 } 1804 1805 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 1806 1807 p = ps->ps_states; 1808 1809 state = TAILQ_FIRST(&state_list); 1810 while (state) { 1811 if (state->timeout != PFTM_UNLINKED) { 1812 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1813 break; 1814 1815 pf_state_export(pstore, 1816 state->state_key, state); 1817 error = copyout(pstore, p, sizeof(*p)); 1818 if (error) { 1819 free(pstore, M_TEMP); 1820 goto fail; 1821 } 1822 p++; 1823 nr++; 1824 } 1825 state = TAILQ_NEXT(state, entry_list); 1826 } 1827 1828 ps->ps_len = sizeof(struct pfsync_state) * nr; 1829 1830 free(pstore, M_TEMP); 1831 break; 1832 } 1833 1834 case DIOCGETSTATUS: { 1835 struct pf_status *s = (struct pf_status *)addr; 1836 bcopy(&pf_status, s, sizeof(struct pf_status)); 1837 pfi_fill_oldstatus(s); 1838 break; 1839 } 1840 1841 case DIOCSETSTATUSIF: { 1842 struct pfioc_if *pi = (struct pfioc_if *)addr; 1843 1844 if (pi->ifname[0] == 0) { 1845 bzero(pf_status.ifname, IFNAMSIZ); 1846 break; 1847 } 1848 if (ifunit(pi->ifname) == NULL) { 1849 error = EINVAL; 1850 break; 1851 } 1852 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 1853 break; 1854 } 1855 1856 case DIOCCLRSTATUS: { 1857 bzero(pf_status.counters, sizeof(pf_status.counters)); 1858 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 1859 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 1860 pf_status.since = time_second; 1861 if (*pf_status.ifname) 1862 pfi_clr_istats(pf_status.ifname); 1863 break; 1864 } 1865 1866 case DIOCNATLOOK: { 1867 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1868 struct pf_state_key *sk; 1869 struct pf_state *state; 1870 struct pf_state_key_cmp key; 1871 int m = 0, direction = pnl->direction; 1872 1873 key.af = pnl->af; 1874 key.proto = pnl->proto; 1875 1876 if (!pnl->proto || 1877 PF_AZERO(&pnl->saddr, pnl->af) || 1878 PF_AZERO(&pnl->daddr, pnl->af) || 1879 ((pnl->proto == IPPROTO_TCP || 1880 pnl->proto == IPPROTO_UDP) && 1881 (!pnl->dport || !pnl->sport))) 1882 error = EINVAL; 1883 else { 1884 /* 1885 * userland gives us source and dest of connection, 1886 * reverse the lookup so we ask for what happens with 1887 * the return traffic, enabling us to find it in the 1888 * state tree. 1889 */ 1890 if (direction == PF_IN) { 1891 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 1892 key.ext.port = pnl->dport; 1893 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 1894 key.gwy.port = pnl->sport; 1895 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 1896 } else { 1897 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 1898 key.lan.port = pnl->dport; 1899 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 1900 key.ext.port = pnl->sport; 1901 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 1902 } 1903 if (m > 1) 1904 error = E2BIG; /* more than one state */ 1905 else if (state != NULL) { 1906 sk = state->state_key; 1907 if (direction == PF_IN) { 1908 PF_ACPY(&pnl->rsaddr, &sk->lan.addr, 1909 sk->af); 1910 pnl->rsport = sk->lan.port; 1911 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 1912 pnl->af); 1913 pnl->rdport = pnl->dport; 1914 } else { 1915 PF_ACPY(&pnl->rdaddr, &sk->gwy.addr, 1916 sk->af); 1917 pnl->rdport = sk->gwy.port; 1918 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 1919 pnl->af); 1920 pnl->rsport = pnl->sport; 1921 } 1922 } else 1923 error = ENOENT; 1924 } 1925 break; 1926 } 1927 1928 case DIOCSETTIMEOUT: { 1929 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1930 int old; 1931 1932 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1933 pt->seconds < 0) { 1934 error = EINVAL; 1935 goto fail; 1936 } 1937 old = pf_default_rule.timeout[pt->timeout]; 1938 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 1939 pt->seconds = 1; 1940 pf_default_rule.timeout[pt->timeout] = pt->seconds; 1941 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 1942 wakeup(pf_purge_thread); 1943 pt->seconds = old; 1944 break; 1945 } 1946 1947 case DIOCGETTIMEOUT: { 1948 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1949 1950 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1951 error = EINVAL; 1952 goto fail; 1953 } 1954 pt->seconds = pf_default_rule.timeout[pt->timeout]; 1955 break; 1956 } 1957 1958 case DIOCGETLIMIT: { 1959 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1960 1961 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1962 error = EINVAL; 1963 goto fail; 1964 } 1965 pl->limit = pf_pool_limits[pl->index].limit; 1966 break; 1967 } 1968 1969 case DIOCSETLIMIT: { 1970 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1971 int old_limit; 1972 1973 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1974 pf_pool_limits[pl->index].pp == NULL) { 1975 error = EINVAL; 1976 goto fail; 1977 } 1978 #ifdef __NetBSD__ 1979 pool_sethardlimit(pf_pool_limits[pl->index].pp, 1980 pl->limit, NULL, 0); 1981 #else 1982 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 1983 pl->limit, NULL, 0) != 0) { 1984 error = EBUSY; 1985 goto fail; 1986 } 1987 #endif /* !__NetBSD__ */ 1988 old_limit = pf_pool_limits[pl->index].limit; 1989 pf_pool_limits[pl->index].limit = pl->limit; 1990 pl->limit = old_limit; 1991 break; 1992 } 1993 1994 case DIOCSETDEBUG: { 1995 u_int32_t *level = (u_int32_t *)addr; 1996 1997 pf_status.debug = *level; 1998 break; 1999 } 2000 2001 case DIOCCLRRULECTRS: { 2002 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 2003 struct pf_ruleset *ruleset = &pf_main_ruleset; 2004 struct pf_rule *rule; 2005 2006 TAILQ_FOREACH(rule, 2007 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 2008 rule->evaluations = 0; 2009 rule->packets[0] = rule->packets[1] = 0; 2010 rule->bytes[0] = rule->bytes[1] = 0; 2011 } 2012 break; 2013 } 2014 2015 #ifdef ALTQ 2016 case DIOCSTARTALTQ: { 2017 struct pf_altq *altq; 2018 2019 /* enable all altq interfaces on active list */ 2020 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2021 if (altq->qname[0] == 0) { 2022 error = pf_enable_altq(altq); 2023 if (error != 0) 2024 break; 2025 } 2026 } 2027 if (error == 0) 2028 pf_altq_running = 1; 2029 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 2030 break; 2031 } 2032 2033 case DIOCSTOPALTQ: { 2034 struct pf_altq *altq; 2035 2036 /* disable all altq interfaces on active list */ 2037 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2038 if (altq->qname[0] == 0) { 2039 error = pf_disable_altq(altq); 2040 if (error != 0) 2041 break; 2042 } 2043 } 2044 if (error == 0) 2045 pf_altq_running = 0; 2046 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 2047 break; 2048 } 2049 2050 case DIOCADDALTQ: { 2051 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2052 struct pf_altq *altq, *a; 2053 2054 if (pa->ticket != ticket_altqs_inactive) { 2055 error = EBUSY; 2056 break; 2057 } 2058 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 2059 if (altq == NULL) { 2060 error = ENOMEM; 2061 break; 2062 } 2063 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 2064 2065 /* 2066 * if this is for a queue, find the discipline and 2067 * copy the necessary fields 2068 */ 2069 if (altq->qname[0] != 0) { 2070 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 2071 error = EBUSY; 2072 pool_put(&pf_altq_pl, altq); 2073 break; 2074 } 2075 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 2076 if (strncmp(a->ifname, altq->ifname, 2077 IFNAMSIZ) == 0 && a->qname[0] == 0) { 2078 altq->altq_disc = a->altq_disc; 2079 break; 2080 } 2081 } 2082 } 2083 2084 error = altq_add(altq); 2085 if (error) { 2086 pool_put(&pf_altq_pl, altq); 2087 break; 2088 } 2089 2090 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 2091 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2092 break; 2093 } 2094 2095 case DIOCGETALTQS: { 2096 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2097 struct pf_altq *altq; 2098 2099 pa->nr = 0; 2100 TAILQ_FOREACH(altq, pf_altqs_active, entries) 2101 pa->nr++; 2102 pa->ticket = ticket_altqs_active; 2103 break; 2104 } 2105 2106 case DIOCGETALTQ: { 2107 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2108 struct pf_altq *altq; 2109 u_int32_t nr; 2110 2111 if (pa->ticket != ticket_altqs_active) { 2112 error = EBUSY; 2113 break; 2114 } 2115 nr = 0; 2116 altq = TAILQ_FIRST(pf_altqs_active); 2117 while ((altq != NULL) && (nr < pa->nr)) { 2118 altq = TAILQ_NEXT(altq, entries); 2119 nr++; 2120 } 2121 if (altq == NULL) { 2122 error = EBUSY; 2123 break; 2124 } 2125 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2126 break; 2127 } 2128 2129 case DIOCCHANGEALTQ: 2130 /* CHANGEALTQ not supported yet! */ 2131 error = ENODEV; 2132 break; 2133 2134 case DIOCGETQSTATS: { 2135 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 2136 struct pf_altq *altq; 2137 u_int32_t nr; 2138 int nbytes; 2139 2140 if (pq->ticket != ticket_altqs_active) { 2141 error = EBUSY; 2142 break; 2143 } 2144 nbytes = pq->nbytes; 2145 nr = 0; 2146 altq = TAILQ_FIRST(pf_altqs_active); 2147 while ((altq != NULL) && (nr < pq->nr)) { 2148 altq = TAILQ_NEXT(altq, entries); 2149 nr++; 2150 } 2151 if (altq == NULL) { 2152 error = EBUSY; 2153 break; 2154 } 2155 error = altq_getqstats(altq, pq->buf, &nbytes); 2156 if (error == 0) { 2157 pq->scheduler = altq->scheduler; 2158 pq->nbytes = nbytes; 2159 } 2160 break; 2161 } 2162 #endif /* ALTQ */ 2163 2164 case DIOCBEGINADDRS: { 2165 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2166 2167 pf_empty_pool(&pf_pabuf); 2168 pp->ticket = ++ticket_pabuf; 2169 break; 2170 } 2171 2172 case DIOCADDADDR: { 2173 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2174 2175 if (pp->ticket != ticket_pabuf) { 2176 error = EBUSY; 2177 break; 2178 } 2179 #ifndef INET 2180 if (pp->af == AF_INET) { 2181 error = EAFNOSUPPORT; 2182 break; 2183 } 2184 #endif /* INET */ 2185 #ifndef INET6 2186 if (pp->af == AF_INET6) { 2187 error = EAFNOSUPPORT; 2188 break; 2189 } 2190 #endif /* INET6 */ 2191 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2192 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2193 pp->addr.addr.type != PF_ADDR_TABLE) { 2194 error = EINVAL; 2195 break; 2196 } 2197 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2198 if (pa == NULL) { 2199 error = ENOMEM; 2200 break; 2201 } 2202 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2203 if (pa->ifname[0]) { 2204 pa->kif = pfi_kif_get(pa->ifname); 2205 if (pa->kif == NULL) { 2206 pool_put(&pf_pooladdr_pl, pa); 2207 error = EINVAL; 2208 break; 2209 } 2210 pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE); 2211 } 2212 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 2213 pfi_dynaddr_remove(&pa->addr); 2214 pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE); 2215 pool_put(&pf_pooladdr_pl, pa); 2216 error = EINVAL; 2217 break; 2218 } 2219 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 2220 break; 2221 } 2222 2223 case DIOCGETADDRS: { 2224 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2225 2226 pp->nr = 0; 2227 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2228 pp->r_num, 0, 1, 0); 2229 if (pool == NULL) { 2230 error = EBUSY; 2231 break; 2232 } 2233 TAILQ_FOREACH(pa, &pool->list, entries) 2234 pp->nr++; 2235 break; 2236 } 2237 2238 case DIOCGETADDR: { 2239 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2240 u_int32_t nr = 0; 2241 2242 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2243 pp->r_num, 0, 1, 1); 2244 if (pool == NULL) { 2245 error = EBUSY; 2246 break; 2247 } 2248 pa = TAILQ_FIRST(&pool->list); 2249 while ((pa != NULL) && (nr < pp->nr)) { 2250 pa = TAILQ_NEXT(pa, entries); 2251 nr++; 2252 } 2253 if (pa == NULL) { 2254 error = EBUSY; 2255 break; 2256 } 2257 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2258 pfi_dynaddr_copyout(&pp->addr.addr); 2259 pf_tbladdr_copyout(&pp->addr.addr); 2260 pf_rtlabel_copyout(&pp->addr.addr); 2261 break; 2262 } 2263 2264 case DIOCCHANGEADDR: { 2265 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2266 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2267 struct pf_ruleset *ruleset; 2268 2269 if (pca->action < PF_CHANGE_ADD_HEAD || 2270 pca->action > PF_CHANGE_REMOVE) { 2271 error = EINVAL; 2272 break; 2273 } 2274 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2275 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2276 pca->addr.addr.type != PF_ADDR_TABLE) { 2277 error = EINVAL; 2278 break; 2279 } 2280 2281 ruleset = pf_find_ruleset(pca->anchor); 2282 if (ruleset == NULL) { 2283 error = EBUSY; 2284 break; 2285 } 2286 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2287 pca->r_num, pca->r_last, 1, 1); 2288 if (pool == NULL) { 2289 error = EBUSY; 2290 break; 2291 } 2292 if (pca->action != PF_CHANGE_REMOVE) { 2293 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2294 if (newpa == NULL) { 2295 error = ENOMEM; 2296 break; 2297 } 2298 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2299 #ifndef INET 2300 if (pca->af == AF_INET) { 2301 pool_put(&pf_pooladdr_pl, newpa); 2302 error = EAFNOSUPPORT; 2303 break; 2304 } 2305 #endif /* INET */ 2306 #ifndef INET6 2307 if (pca->af == AF_INET6) { 2308 pool_put(&pf_pooladdr_pl, newpa); 2309 error = EAFNOSUPPORT; 2310 break; 2311 } 2312 #endif /* INET6 */ 2313 if (newpa->ifname[0]) { 2314 newpa->kif = pfi_kif_get(newpa->ifname); 2315 if (newpa->kif == NULL) { 2316 pool_put(&pf_pooladdr_pl, newpa); 2317 error = EINVAL; 2318 break; 2319 } 2320 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE); 2321 } else 2322 newpa->kif = NULL; 2323 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2324 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2325 pfi_dynaddr_remove(&newpa->addr); 2326 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE); 2327 pool_put(&pf_pooladdr_pl, newpa); 2328 error = EINVAL; 2329 break; 2330 } 2331 } 2332 2333 if (pca->action == PF_CHANGE_ADD_HEAD) 2334 oldpa = TAILQ_FIRST(&pool->list); 2335 else if (pca->action == PF_CHANGE_ADD_TAIL) 2336 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2337 else { 2338 int i = 0; 2339 2340 oldpa = TAILQ_FIRST(&pool->list); 2341 while ((oldpa != NULL) && (i < pca->nr)) { 2342 oldpa = TAILQ_NEXT(oldpa, entries); 2343 i++; 2344 } 2345 if (oldpa == NULL) { 2346 error = EINVAL; 2347 break; 2348 } 2349 } 2350 2351 if (pca->action == PF_CHANGE_REMOVE) { 2352 TAILQ_REMOVE(&pool->list, oldpa, entries); 2353 pfi_dynaddr_remove(&oldpa->addr); 2354 pf_tbladdr_remove(&oldpa->addr); 2355 pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE); 2356 pool_put(&pf_pooladdr_pl, oldpa); 2357 } else { 2358 if (oldpa == NULL) 2359 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2360 else if (pca->action == PF_CHANGE_ADD_HEAD || 2361 pca->action == PF_CHANGE_ADD_BEFORE) 2362 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2363 else 2364 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2365 newpa, entries); 2366 } 2367 2368 pool->cur = TAILQ_FIRST(&pool->list); 2369 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2370 pca->af); 2371 break; 2372 } 2373 2374 case DIOCGETRULESETS: { 2375 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2376 struct pf_ruleset *ruleset; 2377 struct pf_anchor *anchor; 2378 2379 pr->path[sizeof(pr->path) - 1] = 0; 2380 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2381 error = EINVAL; 2382 break; 2383 } 2384 pr->nr = 0; 2385 if (ruleset->anchor == NULL) { 2386 /* XXX kludge for pf_main_ruleset */ 2387 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2388 if (anchor->parent == NULL) 2389 pr->nr++; 2390 } else { 2391 RB_FOREACH(anchor, pf_anchor_node, 2392 &ruleset->anchor->children) 2393 pr->nr++; 2394 } 2395 break; 2396 } 2397 2398 case DIOCGETRULESET: { 2399 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2400 struct pf_ruleset *ruleset; 2401 struct pf_anchor *anchor; 2402 u_int32_t nr = 0; 2403 2404 pr->path[sizeof(pr->path) - 1] = 0; 2405 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2406 error = EINVAL; 2407 break; 2408 } 2409 pr->name[0] = 0; 2410 if (ruleset->anchor == NULL) { 2411 /* XXX kludge for pf_main_ruleset */ 2412 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2413 if (anchor->parent == NULL && nr++ == pr->nr) { 2414 strlcpy(pr->name, anchor->name, 2415 sizeof(pr->name)); 2416 break; 2417 } 2418 } else { 2419 RB_FOREACH(anchor, pf_anchor_node, 2420 &ruleset->anchor->children) 2421 if (nr++ == pr->nr) { 2422 strlcpy(pr->name, anchor->name, 2423 sizeof(pr->name)); 2424 break; 2425 } 2426 } 2427 if (!pr->name[0]) 2428 error = EBUSY; 2429 break; 2430 } 2431 2432 case DIOCRCLRTABLES: { 2433 struct pfioc_table *io = (struct pfioc_table *)addr; 2434 2435 if (io->pfrio_esize != 0) { 2436 error = ENODEV; 2437 break; 2438 } 2439 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2440 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2441 break; 2442 } 2443 2444 case DIOCRADDTABLES: { 2445 struct pfioc_table *io = (struct pfioc_table *)addr; 2446 2447 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2448 error = ENODEV; 2449 break; 2450 } 2451 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2452 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2453 break; 2454 } 2455 2456 case DIOCRDELTABLES: { 2457 struct pfioc_table *io = (struct pfioc_table *)addr; 2458 2459 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2460 error = ENODEV; 2461 break; 2462 } 2463 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2464 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2465 break; 2466 } 2467 2468 case DIOCRGETTABLES: { 2469 struct pfioc_table *io = (struct pfioc_table *)addr; 2470 2471 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2472 error = ENODEV; 2473 break; 2474 } 2475 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2476 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2477 break; 2478 } 2479 2480 case DIOCRGETTSTATS: { 2481 struct pfioc_table *io = (struct pfioc_table *)addr; 2482 2483 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2484 error = ENODEV; 2485 break; 2486 } 2487 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2488 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2489 break; 2490 } 2491 2492 case DIOCRCLRTSTATS: { 2493 struct pfioc_table *io = (struct pfioc_table *)addr; 2494 2495 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2496 error = ENODEV; 2497 break; 2498 } 2499 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2500 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2501 break; 2502 } 2503 2504 case DIOCRSETTFLAGS: { 2505 struct pfioc_table *io = (struct pfioc_table *)addr; 2506 2507 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2508 error = ENODEV; 2509 break; 2510 } 2511 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2512 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2513 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2514 break; 2515 } 2516 2517 case DIOCRCLRADDRS: { 2518 struct pfioc_table *io = (struct pfioc_table *)addr; 2519 2520 if (io->pfrio_esize != 0) { 2521 error = ENODEV; 2522 break; 2523 } 2524 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2525 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2526 break; 2527 } 2528 2529 case DIOCRADDADDRS: { 2530 struct pfioc_table *io = (struct pfioc_table *)addr; 2531 2532 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2533 error = ENODEV; 2534 break; 2535 } 2536 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2537 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2538 PFR_FLAG_USERIOCTL); 2539 break; 2540 } 2541 2542 case DIOCRDELADDRS: { 2543 struct pfioc_table *io = (struct pfioc_table *)addr; 2544 2545 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2546 error = ENODEV; 2547 break; 2548 } 2549 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2550 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2551 PFR_FLAG_USERIOCTL); 2552 break; 2553 } 2554 2555 case DIOCRSETADDRS: { 2556 struct pfioc_table *io = (struct pfioc_table *)addr; 2557 2558 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2559 error = ENODEV; 2560 break; 2561 } 2562 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2563 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2564 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2565 PFR_FLAG_USERIOCTL, 0); 2566 break; 2567 } 2568 2569 case DIOCRGETADDRS: { 2570 struct pfioc_table *io = (struct pfioc_table *)addr; 2571 2572 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2573 error = ENODEV; 2574 break; 2575 } 2576 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2577 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2578 break; 2579 } 2580 2581 case DIOCRGETASTATS: { 2582 struct pfioc_table *io = (struct pfioc_table *)addr; 2583 2584 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2585 error = ENODEV; 2586 break; 2587 } 2588 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2589 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2590 break; 2591 } 2592 2593 case DIOCRCLRASTATS: { 2594 struct pfioc_table *io = (struct pfioc_table *)addr; 2595 2596 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2597 error = ENODEV; 2598 break; 2599 } 2600 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2601 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2602 PFR_FLAG_USERIOCTL); 2603 break; 2604 } 2605 2606 case DIOCRTSTADDRS: { 2607 struct pfioc_table *io = (struct pfioc_table *)addr; 2608 2609 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2610 error = ENODEV; 2611 break; 2612 } 2613 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2614 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2615 PFR_FLAG_USERIOCTL); 2616 break; 2617 } 2618 2619 case DIOCRINADEFINE: { 2620 struct pfioc_table *io = (struct pfioc_table *)addr; 2621 2622 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2623 error = ENODEV; 2624 break; 2625 } 2626 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2627 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2628 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2629 break; 2630 } 2631 2632 case DIOCOSFPADD: { 2633 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2634 error = pf_osfp_add(io); 2635 break; 2636 } 2637 2638 case DIOCOSFPGET: { 2639 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2640 error = pf_osfp_get(io); 2641 break; 2642 } 2643 2644 case DIOCXBEGIN: { 2645 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2646 struct pfioc_trans_e *ioe; 2647 struct pfr_table *table; 2648 int i; 2649 2650 if (io->esize != sizeof(*ioe)) { 2651 error = ENODEV; 2652 goto fail; 2653 } 2654 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2655 M_TEMP, M_WAITOK); 2656 table = (struct pfr_table *)malloc(sizeof(*table), 2657 M_TEMP, M_WAITOK); 2658 for (i = 0; i < io->size; i++) { 2659 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2660 free(table, M_TEMP); 2661 free(ioe, M_TEMP); 2662 error = EFAULT; 2663 goto fail; 2664 } 2665 switch (ioe->rs_num) { 2666 #ifdef ALTQ 2667 case PF_RULESET_ALTQ: 2668 if (ioe->anchor[0]) { 2669 free(table, M_TEMP); 2670 free(ioe, M_TEMP); 2671 error = EINVAL; 2672 goto fail; 2673 } 2674 if ((error = pf_begin_altq(&ioe->ticket))) { 2675 free(table, M_TEMP); 2676 free(ioe, M_TEMP); 2677 goto fail; 2678 } 2679 break; 2680 #endif /* ALTQ */ 2681 case PF_RULESET_TABLE: 2682 bzero(table, sizeof(*table)); 2683 strlcpy(table->pfrt_anchor, ioe->anchor, 2684 sizeof(table->pfrt_anchor)); 2685 if ((error = pfr_ina_begin(table, 2686 &ioe->ticket, NULL, 0))) { 2687 free(table, M_TEMP); 2688 free(ioe, M_TEMP); 2689 goto fail; 2690 } 2691 break; 2692 default: 2693 if ((error = pf_begin_rules(&ioe->ticket, 2694 ioe->rs_num, ioe->anchor))) { 2695 free(table, M_TEMP); 2696 free(ioe, M_TEMP); 2697 goto fail; 2698 } 2699 break; 2700 } 2701 if (copyout(ioe, io->array+i, sizeof(io->array[i]))) { 2702 free(table, M_TEMP); 2703 free(ioe, M_TEMP); 2704 error = EFAULT; 2705 goto fail; 2706 } 2707 } 2708 free(table, M_TEMP); 2709 free(ioe, M_TEMP); 2710 break; 2711 } 2712 2713 case DIOCXROLLBACK: { 2714 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2715 struct pfioc_trans_e *ioe; 2716 struct pfr_table *table; 2717 int i; 2718 2719 if (io->esize != sizeof(*ioe)) { 2720 error = ENODEV; 2721 goto fail; 2722 } 2723 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2724 M_TEMP, M_WAITOK); 2725 table = (struct pfr_table *)malloc(sizeof(*table), 2726 M_TEMP, M_WAITOK); 2727 for (i = 0; i < io->size; i++) { 2728 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2729 free(table, M_TEMP); 2730 free(ioe, M_TEMP); 2731 error = EFAULT; 2732 goto fail; 2733 } 2734 switch (ioe->rs_num) { 2735 #ifdef ALTQ 2736 case PF_RULESET_ALTQ: 2737 if (ioe->anchor[0]) { 2738 free(table, M_TEMP); 2739 free(ioe, M_TEMP); 2740 error = EINVAL; 2741 goto fail; 2742 } 2743 if ((error = pf_rollback_altq(ioe->ticket))) { 2744 free(table, M_TEMP); 2745 free(ioe, M_TEMP); 2746 goto fail; /* really bad */ 2747 } 2748 break; 2749 #endif /* ALTQ */ 2750 case PF_RULESET_TABLE: 2751 bzero(table, sizeof(*table)); 2752 strlcpy(table->pfrt_anchor, ioe->anchor, 2753 sizeof(table->pfrt_anchor)); 2754 if ((error = pfr_ina_rollback(table, 2755 ioe->ticket, NULL, 0))) { 2756 free(table, M_TEMP); 2757 free(ioe, M_TEMP); 2758 goto fail; /* really bad */ 2759 } 2760 break; 2761 default: 2762 if ((error = pf_rollback_rules(ioe->ticket, 2763 ioe->rs_num, ioe->anchor))) { 2764 free(table, M_TEMP); 2765 free(ioe, M_TEMP); 2766 goto fail; /* really bad */ 2767 } 2768 break; 2769 } 2770 } 2771 free(table, M_TEMP); 2772 free(ioe, M_TEMP); 2773 break; 2774 } 2775 2776 case DIOCXCOMMIT: { 2777 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2778 struct pfioc_trans_e *ioe; 2779 struct pfr_table *table; 2780 struct pf_ruleset *rs; 2781 int i; 2782 2783 if (io->esize != sizeof(*ioe)) { 2784 error = ENODEV; 2785 goto fail; 2786 } 2787 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2788 M_TEMP, M_WAITOK); 2789 table = (struct pfr_table *)malloc(sizeof(*table), 2790 M_TEMP, M_WAITOK); 2791 /* first makes sure everything will succeed */ 2792 for (i = 0; i < io->size; i++) { 2793 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2794 free(table, M_TEMP); 2795 free(ioe, M_TEMP); 2796 error = EFAULT; 2797 goto fail; 2798 } 2799 switch (ioe->rs_num) { 2800 #ifdef ALTQ 2801 case PF_RULESET_ALTQ: 2802 if (ioe->anchor[0]) { 2803 free(table, M_TEMP); 2804 free(ioe, M_TEMP); 2805 error = EINVAL; 2806 goto fail; 2807 } 2808 if (!altqs_inactive_open || ioe->ticket != 2809 ticket_altqs_inactive) { 2810 free(table, M_TEMP); 2811 free(ioe, M_TEMP); 2812 error = EBUSY; 2813 goto fail; 2814 } 2815 break; 2816 #endif /* ALTQ */ 2817 case PF_RULESET_TABLE: 2818 rs = pf_find_ruleset(ioe->anchor); 2819 if (rs == NULL || !rs->topen || ioe->ticket != 2820 rs->tticket) { 2821 free(table, M_TEMP); 2822 free(ioe, M_TEMP); 2823 error = EBUSY; 2824 goto fail; 2825 } 2826 break; 2827 default: 2828 if (ioe->rs_num < 0 || ioe->rs_num >= 2829 PF_RULESET_MAX) { 2830 free(table, M_TEMP); 2831 free(ioe, M_TEMP); 2832 error = EINVAL; 2833 goto fail; 2834 } 2835 rs = pf_find_ruleset(ioe->anchor); 2836 if (rs == NULL || 2837 !rs->rules[ioe->rs_num].inactive.open || 2838 rs->rules[ioe->rs_num].inactive.ticket != 2839 ioe->ticket) { 2840 free(table, M_TEMP); 2841 free(ioe, M_TEMP); 2842 error = EBUSY; 2843 goto fail; 2844 } 2845 break; 2846 } 2847 } 2848 /* now do the commit - no errors should happen here */ 2849 for (i = 0; i < io->size; i++) { 2850 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2851 free(table, M_TEMP); 2852 free(ioe, M_TEMP); 2853 error = EFAULT; 2854 goto fail; 2855 } 2856 switch (ioe->rs_num) { 2857 #ifdef ALTQ 2858 case PF_RULESET_ALTQ: 2859 if ((error = pf_commit_altq(ioe->ticket))) { 2860 free(table, M_TEMP); 2861 free(ioe, M_TEMP); 2862 goto fail; /* really bad */ 2863 } 2864 break; 2865 #endif /* ALTQ */ 2866 case PF_RULESET_TABLE: 2867 bzero(table, sizeof(*table)); 2868 strlcpy(table->pfrt_anchor, ioe->anchor, 2869 sizeof(table->pfrt_anchor)); 2870 if ((error = pfr_ina_commit(table, ioe->ticket, 2871 NULL, NULL, 0))) { 2872 free(table, M_TEMP); 2873 free(ioe, M_TEMP); 2874 goto fail; /* really bad */ 2875 } 2876 break; 2877 default: 2878 if ((error = pf_commit_rules(ioe->ticket, 2879 ioe->rs_num, ioe->anchor))) { 2880 free(table, M_TEMP); 2881 free(ioe, M_TEMP); 2882 goto fail; /* really bad */ 2883 } 2884 break; 2885 } 2886 } 2887 free(table, M_TEMP); 2888 free(ioe, M_TEMP); 2889 break; 2890 } 2891 2892 case DIOCGETSRCNODES: { 2893 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 2894 struct pf_src_node *n, *p, *pstore; 2895 u_int32_t nr = 0; 2896 int space = psn->psn_len; 2897 2898 if (space == 0) { 2899 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 2900 nr++; 2901 psn->psn_len = sizeof(struct pf_src_node) * nr; 2902 break; 2903 } 2904 2905 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 2906 2907 p = psn->psn_src_nodes; 2908 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2909 int secs = time_second, diff; 2910 2911 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 2912 break; 2913 2914 bcopy(n, pstore, sizeof(*pstore)); 2915 if (n->rule.ptr != NULL) 2916 pstore->rule.nr = n->rule.ptr->nr; 2917 pstore->creation = secs - pstore->creation; 2918 if (pstore->expire > secs) 2919 pstore->expire -= secs; 2920 else 2921 pstore->expire = 0; 2922 2923 /* adjust the connection rate estimate */ 2924 diff = secs - n->conn_rate.last; 2925 if (diff >= n->conn_rate.seconds) 2926 pstore->conn_rate.count = 0; 2927 else 2928 pstore->conn_rate.count -= 2929 n->conn_rate.count * diff / 2930 n->conn_rate.seconds; 2931 2932 error = copyout(pstore, p, sizeof(*p)); 2933 if (error) { 2934 free(pstore, M_TEMP); 2935 goto fail; 2936 } 2937 p++; 2938 nr++; 2939 } 2940 psn->psn_len = sizeof(struct pf_src_node) * nr; 2941 2942 free(pstore, M_TEMP); 2943 break; 2944 } 2945 2946 case DIOCCLRSRCNODES: { 2947 struct pf_src_node *n; 2948 struct pf_state *state; 2949 2950 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 2951 state->src_node = NULL; 2952 state->nat_src_node = NULL; 2953 } 2954 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2955 n->expire = 1; 2956 n->states = 0; 2957 } 2958 pf_purge_expired_src_nodes(1); 2959 pf_status.src_nodes = 0; 2960 break; 2961 } 2962 2963 case DIOCKILLSRCNODES: { 2964 struct pf_src_node *sn; 2965 struct pf_state *s; 2966 struct pfioc_src_node_kill *psnk = \ 2967 (struct pfioc_src_node_kill *) addr; 2968 int killed = 0; 2969 2970 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) { 2971 if (PF_MATCHA(psnk->psnk_src.neg, \ 2972 &psnk->psnk_src.addr.v.a.addr, \ 2973 &psnk->psnk_src.addr.v.a.mask, \ 2974 &sn->addr, sn->af) && 2975 PF_MATCHA(psnk->psnk_dst.neg, \ 2976 &psnk->psnk_dst.addr.v.a.addr, \ 2977 &psnk->psnk_dst.addr.v.a.mask, \ 2978 &sn->raddr, sn->af)) { 2979 /* Handle state to src_node linkage */ 2980 if (sn->states != 0) { 2981 RB_FOREACH(s, pf_state_tree_id, 2982 &tree_id) { 2983 if (s->src_node == sn) 2984 s->src_node = NULL; 2985 if (s->nat_src_node == sn) 2986 s->nat_src_node = NULL; 2987 } 2988 sn->states = 0; 2989 } 2990 sn->expire = 1; 2991 killed++; 2992 } 2993 } 2994 2995 if (killed > 0) 2996 pf_purge_expired_src_nodes(1); 2997 2998 psnk->psnk_af = killed; 2999 break; 3000 } 3001 3002 case DIOCSETHOSTID: { 3003 u_int32_t *hostid = (u_int32_t *)addr; 3004 3005 if (*hostid == 0) 3006 pf_status.hostid = arc4random(); 3007 else 3008 pf_status.hostid = *hostid; 3009 break; 3010 } 3011 3012 case DIOCOSFPFLUSH: 3013 pf_osfp_flush(); 3014 break; 3015 3016 case DIOCIGETIFACES: { 3017 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3018 3019 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 3020 error = ENODEV; 3021 break; 3022 } 3023 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 3024 &io->pfiio_size); 3025 break; 3026 } 3027 3028 case DIOCSETIFFLAG: { 3029 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3030 3031 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 3032 break; 3033 } 3034 3035 case DIOCCLRIFFLAG: { 3036 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3037 3038 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 3039 break; 3040 } 3041 3042 default: 3043 error = ENODEV; 3044 break; 3045 } 3046 fail: 3047 splx(s); 3048 if (flags & FWRITE) 3049 rw_exit_write(&pf_consistency_lock); 3050 else 3051 rw_exit_read(&pf_consistency_lock); 3052 return (error); 3053 } 3054 3055 #ifdef __NetBSD__ 3056 #ifdef INET 3057 static int 3058 pfil4_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3059 { 3060 int error; 3061 3062 /* 3063 * ensure that mbufs are writable beforehand 3064 * as it's assumed by pf code. 3065 * ip hdr (60 bytes) + tcp hdr (60 bytes) should be enough. 3066 * XXX inefficient 3067 */ 3068 error = m_makewritable(mp, 0, 60 + 60, M_DONTWAIT); 3069 if (error) { 3070 m_freem(*mp); 3071 *mp = NULL; 3072 return error; 3073 } 3074 3075 /* 3076 * If the packet is out-bound, we can't delay checksums 3077 * here. For in-bound, the checksum has already been 3078 * validated. 3079 */ 3080 if (dir == PFIL_OUT) { 3081 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 3082 in_delayed_cksum(*mp); 3083 (*mp)->m_pkthdr.csum_flags &= 3084 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 3085 } 3086 } 3087 3088 if (pf_test(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3089 != PF_PASS) { 3090 m_freem(*mp); 3091 *mp = NULL; 3092 return EHOSTUNREACH; 3093 } 3094 3095 /* 3096 * we're not compatible with fast-forward. 3097 */ 3098 3099 if (dir == PFIL_IN && *mp) { 3100 (*mp)->m_flags &= ~M_CANFASTFWD; 3101 } 3102 3103 return (0); 3104 } 3105 #endif /* INET */ 3106 3107 #ifdef INET6 3108 static int 3109 pfil6_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3110 { 3111 int error; 3112 3113 /* 3114 * ensure that mbufs are writable beforehand 3115 * as it's assumed by pf code. 3116 * XXX inefficient 3117 */ 3118 error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 3119 if (error) { 3120 m_freem(*mp); 3121 *mp = NULL; 3122 return error; 3123 } 3124 3125 /* 3126 * If the packet is out-bound, we can't delay checksums 3127 * here. For in-bound, the checksum has already been 3128 * validated. 3129 */ 3130 if (dir == PFIL_OUT) { 3131 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 3132 in6_delayed_cksum(*mp); 3133 (*mp)->m_pkthdr.csum_flags &= 3134 ~(M_CSUM_TCPv6|M_CSUM_UDPv6); 3135 } 3136 } 3137 3138 if (pf_test6(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3139 != PF_PASS) { 3140 m_freem(*mp); 3141 *mp = NULL; 3142 return EHOSTUNREACH; 3143 } else 3144 return (0); 3145 } 3146 #endif /* INET6 */ 3147 3148 static int 3149 pf_pfil_attach(void) 3150 { 3151 struct pfil_head *ph_inet; 3152 #ifdef INET6 3153 struct pfil_head *ph_inet6; 3154 #endif /* INET6 */ 3155 int error; 3156 3157 if (pf_pfil_attached) 3158 return (EBUSY); 3159 3160 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3161 if (ph_inet) 3162 error = pfil_add_hook((void *)pfil4_wrapper, NULL, 3163 PFIL_IN|PFIL_OUT, ph_inet); 3164 else 3165 error = ENOENT; 3166 if (error) 3167 return (error); 3168 3169 #ifdef INET6 3170 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3171 if (ph_inet6) 3172 error = pfil_add_hook((void *)pfil6_wrapper, NULL, 3173 PFIL_IN|PFIL_OUT, ph_inet6); 3174 else 3175 error = ENOENT; 3176 if (error) 3177 goto bad; 3178 #endif /* INET6 */ 3179 3180 pf_pfil_attached = 1; 3181 3182 return (0); 3183 3184 #ifdef INET6 3185 bad: 3186 pfil_remove_hook(pfil4_wrapper, NULL, PFIL_IN|PFIL_OUT, ph_inet); 3187 #endif /* INET6 */ 3188 3189 return (error); 3190 } 3191 3192 static int 3193 pf_pfil_detach(void) 3194 { 3195 struct pfil_head *ph_inet; 3196 #ifdef INET6 3197 struct pfil_head *ph_inet6; 3198 #endif /* INET6 */ 3199 3200 if (pf_pfil_attached == 0) 3201 return (EBUSY); 3202 3203 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3204 if (ph_inet) 3205 pfil_remove_hook((void *)pfil4_wrapper, NULL, 3206 PFIL_IN|PFIL_OUT, ph_inet); 3207 #ifdef INET6 3208 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3209 if (ph_inet6) 3210 pfil_remove_hook((void *)pfil6_wrapper, NULL, 3211 PFIL_IN|PFIL_OUT, ph_inet6); 3212 #endif /* INET6 */ 3213 pf_pfil_attached = 0; 3214 3215 return (0); 3216 } 3217 #endif /* __NetBSD__ */ 3218
Indexes created Thu Oct 02 14:10:14 GMT 2025