pf_ioctl.c revision 1.4
1 /* $NetBSD: pf_ioctl.c,v 1.4 2004/06/22 18:59:14 martin Exp $ */ 2 /* $OpenBSD: pf_ioctl.c,v 1.112 2004/03/22 04:54:18 mcbride Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #ifdef _KERNEL_OPT 40 #include "opt_inet.h" 41 #include "opt_altq.h" 42 #include "opt_pfil_hooks.h" 43 #endif 44 45 #ifdef __OpenBSD__ 46 #include "pfsync.h" 47 #else 48 #define NPFSYNC 0 49 #endif 50 51 #include <sys/param.h> 52 #include <sys/systm.h> 53 #include <sys/mbuf.h> 54 #include <sys/filio.h> 55 #include <sys/fcntl.h> 56 #include <sys/socket.h> 57 #include <sys/socketvar.h> 58 #include <sys/kernel.h> 59 #include <sys/time.h> 60 #ifdef __OpenBSD__ 61 #include <sys/timeout.h> 62 #else 63 #include <sys/callout.h> 64 #endif 65 #include <sys/pool.h> 66 #include <sys/malloc.h> 67 #ifdef __NetBSD__ 68 #include <sys/conf.h> 69 #endif 70 71 #include <net/if.h> 72 #include <net/if_types.h> 73 #include <net/route.h> 74 75 #include <netinet/in.h> 76 #include <netinet/in_var.h> 77 #include <netinet/in_systm.h> 78 #include <netinet/ip.h> 79 #include <netinet/ip_var.h> 80 #include <netinet/ip_icmp.h> 81 82 #ifdef __OpenBSD__ 83 #include <dev/rndvar.h> 84 #endif 85 #include <net/pfvar.h> 86 87 #if NPFSYNC > 0 88 #include <net/if_pfsync.h> 89 #endif /* NPFSYNC > 0 */ 90 91 #ifdef INET6 92 #include <netinet/ip6.h> 93 #include <netinet/in_pcb.h> 94 #endif /* INET6 */ 95 96 #ifdef ALTQ 97 #include <altq/altq.h> 98 #endif 99 100 void pfattach(int); 101 int pfdetach(void); 102 int pfopen(dev_t, int, int, struct proc *); 103 int pfclose(dev_t, int, int, struct proc *); 104 struct pf_pool *pf_get_pool(char *, char *, u_int32_t, 105 u_int8_t, u_int8_t, u_int8_t, u_int8_t, u_int8_t); 106 int pf_get_ruleset_number(u_int8_t); 107 void pf_init_ruleset(struct pf_ruleset *); 108 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 109 void pf_empty_pool(struct pf_palist *); 110 int pfioctl(dev_t, u_long, caddr_t, int, struct proc *); 111 #ifdef ALTQ 112 int pf_begin_altq(u_int32_t *); 113 int pf_rollback_altq(u_int32_t); 114 int pf_commit_altq(u_int32_t); 115 #endif /* ALTQ */ 116 int pf_begin_rules(u_int32_t *, int, char *, char *); 117 int pf_rollback_rules(u_int32_t, int, char *, char *); 118 int pf_commit_rules(u_int32_t, int, char *, char *); 119 120 #ifdef __NetBSD__ 121 const struct cdevsw pf_cdevsw = { 122 pfopen, pfclose, noread, nowrite, pfioctl, 123 nostop, notty, nopoll, nommap, nokqfilter, 124 }; 125 126 static int pf_pfil_attach(void); 127 static int pf_pfil_detach(void); 128 129 POOL_INIT(pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 130 &pool_allocator_nointr); 131 POOL_INIT(pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 132 "pfsrctrpl", NULL); 133 POOL_INIT(pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", NULL); 134 POOL_INIT(pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", NULL); 135 POOL_INIT(pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 136 "pfpooladdrpl", NULL); 137 #endif 138 139 #ifdef __OpenBSD__ 140 extern struct timeout pf_expire_to; 141 #else 142 extern struct callout pf_expire_to; 143 #endif 144 145 struct pf_rule pf_default_rule; 146 147 #define TAGID_MAX 50000 148 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 149 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 150 151 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 152 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 153 #endif 154 static u_int16_t tagname2tag(struct pf_tags *, char *); 155 static void tag2tagname(struct pf_tags *, u_int16_t, char *); 156 static void tag_unref(struct pf_tags *, u_int16_t); 157 158 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 159 160 #ifdef __NetBSD__ 161 struct pfil_head pf_ioctl_head; 162 struct pfil_head pf_newif_head; 163 extern struct pfil_head if_pfil; 164 #endif 165 166 void 167 pfattach(int num) 168 { 169 u_int32_t *timeout = pf_default_rule.timeout; 170 171 #ifdef __NetBSD__ 172 pfil_head_register(&pf_ioctl_head); 173 pfil_head_register(&pf_newif_head); 174 #endif 175 176 #ifdef __OpenBSD__ 177 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 178 &pool_allocator_nointr); 179 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 180 "pfsrctrpl", NULL); 181 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 182 NULL); 183 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 184 NULL); 185 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 186 "pfpooladdrpl", NULL); 187 #endif 188 pfr_initialize(); 189 pfi_initialize(); 190 pf_osfp_initialize(); 191 192 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 193 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 194 195 RB_INIT(&tree_src_tracking); 196 TAILQ_INIT(&pf_anchors); 197 pf_init_ruleset(&pf_main_ruleset); 198 TAILQ_INIT(&pf_altqs[0]); 199 TAILQ_INIT(&pf_altqs[1]); 200 TAILQ_INIT(&pf_pabuf); 201 pf_altqs_active = &pf_altqs[0]; 202 pf_altqs_inactive = &pf_altqs[1]; 203 TAILQ_INIT(&state_updates); 204 205 /* default rule should never be garbage collected */ 206 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 207 pf_default_rule.action = PF_PASS; 208 pf_default_rule.nr = -1; 209 210 /* initialize default timeouts */ 211 timeout[PFTM_TCP_FIRST_PACKET] = 120; /* First TCP packet */ 212 timeout[PFTM_TCP_OPENING] = 30; /* No response yet */ 213 timeout[PFTM_TCP_ESTABLISHED] = 24*60*60; /* Established */ 214 timeout[PFTM_TCP_CLOSING] = 15 * 60; /* Half closed */ 215 timeout[PFTM_TCP_FIN_WAIT] = 45; /* Got both FINs */ 216 timeout[PFTM_TCP_CLOSED] = 90; /* Got a RST */ 217 timeout[PFTM_UDP_FIRST_PACKET] = 60; /* First UDP packet */ 218 timeout[PFTM_UDP_SINGLE] = 30; /* Unidirectional */ 219 timeout[PFTM_UDP_MULTIPLE] = 60; /* Bidirectional */ 220 timeout[PFTM_ICMP_FIRST_PACKET] = 20; /* First ICMP packet */ 221 timeout[PFTM_ICMP_ERROR_REPLY] = 10; /* Got error response */ 222 timeout[PFTM_OTHER_FIRST_PACKET] = 60; /* First packet */ 223 timeout[PFTM_OTHER_SINGLE] = 30; /* Unidirectional */ 224 timeout[PFTM_OTHER_MULTIPLE] = 60; /* Bidirectional */ 225 timeout[PFTM_FRAG] = 30; /* Fragment expire */ 226 timeout[PFTM_INTERVAL] = 10; /* Expire interval */ 227 timeout[PFTM_SRC_NODE] = 0; /* Source tracking */ 228 229 #ifdef __OpenBSD__ 230 timeout_set(&pf_expire_to, pf_purge_timeout, &pf_expire_to); 231 timeout_add(&pf_expire_to, timeout[PFTM_INTERVAL] * hz); 232 #else 233 callout_init(&pf_expire_to); 234 callout_reset(&pf_expire_to, timeout[PFTM_INTERVAL] * hz, 235 pf_purge_timeout, &pf_expire_to); 236 #endif 237 238 pf_normalize_init(); 239 bzero(&pf_status, sizeof(pf_status)); 240 pf_status.debug = PF_DEBUG_URGENT; 241 242 /* XXX do our best to avoid a conflict */ 243 pf_status.hostid = arc4random(); 244 } 245 246 int 247 pfopen(dev_t dev, int flags, int fmt, struct proc *p) 248 { 249 if (minor(dev) >= 1) 250 return (ENXIO); 251 return (0); 252 } 253 254 int 255 pfdetach(void) 256 { 257 return pf_pfil_detach(); 258 } 259 260 int 261 pfclose(dev_t dev, int flags, int fmt, struct proc *p) 262 { 263 if (minor(dev) >= 1) 264 return (ENXIO); 265 return (0); 266 } 267 268 struct pf_pool * 269 pf_get_pool(char *anchorname, char *rulesetname, u_int32_t ticket, 270 u_int8_t rule_action, u_int8_t rule_number, u_int8_t r_last, 271 u_int8_t active, u_int8_t check_ticket) 272 { 273 struct pf_ruleset *ruleset; 274 struct pf_rule *rule; 275 int rs_num; 276 277 ruleset = pf_find_ruleset(anchorname, rulesetname); 278 if (ruleset == NULL) 279 return (NULL); 280 rs_num = pf_get_ruleset_number(rule_action); 281 if (rs_num >= PF_RULESET_MAX) 282 return (NULL); 283 if (active) { 284 if (check_ticket && ticket != 285 ruleset->rules[rs_num].active.ticket) 286 return (NULL); 287 if (r_last) 288 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 289 pf_rulequeue); 290 else 291 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 292 } else { 293 if (check_ticket && ticket != 294 ruleset->rules[rs_num].inactive.ticket) 295 return (NULL); 296 if (r_last) 297 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 298 pf_rulequeue); 299 else 300 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 301 } 302 if (!r_last) { 303 while ((rule != NULL) && (rule->nr != rule_number)) 304 rule = TAILQ_NEXT(rule, entries); 305 } 306 if (rule == NULL) 307 return (NULL); 308 309 return (&rule->rpool); 310 } 311 312 int 313 pf_get_ruleset_number(u_int8_t action) 314 { 315 switch (action) { 316 case PF_SCRUB: 317 return (PF_RULESET_SCRUB); 318 break; 319 case PF_PASS: 320 case PF_DROP: 321 return (PF_RULESET_FILTER); 322 break; 323 case PF_NAT: 324 case PF_NONAT: 325 return (PF_RULESET_NAT); 326 break; 327 case PF_BINAT: 328 case PF_NOBINAT: 329 return (PF_RULESET_BINAT); 330 break; 331 case PF_RDR: 332 case PF_NORDR: 333 return (PF_RULESET_RDR); 334 break; 335 default: 336 return (PF_RULESET_MAX); 337 break; 338 } 339 } 340 341 void 342 pf_init_ruleset(struct pf_ruleset *ruleset) 343 { 344 int i; 345 346 memset(ruleset, 0, sizeof(struct pf_ruleset)); 347 for (i = 0; i < PF_RULESET_MAX; i++) { 348 TAILQ_INIT(&ruleset->rules[i].queues[0]); 349 TAILQ_INIT(&ruleset->rules[i].queues[1]); 350 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 351 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 352 } 353 } 354 355 struct pf_anchor * 356 pf_find_anchor(const char *anchorname) 357 { 358 struct pf_anchor *anchor; 359 int n = -1; 360 361 anchor = TAILQ_FIRST(&pf_anchors); 362 while (anchor != NULL && (n = strcmp(anchor->name, anchorname)) < 0) 363 anchor = TAILQ_NEXT(anchor, entries); 364 if (n == 0) 365 return (anchor); 366 else 367 return (NULL); 368 } 369 370 struct pf_ruleset * 371 pf_find_ruleset(char *anchorname, char *rulesetname) 372 { 373 struct pf_anchor *anchor; 374 struct pf_ruleset *ruleset; 375 376 if (!anchorname[0] && !rulesetname[0]) 377 return (&pf_main_ruleset); 378 if (!anchorname[0] || !rulesetname[0]) 379 return (NULL); 380 anchorname[PF_ANCHOR_NAME_SIZE-1] = 0; 381 rulesetname[PF_RULESET_NAME_SIZE-1] = 0; 382 anchor = pf_find_anchor(anchorname); 383 if (anchor == NULL) 384 return (NULL); 385 ruleset = TAILQ_FIRST(&anchor->rulesets); 386 while (ruleset != NULL && strcmp(ruleset->name, rulesetname) < 0) 387 ruleset = TAILQ_NEXT(ruleset, entries); 388 if (ruleset != NULL && !strcmp(ruleset->name, rulesetname)) 389 return (ruleset); 390 else 391 return (NULL); 392 } 393 394 struct pf_ruleset * 395 pf_find_or_create_ruleset(char anchorname[PF_ANCHOR_NAME_SIZE], 396 char rulesetname[PF_RULESET_NAME_SIZE]) 397 { 398 struct pf_anchor *anchor, *a; 399 struct pf_ruleset *ruleset, *r; 400 401 if (!anchorname[0] && !rulesetname[0]) 402 return (&pf_main_ruleset); 403 if (!anchorname[0] || !rulesetname[0]) 404 return (NULL); 405 anchorname[PF_ANCHOR_NAME_SIZE-1] = 0; 406 rulesetname[PF_RULESET_NAME_SIZE-1] = 0; 407 a = TAILQ_FIRST(&pf_anchors); 408 while (a != NULL && strcmp(a->name, anchorname) < 0) 409 a = TAILQ_NEXT(a, entries); 410 if (a != NULL && !strcmp(a->name, anchorname)) 411 anchor = a; 412 else { 413 anchor = (struct pf_anchor *)malloc(sizeof(struct pf_anchor), 414 M_TEMP, M_NOWAIT); 415 if (anchor == NULL) 416 return (NULL); 417 memset(anchor, 0, sizeof(struct pf_anchor)); 418 bcopy(anchorname, anchor->name, sizeof(anchor->name)); 419 TAILQ_INIT(&anchor->rulesets); 420 if (a != NULL) 421 TAILQ_INSERT_BEFORE(a, anchor, entries); 422 else 423 TAILQ_INSERT_TAIL(&pf_anchors, anchor, entries); 424 } 425 r = TAILQ_FIRST(&anchor->rulesets); 426 while (r != NULL && strcmp(r->name, rulesetname) < 0) 427 r = TAILQ_NEXT(r, entries); 428 if (r != NULL && !strcmp(r->name, rulesetname)) 429 return (r); 430 ruleset = (struct pf_ruleset *)malloc(sizeof(struct pf_ruleset), 431 M_TEMP, M_NOWAIT); 432 if (ruleset != NULL) { 433 pf_init_ruleset(ruleset); 434 bcopy(rulesetname, ruleset->name, sizeof(ruleset->name)); 435 ruleset->anchor = anchor; 436 if (r != NULL) 437 TAILQ_INSERT_BEFORE(r, ruleset, entries); 438 else 439 TAILQ_INSERT_TAIL(&anchor->rulesets, ruleset, entries); 440 } 441 return (ruleset); 442 } 443 444 void 445 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 446 { 447 struct pf_anchor *anchor; 448 int i; 449 450 if (ruleset == NULL || ruleset->anchor == NULL || ruleset->tables > 0 || 451 ruleset->topen) 452 return; 453 for (i = 0; i < PF_RULESET_MAX; ++i) 454 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 455 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 456 ruleset->rules[i].inactive.open) 457 return; 458 459 anchor = ruleset->anchor; 460 TAILQ_REMOVE(&anchor->rulesets, ruleset, entries); 461 free(ruleset, M_TEMP); 462 463 if (TAILQ_EMPTY(&anchor->rulesets)) { 464 TAILQ_REMOVE(&pf_anchors, anchor, entries); 465 free(anchor, M_TEMP); 466 pf_update_anchor_rules(); 467 } 468 } 469 470 void 471 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 472 { 473 struct pf_pooladdr *mv_pool_pa; 474 475 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 476 TAILQ_REMOVE(poola, mv_pool_pa, entries); 477 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 478 } 479 } 480 481 void 482 pf_empty_pool(struct pf_palist *poola) 483 { 484 struct pf_pooladdr *empty_pool_pa; 485 486 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 487 pfi_dynaddr_remove(&empty_pool_pa->addr); 488 pf_tbladdr_remove(&empty_pool_pa->addr); 489 pfi_detach_rule(empty_pool_pa->kif); 490 TAILQ_REMOVE(poola, empty_pool_pa, entries); 491 pool_put(&pf_pooladdr_pl, empty_pool_pa); 492 } 493 } 494 495 void 496 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 497 { 498 if (rulequeue != NULL) { 499 if (rule->states <= 0) { 500 /* 501 * XXX - we need to remove the table *before* detaching 502 * the rule to make sure the table code does not delete 503 * the anchor under our feet. 504 */ 505 pf_tbladdr_remove(&rule->src.addr); 506 pf_tbladdr_remove(&rule->dst.addr); 507 } 508 TAILQ_REMOVE(rulequeue, rule, entries); 509 rule->entries.tqe_prev = NULL; 510 rule->nr = -1; 511 } 512 513 if (rule->states > 0 || rule->src_nodes > 0 || 514 rule->entries.tqe_prev != NULL) 515 return; 516 pf_tag_unref(rule->tag); 517 pf_tag_unref(rule->match_tag); 518 #ifdef ALTQ 519 if (rule->pqid != rule->qid) 520 pf_qid_unref(rule->pqid); 521 pf_qid_unref(rule->qid); 522 #endif 523 pfi_dynaddr_remove(&rule->src.addr); 524 pfi_dynaddr_remove(&rule->dst.addr); 525 if (rulequeue == NULL) { 526 pf_tbladdr_remove(&rule->src.addr); 527 pf_tbladdr_remove(&rule->dst.addr); 528 } 529 pfi_detach_rule(rule->kif); 530 pf_empty_pool(&rule->rpool.list); 531 pool_put(&pf_rule_pl, rule); 532 } 533 534 static u_int16_t 535 tagname2tag(struct pf_tags *head, char *tagname) 536 { 537 struct pf_tagname *tag, *p = NULL; 538 u_int16_t new_tagid = 1; 539 540 TAILQ_FOREACH(tag, head, entries) 541 if (strcmp(tagname, tag->name) == 0) { 542 tag->ref++; 543 return (tag->tag); 544 } 545 546 /* 547 * to avoid fragmentation, we do a linear search from the beginning 548 * and take the first free slot we find. if there is none or the list 549 * is empty, append a new entry at the end. 550 */ 551 552 /* new entry */ 553 if (!TAILQ_EMPTY(head)) 554 for (p = TAILQ_FIRST(head); p != NULL && 555 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 556 new_tagid = p->tag + 1; 557 558 if (new_tagid > TAGID_MAX) 559 return (0); 560 561 /* allocate and fill new struct pf_tagname */ 562 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 563 M_TEMP, M_NOWAIT); 564 if (tag == NULL) 565 return (0); 566 bzero(tag, sizeof(struct pf_tagname)); 567 strlcpy(tag->name, tagname, sizeof(tag->name)); 568 tag->tag = new_tagid; 569 tag->ref++; 570 571 if (p != NULL) /* insert new entry before p */ 572 TAILQ_INSERT_BEFORE(p, tag, entries); 573 else /* either list empty or no free slot in between */ 574 TAILQ_INSERT_TAIL(head, tag, entries); 575 576 return (tag->tag); 577 } 578 579 static void 580 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 581 { 582 struct pf_tagname *tag; 583 584 TAILQ_FOREACH(tag, head, entries) 585 if (tag->tag == tagid) { 586 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 587 return; 588 } 589 } 590 591 static void 592 tag_unref(struct pf_tags *head, u_int16_t tag) 593 { 594 struct pf_tagname *p, *next; 595 596 if (tag == 0) 597 return; 598 599 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 600 next = TAILQ_NEXT(p, entries); 601 if (tag == p->tag) { 602 if (--p->ref == 0) { 603 TAILQ_REMOVE(head, p, entries); 604 free(p, M_TEMP); 605 } 606 break; 607 } 608 } 609 } 610 611 u_int16_t 612 pf_tagname2tag(char *tagname) 613 { 614 return (tagname2tag(&pf_tags, tagname)); 615 } 616 617 void 618 pf_tag2tagname(u_int16_t tagid, char *p) 619 { 620 return (tag2tagname(&pf_tags, tagid, p)); 621 } 622 623 void 624 pf_tag_unref(u_int16_t tag) 625 { 626 return (tag_unref(&pf_tags, tag)); 627 } 628 629 #ifdef ALTQ 630 u_int32_t 631 pf_qname2qid(char *qname) 632 { 633 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 634 } 635 636 void 637 pf_qid2qname(u_int32_t qid, char *p) 638 { 639 return (tag2tagname(&pf_qids, (u_int16_t)qid, p)); 640 } 641 642 void 643 pf_qid_unref(u_int32_t qid) 644 { 645 return (tag_unref(&pf_qids, (u_int16_t)qid)); 646 } 647 648 int 649 pf_begin_altq(u_int32_t *ticket) 650 { 651 struct pf_altq *altq; 652 int error = 0; 653 654 /* Purge the old altq list */ 655 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 656 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 657 if (altq->qname[0] == 0) { 658 /* detach and destroy the discipline */ 659 error = altq_remove(altq); 660 } else 661 pf_qid_unref(altq->qid); 662 pool_put(&pf_altq_pl, altq); 663 } 664 if (error) 665 return (error); 666 *ticket = ++ticket_altqs_inactive; 667 altqs_inactive_open = 1; 668 return (0); 669 } 670 671 int 672 pf_rollback_altq(u_int32_t ticket) 673 { 674 struct pf_altq *altq; 675 int error = 0; 676 677 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 678 return (0); 679 /* Purge the old altq list */ 680 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 681 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 682 if (altq->qname[0] == 0) { 683 /* detach and destroy the discipline */ 684 error = altq_remove(altq); 685 } else 686 pf_qid_unref(altq->qid); 687 pool_put(&pf_altq_pl, altq); 688 } 689 altqs_inactive_open = 0; 690 return (error); 691 } 692 693 int 694 pf_commit_altq(u_int32_t ticket) 695 { 696 struct pf_altqqueue *old_altqs; 697 struct pf_altq *altq; 698 int s, err, error = 0; 699 700 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 701 return (EBUSY); 702 703 /* swap altqs, keep the old. */ 704 s = splsoftnet(); 705 old_altqs = pf_altqs_active; 706 pf_altqs_active = pf_altqs_inactive; 707 pf_altqs_inactive = old_altqs; 708 ticket_altqs_active = ticket_altqs_inactive; 709 710 /* Attach new disciplines */ 711 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 712 if (altq->qname[0] == 0) { 713 /* attach the discipline */ 714 error = altq_pfattach(altq); 715 if (error) { 716 splx(s); 717 return (error); 718 } 719 } 720 } 721 722 /* Purge the old altq list */ 723 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 724 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 725 if (altq->qname[0] == 0) { 726 /* detach and destroy the discipline */ 727 err = altq_pfdetach(altq); 728 if (err != 0 && error == 0) 729 error = err; 730 err = altq_remove(altq); 731 if (err != 0 && error == 0) 732 error = err; 733 } else 734 pf_qid_unref(altq->qid); 735 pool_put(&pf_altq_pl, altq); 736 } 737 splx(s); 738 739 altqs_inactive_open = 0; 740 return (error); 741 } 742 #endif /* ALTQ */ 743 744 int 745 pf_begin_rules(u_int32_t *ticket, int rs_num, char *anchor, char *ruleset) 746 { 747 struct pf_ruleset *rs; 748 struct pf_rule *rule; 749 750 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 751 return (EINVAL); 752 rs = pf_find_or_create_ruleset(anchor, ruleset); 753 if (rs == NULL) 754 return (EINVAL); 755 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 756 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 757 *ticket = ++rs->rules[rs_num].inactive.ticket; 758 rs->rules[rs_num].inactive.open = 1; 759 return (0); 760 } 761 762 int 763 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor, char *ruleset) 764 { 765 struct pf_ruleset *rs; 766 struct pf_rule *rule; 767 768 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 769 return (EINVAL); 770 rs = pf_find_ruleset(anchor, ruleset); 771 if (rs == NULL || !rs->rules[rs_num].inactive.open || 772 rs->rules[rs_num].inactive.ticket != ticket) 773 return (0); 774 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) 775 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 776 rs->rules[rs_num].inactive.open = 0; 777 return (0); 778 } 779 780 int 781 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor, char *ruleset) 782 { 783 struct pf_ruleset *rs; 784 struct pf_rule *rule; 785 struct pf_rulequeue *old_rules; 786 int s; 787 788 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 789 return (EINVAL); 790 rs = pf_find_ruleset(anchor, ruleset); 791 if (rs == NULL || !rs->rules[rs_num].inactive.open || 792 ticket != rs->rules[rs_num].inactive.ticket) 793 return (EBUSY); 794 795 /* Swap rules, keep the old. */ 796 s = splsoftnet(); 797 old_rules = rs->rules[rs_num].active.ptr; 798 rs->rules[rs_num].active.ptr = 799 rs->rules[rs_num].inactive.ptr; 800 rs->rules[rs_num].inactive.ptr = old_rules; 801 rs->rules[rs_num].active.ticket = 802 rs->rules[rs_num].inactive.ticket; 803 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 804 805 /* Purge the old rule list. */ 806 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 807 pf_rm_rule(old_rules, rule); 808 rs->rules[rs_num].inactive.open = 0; 809 pf_remove_if_empty_ruleset(rs); 810 pf_update_anchor_rules(); 811 splx(s); 812 return (0); 813 } 814 815 int 816 pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p) 817 { 818 struct pf_pooladdr *pa = NULL; 819 struct pf_pool *pool = NULL; 820 int s; 821 int error = 0; 822 823 /* XXX keep in sync with switch() below */ 824 if (securelevel > 1) 825 switch (cmd) { 826 case DIOCGETRULES: 827 case DIOCGETRULE: 828 case DIOCGETADDRS: 829 case DIOCGETADDR: 830 case DIOCGETSTATE: 831 case DIOCSETSTATUSIF: 832 case DIOCGETSTATUS: 833 case DIOCCLRSTATUS: 834 case DIOCNATLOOK: 835 case DIOCSETDEBUG: 836 case DIOCGETSTATES: 837 case DIOCGETTIMEOUT: 838 case DIOCCLRRULECTRS: 839 case DIOCGETLIMIT: 840 case DIOCGETALTQS: 841 case DIOCGETALTQ: 842 case DIOCGETQSTATS: 843 case DIOCGETANCHORS: 844 case DIOCGETANCHOR: 845 case DIOCGETRULESETS: 846 case DIOCGETRULESET: 847 case DIOCRGETTABLES: 848 case DIOCRGETTSTATS: 849 case DIOCRCLRTSTATS: 850 case DIOCRCLRADDRS: 851 case DIOCRADDADDRS: 852 case DIOCRDELADDRS: 853 case DIOCRSETADDRS: 854 case DIOCRGETADDRS: 855 case DIOCRGETASTATS: 856 case DIOCRCLRASTATS: 857 case DIOCRTSTADDRS: 858 case DIOCOSFPGET: 859 case DIOCGETSRCNODES: 860 case DIOCCLRSRCNODES: 861 case DIOCIGETIFACES: 862 case DIOCICLRISTATS: 863 break; 864 case DIOCRCLRTABLES: 865 case DIOCRADDTABLES: 866 case DIOCRDELTABLES: 867 case DIOCRSETTFLAGS: 868 if (((struct pfioc_table *)addr)->pfrio_flags & 869 PFR_FLAG_DUMMY) 870 break; /* dummy operation ok */ 871 return (EPERM); 872 default: 873 return (EPERM); 874 } 875 876 if (!(flags & FWRITE)) 877 switch (cmd) { 878 case DIOCGETRULES: 879 case DIOCGETRULE: 880 case DIOCGETADDRS: 881 case DIOCGETADDR: 882 case DIOCGETSTATE: 883 case DIOCGETSTATUS: 884 case DIOCGETSTATES: 885 case DIOCGETTIMEOUT: 886 case DIOCGETLIMIT: 887 case DIOCGETALTQS: 888 case DIOCGETALTQ: 889 case DIOCGETQSTATS: 890 case DIOCGETANCHORS: 891 case DIOCGETANCHOR: 892 case DIOCGETRULESETS: 893 case DIOCGETRULESET: 894 case DIOCRGETTABLES: 895 case DIOCRGETTSTATS: 896 case DIOCRGETADDRS: 897 case DIOCRGETASTATS: 898 case DIOCRTSTADDRS: 899 case DIOCOSFPGET: 900 case DIOCGETSRCNODES: 901 case DIOCIGETIFACES: 902 break; 903 case DIOCRCLRTABLES: 904 case DIOCRADDTABLES: 905 case DIOCRDELTABLES: 906 case DIOCRCLRTSTATS: 907 case DIOCRCLRADDRS: 908 case DIOCRADDADDRS: 909 case DIOCRDELADDRS: 910 case DIOCRSETADDRS: 911 case DIOCRSETTFLAGS: 912 if (((struct pfioc_table *)addr)->pfrio_flags & 913 PFR_FLAG_DUMMY) 914 break; /* dummy operation ok */ 915 return (EACCES); 916 default: 917 return (EACCES); 918 } 919 920 switch (cmd) { 921 922 case DIOCSTART: 923 if (pf_status.running) 924 error = EEXIST; 925 else { 926 #ifdef __NetBSD__ 927 error = pf_pfil_attach(); 928 if (error) 929 break; 930 #endif 931 pf_status.running = 1; 932 pf_status.since = time.tv_sec; 933 if (pf_status.stateid == 0) { 934 pf_status.stateid = time.tv_sec; 935 pf_status.stateid = pf_status.stateid << 32; 936 } 937 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 938 } 939 break; 940 941 case DIOCSTOP: 942 if (!pf_status.running) 943 error = ENOENT; 944 else { 945 #ifdef __NetBSD__ 946 error = pf_pfil_detach(); 947 if (error) 948 break; 949 #endif 950 pf_status.running = 0; 951 pf_status.since = time.tv_sec; 952 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 953 } 954 break; 955 956 case DIOCBEGINRULES: { 957 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 958 959 error = pf_begin_rules(&pr->ticket, pf_get_ruleset_number( 960 pr->rule.action), pr->anchor, pr->ruleset); 961 break; 962 } 963 964 case DIOCADDRULE: { 965 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 966 struct pf_ruleset *ruleset; 967 struct pf_rule *rule, *tail; 968 struct pf_pooladdr *pa; 969 int rs_num; 970 971 ruleset = pf_find_ruleset(pr->anchor, pr->ruleset); 972 if (ruleset == NULL) { 973 error = EINVAL; 974 break; 975 } 976 rs_num = pf_get_ruleset_number(pr->rule.action); 977 if (rs_num >= PF_RULESET_MAX) { 978 error = EINVAL; 979 break; 980 } 981 if (pr->rule.anchorname[0] && ruleset != &pf_main_ruleset) { 982 error = EINVAL; 983 break; 984 } 985 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 986 error = EINVAL; 987 break; 988 } 989 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 990 error = EBUSY; 991 break; 992 } 993 if (pr->pool_ticket != ticket_pabuf) { 994 error = EBUSY; 995 break; 996 } 997 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 998 if (rule == NULL) { 999 error = ENOMEM; 1000 break; 1001 } 1002 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1003 rule->anchor = NULL; 1004 rule->kif = NULL; 1005 TAILQ_INIT(&rule->rpool.list); 1006 /* initialize refcounting */ 1007 rule->states = 0; 1008 rule->src_nodes = 0; 1009 rule->entries.tqe_prev = NULL; 1010 #ifndef INET 1011 if (rule->af == AF_INET) { 1012 pool_put(&pf_rule_pl, rule); 1013 error = EAFNOSUPPORT; 1014 break; 1015 } 1016 #endif /* INET */ 1017 #ifndef INET6 1018 if (rule->af == AF_INET6) { 1019 pool_put(&pf_rule_pl, rule); 1020 error = EAFNOSUPPORT; 1021 break; 1022 } 1023 #endif /* INET6 */ 1024 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1025 pf_rulequeue); 1026 if (tail) 1027 rule->nr = tail->nr + 1; 1028 else 1029 rule->nr = 0; 1030 if (rule->ifname[0]) { 1031 rule->kif = pfi_attach_rule(rule->ifname); 1032 if (rule->kif == NULL) { 1033 pool_put(&pf_rule_pl, rule); 1034 error = EINVAL; 1035 break; 1036 } 1037 } 1038 1039 #ifdef ALTQ 1040 /* set queue IDs */ 1041 if (rule->qname[0] != 0) { 1042 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1043 error = EBUSY; 1044 else if (rule->pqname[0] != 0) { 1045 if ((rule->pqid = 1046 pf_qname2qid(rule->pqname)) == 0) 1047 error = EBUSY; 1048 } else 1049 rule->pqid = rule->qid; 1050 } 1051 #endif 1052 if (rule->tagname[0]) 1053 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1054 error = EBUSY; 1055 if (rule->match_tagname[0]) 1056 if ((rule->match_tag = 1057 pf_tagname2tag(rule->match_tagname)) == 0) 1058 error = EBUSY; 1059 if (rule->rt && !rule->direction) 1060 error = EINVAL; 1061 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1062 error = EINVAL; 1063 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1064 error = EINVAL; 1065 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1066 error = EINVAL; 1067 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1068 error = EINVAL; 1069 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1070 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1071 error = EINVAL; 1072 1073 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1074 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1075 (rule->action == PF_BINAT)) && !rule->anchorname[0]) || 1076 (rule->rt > PF_FASTROUTE)) && 1077 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1078 error = EINVAL; 1079 1080 if (error) { 1081 pf_rm_rule(NULL, rule); 1082 break; 1083 } 1084 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1085 rule->evaluations = rule->packets = rule->bytes = 0; 1086 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1087 rule, entries); 1088 break; 1089 } 1090 1091 case DIOCCOMMITRULES: { 1092 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1093 1094 error = pf_commit_rules(pr->ticket, pf_get_ruleset_number( 1095 pr->rule.action), pr->anchor, pr->ruleset); 1096 break; 1097 } 1098 1099 case DIOCGETRULES: { 1100 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1101 struct pf_ruleset *ruleset; 1102 struct pf_rule *tail; 1103 int rs_num; 1104 1105 ruleset = pf_find_ruleset(pr->anchor, pr->ruleset); 1106 if (ruleset == NULL) { 1107 error = EINVAL; 1108 break; 1109 } 1110 rs_num = pf_get_ruleset_number(pr->rule.action); 1111 if (rs_num >= PF_RULESET_MAX) { 1112 error = EINVAL; 1113 break; 1114 } 1115 s = splsoftnet(); 1116 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1117 pf_rulequeue); 1118 if (tail) 1119 pr->nr = tail->nr + 1; 1120 else 1121 pr->nr = 0; 1122 pr->ticket = ruleset->rules[rs_num].active.ticket; 1123 splx(s); 1124 break; 1125 } 1126 1127 case DIOCGETRULE: { 1128 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1129 struct pf_ruleset *ruleset; 1130 struct pf_rule *rule; 1131 int rs_num, i; 1132 1133 ruleset = pf_find_ruleset(pr->anchor, pr->ruleset); 1134 if (ruleset == NULL) { 1135 error = EINVAL; 1136 break; 1137 } 1138 rs_num = pf_get_ruleset_number(pr->rule.action); 1139 if (rs_num >= PF_RULESET_MAX) { 1140 error = EINVAL; 1141 break; 1142 } 1143 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1144 error = EBUSY; 1145 break; 1146 } 1147 s = splsoftnet(); 1148 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1149 while ((rule != NULL) && (rule->nr != pr->nr)) 1150 rule = TAILQ_NEXT(rule, entries); 1151 if (rule == NULL) { 1152 error = EBUSY; 1153 splx(s); 1154 break; 1155 } 1156 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1157 pfi_dynaddr_copyout(&pr->rule.src.addr); 1158 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1159 pf_tbladdr_copyout(&pr->rule.src.addr); 1160 pf_tbladdr_copyout(&pr->rule.dst.addr); 1161 for (i = 0; i < PF_SKIP_COUNT; ++i) 1162 if (rule->skip[i].ptr == NULL) 1163 pr->rule.skip[i].nr = -1; 1164 else 1165 pr->rule.skip[i].nr = 1166 rule->skip[i].ptr->nr; 1167 splx(s); 1168 break; 1169 } 1170 1171 case DIOCCHANGERULE: { 1172 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1173 struct pf_ruleset *ruleset; 1174 struct pf_rule *oldrule = NULL, *newrule = NULL; 1175 u_int32_t nr = 0; 1176 int rs_num; 1177 1178 if (!(pcr->action == PF_CHANGE_REMOVE || 1179 pcr->action == PF_CHANGE_GET_TICKET) && 1180 pcr->pool_ticket != ticket_pabuf) { 1181 error = EBUSY; 1182 break; 1183 } 1184 1185 if (pcr->action < PF_CHANGE_ADD_HEAD || 1186 pcr->action > PF_CHANGE_GET_TICKET) { 1187 error = EINVAL; 1188 break; 1189 } 1190 ruleset = pf_find_ruleset(pcr->anchor, pcr->ruleset); 1191 if (ruleset == NULL) { 1192 error = EINVAL; 1193 break; 1194 } 1195 rs_num = pf_get_ruleset_number(pcr->rule.action); 1196 if (rs_num >= PF_RULESET_MAX) { 1197 error = EINVAL; 1198 break; 1199 } 1200 1201 if (pcr->action == PF_CHANGE_GET_TICKET) { 1202 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1203 break; 1204 } else { 1205 if (pcr->ticket != 1206 ruleset->rules[rs_num].active.ticket) { 1207 error = EINVAL; 1208 break; 1209 } 1210 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1211 error = EINVAL; 1212 break; 1213 } 1214 } 1215 1216 if (pcr->action != PF_CHANGE_REMOVE) { 1217 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1218 if (newrule == NULL) { 1219 error = ENOMEM; 1220 break; 1221 } 1222 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1223 TAILQ_INIT(&newrule->rpool.list); 1224 /* initialize refcounting */ 1225 newrule->states = 0; 1226 newrule->entries.tqe_prev = NULL; 1227 #ifndef INET 1228 if (newrule->af == AF_INET) { 1229 pool_put(&pf_rule_pl, newrule); 1230 error = EAFNOSUPPORT; 1231 break; 1232 } 1233 #endif /* INET */ 1234 #ifndef INET6 1235 if (newrule->af == AF_INET6) { 1236 pool_put(&pf_rule_pl, newrule); 1237 error = EAFNOSUPPORT; 1238 break; 1239 } 1240 #endif /* INET6 */ 1241 if (newrule->ifname[0]) { 1242 newrule->kif = pfi_attach_rule(newrule->ifname); 1243 if (newrule->kif == NULL) { 1244 pool_put(&pf_rule_pl, newrule); 1245 error = EINVAL; 1246 break; 1247 } 1248 } else 1249 newrule->kif = NULL; 1250 1251 #ifdef ALTQ 1252 /* set queue IDs */ 1253 if (newrule->qname[0] != 0) { 1254 if ((newrule->qid = 1255 pf_qname2qid(newrule->qname)) == 0) 1256 error = EBUSY; 1257 else if (newrule->pqname[0] != 0) { 1258 if ((newrule->pqid = 1259 pf_qname2qid(newrule->pqname)) == 0) 1260 error = EBUSY; 1261 } else 1262 newrule->pqid = newrule->qid; 1263 } 1264 #endif 1265 if (newrule->tagname[0]) 1266 if ((newrule->tag = 1267 pf_tagname2tag(newrule->tagname)) == 0) 1268 error = EBUSY; 1269 if (newrule->match_tagname[0]) 1270 if ((newrule->match_tag = pf_tagname2tag( 1271 newrule->match_tagname)) == 0) 1272 error = EBUSY; 1273 1274 if (newrule->rt && !newrule->direction) 1275 error = EINVAL; 1276 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1277 error = EINVAL; 1278 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1279 error = EINVAL; 1280 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1281 error = EINVAL; 1282 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1283 error = EINVAL; 1284 1285 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1286 if (((((newrule->action == PF_NAT) || 1287 (newrule->action == PF_RDR) || 1288 (newrule->action == PF_BINAT) || 1289 (newrule->rt > PF_FASTROUTE)) && 1290 !newrule->anchorname[0])) && 1291 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1292 error = EINVAL; 1293 1294 if (error) { 1295 pf_rm_rule(NULL, newrule); 1296 break; 1297 } 1298 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1299 newrule->evaluations = newrule->packets = 0; 1300 newrule->bytes = 0; 1301 } 1302 pf_empty_pool(&pf_pabuf); 1303 1304 s = splsoftnet(); 1305 1306 if (pcr->action == PF_CHANGE_ADD_HEAD) 1307 oldrule = TAILQ_FIRST( 1308 ruleset->rules[rs_num].active.ptr); 1309 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1310 oldrule = TAILQ_LAST( 1311 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1312 else { 1313 oldrule = TAILQ_FIRST( 1314 ruleset->rules[rs_num].active.ptr); 1315 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1316 oldrule = TAILQ_NEXT(oldrule, entries); 1317 if (oldrule == NULL) { 1318 pf_rm_rule(NULL, newrule); 1319 error = EINVAL; 1320 splx(s); 1321 break; 1322 } 1323 } 1324 1325 if (pcr->action == PF_CHANGE_REMOVE) 1326 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1327 else { 1328 if (oldrule == NULL) 1329 TAILQ_INSERT_TAIL( 1330 ruleset->rules[rs_num].active.ptr, 1331 newrule, entries); 1332 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1333 pcr->action == PF_CHANGE_ADD_BEFORE) 1334 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1335 else 1336 TAILQ_INSERT_AFTER( 1337 ruleset->rules[rs_num].active.ptr, 1338 oldrule, newrule, entries); 1339 } 1340 1341 nr = 0; 1342 TAILQ_FOREACH(oldrule, 1343 ruleset->rules[rs_num].active.ptr, entries) 1344 oldrule->nr = nr++; 1345 1346 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1347 pf_remove_if_empty_ruleset(ruleset); 1348 pf_update_anchor_rules(); 1349 1350 ruleset->rules[rs_num].active.ticket++; 1351 splx(s); 1352 break; 1353 } 1354 1355 case DIOCCLRSTATES: { 1356 struct pf_state *state; 1357 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1358 int killed = 0; 1359 1360 s = splsoftnet(); 1361 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1362 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1363 state->u.s.kif->pfik_name)) { 1364 state->timeout = PFTM_PURGE; 1365 #if NPFSYNC 1366 /* don't send out individual delete messages */ 1367 state->sync_flags = PFSTATE_NOSYNC; 1368 #endif 1369 killed++; 1370 } 1371 } 1372 pf_purge_expired_states(); 1373 pf_status.states = 0; 1374 psk->psk_af = killed; 1375 #if NPFSYNC 1376 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1377 #endif 1378 splx(s); 1379 break; 1380 } 1381 1382 case DIOCKILLSTATES: { 1383 struct pf_state *state; 1384 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1385 int killed = 0; 1386 1387 s = splsoftnet(); 1388 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1389 if ((!psk->psk_af || state->af == psk->psk_af) 1390 && (!psk->psk_proto || psk->psk_proto == 1391 state->proto) && 1392 PF_MATCHA(psk->psk_src.not, 1393 &psk->psk_src.addr.v.a.addr, 1394 &psk->psk_src.addr.v.a.mask, 1395 &state->lan.addr, state->af) && 1396 PF_MATCHA(psk->psk_dst.not, 1397 &psk->psk_dst.addr.v.a.addr, 1398 &psk->psk_dst.addr.v.a.mask, 1399 &state->ext.addr, state->af) && 1400 (psk->psk_src.port_op == 0 || 1401 pf_match_port(psk->psk_src.port_op, 1402 psk->psk_src.port[0], psk->psk_src.port[1], 1403 state->lan.port)) && 1404 (psk->psk_dst.port_op == 0 || 1405 pf_match_port(psk->psk_dst.port_op, 1406 psk->psk_dst.port[0], psk->psk_dst.port[1], 1407 state->ext.port)) && 1408 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1409 state->u.s.kif->pfik_name))) { 1410 state->timeout = PFTM_PURGE; 1411 killed++; 1412 } 1413 } 1414 pf_purge_expired_states(); 1415 splx(s); 1416 psk->psk_af = killed; 1417 break; 1418 } 1419 1420 case DIOCADDSTATE: { 1421 struct pfioc_state *ps = (struct pfioc_state *)addr; 1422 struct pf_state *state; 1423 struct pfi_kif *kif; 1424 1425 if (ps->state.timeout >= PFTM_MAX && 1426 ps->state.timeout != PFTM_UNTIL_PACKET) { 1427 error = EINVAL; 1428 break; 1429 } 1430 state = pool_get(&pf_state_pl, PR_NOWAIT); 1431 if (state == NULL) { 1432 error = ENOMEM; 1433 break; 1434 } 1435 s = splsoftnet(); 1436 kif = pfi_lookup_create(ps->state.u.ifname); 1437 if (kif == NULL) { 1438 pool_put(&pf_state_pl, state); 1439 error = ENOENT; 1440 splx(s); 1441 break; 1442 } 1443 bcopy(&ps->state, state, sizeof(struct pf_state)); 1444 bzero(&state->u, sizeof(state->u)); 1445 state->rule.ptr = &pf_default_rule; 1446 state->nat_rule.ptr = NULL; 1447 state->anchor.ptr = NULL; 1448 state->rt_kif = NULL; 1449 state->creation = time.tv_sec; 1450 state->pfsync_time = 0; 1451 state->packets[0] = state->packets[1] = 0; 1452 state->bytes[0] = state->bytes[1] = 0; 1453 1454 if (pf_insert_state(kif, state)) { 1455 pfi_maybe_destroy(kif); 1456 pool_put(&pf_state_pl, state); 1457 error = ENOMEM; 1458 } 1459 splx(s); 1460 break; 1461 } 1462 1463 case DIOCGETSTATE: { 1464 struct pfioc_state *ps = (struct pfioc_state *)addr; 1465 struct pf_state *state; 1466 u_int32_t nr; 1467 1468 nr = 0; 1469 s = splsoftnet(); 1470 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 1471 if (nr >= ps->nr) 1472 break; 1473 nr++; 1474 } 1475 if (state == NULL) { 1476 error = EBUSY; 1477 splx(s); 1478 break; 1479 } 1480 bcopy(state, &ps->state, sizeof(struct pf_state)); 1481 ps->state.rule.nr = state->rule.ptr->nr; 1482 ps->state.nat_rule.nr = (state->nat_rule.ptr == NULL) ? 1483 -1 : state->nat_rule.ptr->nr; 1484 ps->state.anchor.nr = (state->anchor.ptr == NULL) ? 1485 -1 : state->anchor.ptr->nr; 1486 splx(s); 1487 ps->state.expire = pf_state_expires(state); 1488 if (ps->state.expire > time.tv_sec) 1489 ps->state.expire -= time.tv_sec; 1490 else 1491 ps->state.expire = 0; 1492 break; 1493 } 1494 1495 case DIOCGETSTATES: { 1496 struct pfioc_states *ps = (struct pfioc_states *)addr; 1497 struct pf_state *state; 1498 struct pf_state *p, pstore; 1499 struct pfi_kif *kif; 1500 u_int32_t nr = 0; 1501 int space = ps->ps_len; 1502 1503 if (space == 0) { 1504 s = splsoftnet(); 1505 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1506 nr += kif->pfik_states; 1507 splx(s); 1508 ps->ps_len = sizeof(struct pf_state) * nr; 1509 return (0); 1510 } 1511 1512 s = splsoftnet(); 1513 p = ps->ps_states; 1514 TAILQ_FOREACH(kif, &pfi_statehead, pfik_w_states) 1515 RB_FOREACH(state, pf_state_tree_ext_gwy, 1516 &kif->pfik_ext_gwy) { 1517 int secs = time.tv_sec; 1518 1519 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1520 break; 1521 1522 bcopy(state, &pstore, sizeof(pstore)); 1523 strlcpy(pstore.u.ifname, kif->pfik_name, 1524 sizeof(pstore.u.ifname)); 1525 pstore.rule.nr = state->rule.ptr->nr; 1526 pstore.nat_rule.nr = (state->nat_rule.ptr == 1527 NULL) ? -1 : state->nat_rule.ptr->nr; 1528 pstore.anchor.nr = (state->anchor.ptr == 1529 NULL) ? -1 : state->anchor.ptr->nr; 1530 pstore.creation = secs - pstore.creation; 1531 pstore.expire = pf_state_expires(state); 1532 if (pstore.expire > secs) 1533 pstore.expire -= secs; 1534 else 1535 pstore.expire = 0; 1536 error = copyout(&pstore, p, sizeof(*p)); 1537 if (error) { 1538 splx(s); 1539 goto fail; 1540 } 1541 p++; 1542 nr++; 1543 } 1544 ps->ps_len = sizeof(struct pf_state) * nr; 1545 splx(s); 1546 break; 1547 } 1548 1549 case DIOCGETSTATUS: { 1550 struct pf_status *s = (struct pf_status *)addr; 1551 bcopy(&pf_status, s, sizeof(struct pf_status)); 1552 pfi_fill_oldstatus(s); 1553 break; 1554 } 1555 1556 case DIOCSETSTATUSIF: { 1557 struct pfioc_if *pi = (struct pfioc_if *)addr; 1558 1559 if (pi->ifname[0] == 0) { 1560 bzero(pf_status.ifname, IFNAMSIZ); 1561 break; 1562 } 1563 if (ifunit(pi->ifname) == NULL) { 1564 error = EINVAL; 1565 break; 1566 } 1567 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 1568 break; 1569 } 1570 1571 case DIOCCLRSTATUS: { 1572 bzero(pf_status.counters, sizeof(pf_status.counters)); 1573 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 1574 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 1575 if (*pf_status.ifname) 1576 pfi_clr_istats(pf_status.ifname, NULL, 1577 PFI_FLAG_INSTANCE); 1578 break; 1579 } 1580 1581 case DIOCNATLOOK: { 1582 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1583 struct pf_state *state; 1584 struct pf_state key; 1585 int m = 0, direction = pnl->direction; 1586 1587 key.af = pnl->af; 1588 key.proto = pnl->proto; 1589 1590 if (!pnl->proto || 1591 PF_AZERO(&pnl->saddr, pnl->af) || 1592 PF_AZERO(&pnl->daddr, pnl->af) || 1593 !pnl->dport || !pnl->sport) 1594 error = EINVAL; 1595 else { 1596 s = splsoftnet(); 1597 1598 /* 1599 * userland gives us source and dest of connection, 1600 * reverse the lookup so we ask for what happens with 1601 * the return traffic, enabling us to find it in the 1602 * state tree. 1603 */ 1604 if (direction == PF_IN) { 1605 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 1606 key.ext.port = pnl->dport; 1607 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 1608 key.gwy.port = pnl->sport; 1609 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 1610 } else { 1611 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 1612 key.lan.port = pnl->dport; 1613 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 1614 key.ext.port = pnl->sport; 1615 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 1616 } 1617 if (m > 1) 1618 error = E2BIG; /* more than one state */ 1619 else if (state != NULL) { 1620 if (direction == PF_IN) { 1621 PF_ACPY(&pnl->rsaddr, &state->lan.addr, 1622 state->af); 1623 pnl->rsport = state->lan.port; 1624 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 1625 pnl->af); 1626 pnl->rdport = pnl->dport; 1627 } else { 1628 PF_ACPY(&pnl->rdaddr, &state->gwy.addr, 1629 state->af); 1630 pnl->rdport = state->gwy.port; 1631 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 1632 pnl->af); 1633 pnl->rsport = pnl->sport; 1634 } 1635 } else 1636 error = ENOENT; 1637 splx(s); 1638 } 1639 break; 1640 } 1641 1642 case DIOCSETTIMEOUT: { 1643 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1644 int old; 1645 1646 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1647 pt->seconds < 0) { 1648 error = EINVAL; 1649 goto fail; 1650 } 1651 old = pf_default_rule.timeout[pt->timeout]; 1652 pf_default_rule.timeout[pt->timeout] = pt->seconds; 1653 pt->seconds = old; 1654 break; 1655 } 1656 1657 case DIOCGETTIMEOUT: { 1658 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1659 1660 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1661 error = EINVAL; 1662 goto fail; 1663 } 1664 pt->seconds = pf_default_rule.timeout[pt->timeout]; 1665 break; 1666 } 1667 1668 case DIOCGETLIMIT: { 1669 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1670 1671 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1672 error = EINVAL; 1673 goto fail; 1674 } 1675 pl->limit = pf_pool_limits[pl->index].limit; 1676 break; 1677 } 1678 1679 case DIOCSETLIMIT: { 1680 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1681 int old_limit; 1682 1683 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1684 pf_pool_limits[pl->index].pp == NULL) { 1685 error = EINVAL; 1686 goto fail; 1687 } 1688 #ifdef __OpenBSD__ 1689 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 1690 pl->limit, NULL, 0) != 0) { 1691 error = EBUSY; 1692 goto fail; 1693 } 1694 #else 1695 pool_sethardlimit(pf_pool_limits[pl->index].pp, 1696 pl->limit, NULL, 0); 1697 #endif 1698 old_limit = pf_pool_limits[pl->index].limit; 1699 pf_pool_limits[pl->index].limit = pl->limit; 1700 pl->limit = old_limit; 1701 break; 1702 } 1703 1704 case DIOCSETDEBUG: { 1705 u_int32_t *level = (u_int32_t *)addr; 1706 1707 pf_status.debug = *level; 1708 break; 1709 } 1710 1711 case DIOCCLRRULECTRS: { 1712 struct pf_ruleset *ruleset = &pf_main_ruleset; 1713 struct pf_rule *rule; 1714 1715 s = splsoftnet(); 1716 TAILQ_FOREACH(rule, 1717 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) 1718 rule->evaluations = rule->packets = 1719 rule->bytes = 0; 1720 splx(s); 1721 break; 1722 } 1723 1724 #ifdef ALTQ 1725 case DIOCSTARTALTQ: { 1726 struct pf_altq *altq; 1727 struct ifnet *ifp; 1728 struct tb_profile tb; 1729 1730 /* enable all altq interfaces on active list */ 1731 s = splsoftnet(); 1732 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1733 if (altq->qname[0] == 0) { 1734 if ((ifp = ifunit(altq->ifname)) == NULL) { 1735 error = EINVAL; 1736 break; 1737 } 1738 if (ifp->if_snd.altq_type != ALTQT_NONE) 1739 error = altq_enable(&ifp->if_snd); 1740 if (error != 0) 1741 break; 1742 /* set tokenbucket regulator */ 1743 tb.rate = altq->ifbandwidth; 1744 tb.depth = altq->tbrsize; 1745 error = tbr_set(&ifp->if_snd, &tb); 1746 if (error != 0) 1747 break; 1748 } 1749 } 1750 if (error == 0) 1751 pfaltq_running = 1; 1752 splx(s); 1753 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 1754 break; 1755 } 1756 1757 case DIOCSTOPALTQ: { 1758 struct pf_altq *altq; 1759 struct ifnet *ifp; 1760 struct tb_profile tb; 1761 int err; 1762 1763 /* disable all altq interfaces on active list */ 1764 s = splsoftnet(); 1765 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 1766 if (altq->qname[0] == 0) { 1767 if ((ifp = ifunit(altq->ifname)) == NULL) { 1768 error = EINVAL; 1769 break; 1770 } 1771 if (ifp->if_snd.altq_type != ALTQT_NONE) { 1772 err = altq_disable(&ifp->if_snd); 1773 if (err != 0 && error == 0) 1774 error = err; 1775 } 1776 /* clear tokenbucket regulator */ 1777 tb.rate = 0; 1778 err = tbr_set(&ifp->if_snd, &tb); 1779 if (err != 0 && error == 0) 1780 error = err; 1781 } 1782 } 1783 if (error == 0) 1784 pfaltq_running = 0; 1785 splx(s); 1786 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 1787 break; 1788 } 1789 1790 case DIOCBEGINALTQS: { 1791 u_int32_t *ticket = (u_int32_t *)addr; 1792 1793 error = pf_begin_altq(ticket); 1794 break; 1795 } 1796 1797 case DIOCADDALTQ: { 1798 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1799 struct pf_altq *altq, *a; 1800 1801 if (pa->ticket != ticket_altqs_inactive) { 1802 error = EBUSY; 1803 break; 1804 } 1805 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 1806 if (altq == NULL) { 1807 error = ENOMEM; 1808 break; 1809 } 1810 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 1811 1812 /* 1813 * if this is for a queue, find the discipline and 1814 * copy the necessary fields 1815 */ 1816 if (altq->qname[0] != 0) { 1817 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 1818 error = EBUSY; 1819 pool_put(&pf_altq_pl, altq); 1820 break; 1821 } 1822 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 1823 if (strncmp(a->ifname, altq->ifname, 1824 IFNAMSIZ) == 0 && a->qname[0] == 0) { 1825 altq->altq_disc = a->altq_disc; 1826 break; 1827 } 1828 } 1829 } 1830 1831 error = altq_add(altq); 1832 if (error) { 1833 pool_put(&pf_altq_pl, altq); 1834 break; 1835 } 1836 1837 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 1838 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1839 break; 1840 } 1841 1842 case DIOCCOMMITALTQS: { 1843 u_int32_t ticket = *(u_int32_t *)addr; 1844 1845 error = pf_commit_altq(ticket); 1846 break; 1847 } 1848 1849 case DIOCGETALTQS: { 1850 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1851 struct pf_altq *altq; 1852 1853 pa->nr = 0; 1854 s = splsoftnet(); 1855 TAILQ_FOREACH(altq, pf_altqs_active, entries) 1856 pa->nr++; 1857 pa->ticket = ticket_altqs_active; 1858 splx(s); 1859 break; 1860 } 1861 1862 case DIOCGETALTQ: { 1863 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1864 struct pf_altq *altq; 1865 u_int32_t nr; 1866 1867 if (pa->ticket != ticket_altqs_active) { 1868 error = EBUSY; 1869 break; 1870 } 1871 nr = 0; 1872 s = splsoftnet(); 1873 altq = TAILQ_FIRST(pf_altqs_active); 1874 while ((altq != NULL) && (nr < pa->nr)) { 1875 altq = TAILQ_NEXT(altq, entries); 1876 nr++; 1877 } 1878 if (altq == NULL) { 1879 error = EBUSY; 1880 splx(s); 1881 break; 1882 } 1883 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 1884 splx(s); 1885 break; 1886 } 1887 1888 case DIOCCHANGEALTQ: 1889 /* CHANGEALTQ not supported yet! */ 1890 error = ENODEV; 1891 break; 1892 1893 case DIOCGETQSTATS: { 1894 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 1895 struct pf_altq *altq; 1896 u_int32_t nr; 1897 int nbytes; 1898 1899 if (pq->ticket != ticket_altqs_active) { 1900 error = EBUSY; 1901 break; 1902 } 1903 nbytes = pq->nbytes; 1904 nr = 0; 1905 s = splsoftnet(); 1906 altq = TAILQ_FIRST(pf_altqs_active); 1907 while ((altq != NULL) && (nr < pq->nr)) { 1908 altq = TAILQ_NEXT(altq, entries); 1909 nr++; 1910 } 1911 if (altq == NULL) { 1912 error = EBUSY; 1913 splx(s); 1914 break; 1915 } 1916 error = altq_getqstats(altq, pq->buf, &nbytes); 1917 splx(s); 1918 if (error == 0) { 1919 pq->scheduler = altq->scheduler; 1920 pq->nbytes = nbytes; 1921 } 1922 break; 1923 } 1924 #endif /* ALTQ */ 1925 1926 case DIOCBEGINADDRS: { 1927 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 1928 1929 pf_empty_pool(&pf_pabuf); 1930 pp->ticket = ++ticket_pabuf; 1931 break; 1932 } 1933 1934 case DIOCADDADDR: { 1935 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 1936 1937 #ifndef INET 1938 if (pp->af == AF_INET) { 1939 error = EAFNOSUPPORT; 1940 break; 1941 } 1942 #endif /* INET */ 1943 #ifndef INET6 1944 if (pp->af == AF_INET6) { 1945 error = EAFNOSUPPORT; 1946 break; 1947 } 1948 #endif /* INET6 */ 1949 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 1950 pp->addr.addr.type != PF_ADDR_DYNIFTL && 1951 pp->addr.addr.type != PF_ADDR_TABLE) { 1952 error = EINVAL; 1953 break; 1954 } 1955 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 1956 if (pa == NULL) { 1957 error = ENOMEM; 1958 break; 1959 } 1960 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 1961 if (pa->ifname[0]) { 1962 pa->kif = pfi_attach_rule(pa->ifname); 1963 if (pa->kif == NULL) { 1964 pool_put(&pf_pooladdr_pl, pa); 1965 error = EINVAL; 1966 break; 1967 } 1968 } 1969 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 1970 pfi_dynaddr_remove(&pa->addr); 1971 pfi_detach_rule(pa->kif); 1972 pool_put(&pf_pooladdr_pl, pa); 1973 error = EINVAL; 1974 break; 1975 } 1976 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 1977 break; 1978 } 1979 1980 case DIOCGETADDRS: { 1981 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 1982 1983 pp->nr = 0; 1984 s = splsoftnet(); 1985 pool = pf_get_pool(pp->anchor, pp->ruleset, pp->ticket, 1986 pp->r_action, pp->r_num, 0, 1, 0); 1987 if (pool == NULL) { 1988 error = EBUSY; 1989 splx(s); 1990 break; 1991 } 1992 TAILQ_FOREACH(pa, &pool->list, entries) 1993 pp->nr++; 1994 splx(s); 1995 break; 1996 } 1997 1998 case DIOCGETADDR: { 1999 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2000 u_int32_t nr = 0; 2001 2002 s = splsoftnet(); 2003 pool = pf_get_pool(pp->anchor, pp->ruleset, pp->ticket, 2004 pp->r_action, pp->r_num, 0, 1, 1); 2005 if (pool == NULL) { 2006 error = EBUSY; 2007 splx(s); 2008 break; 2009 } 2010 pa = TAILQ_FIRST(&pool->list); 2011 while ((pa != NULL) && (nr < pp->nr)) { 2012 pa = TAILQ_NEXT(pa, entries); 2013 nr++; 2014 } 2015 if (pa == NULL) { 2016 error = EBUSY; 2017 splx(s); 2018 break; 2019 } 2020 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2021 pfi_dynaddr_copyout(&pp->addr.addr); 2022 pf_tbladdr_copyout(&pp->addr.addr); 2023 splx(s); 2024 break; 2025 } 2026 2027 case DIOCCHANGEADDR: { 2028 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2029 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2030 struct pf_ruleset *ruleset; 2031 2032 if (pca->action < PF_CHANGE_ADD_HEAD || 2033 pca->action > PF_CHANGE_REMOVE) { 2034 error = EINVAL; 2035 break; 2036 } 2037 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2038 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2039 pca->addr.addr.type != PF_ADDR_TABLE) { 2040 error = EINVAL; 2041 break; 2042 } 2043 2044 ruleset = pf_find_ruleset(pca->anchor, pca->ruleset); 2045 if (ruleset == NULL) { 2046 error = EBUSY; 2047 break; 2048 } 2049 pool = pf_get_pool(pca->anchor, pca->ruleset, pca->ticket, 2050 pca->r_action, pca->r_num, pca->r_last, 1, 1); 2051 if (pool == NULL) { 2052 error = EBUSY; 2053 break; 2054 } 2055 if (pca->action != PF_CHANGE_REMOVE) { 2056 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2057 if (newpa == NULL) { 2058 error = ENOMEM; 2059 break; 2060 } 2061 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2062 #ifndef INET 2063 if (pca->af == AF_INET) { 2064 pool_put(&pf_pooladdr_pl, newpa); 2065 error = EAFNOSUPPORT; 2066 break; 2067 } 2068 #endif /* INET */ 2069 #ifndef INET6 2070 if (pca->af == AF_INET6) { 2071 pool_put(&pf_pooladdr_pl, newpa); 2072 error = EAFNOSUPPORT; 2073 break; 2074 } 2075 #endif /* INET6 */ 2076 if (newpa->ifname[0]) { 2077 newpa->kif = pfi_attach_rule(newpa->ifname); 2078 if (newpa->kif == NULL) { 2079 pool_put(&pf_pooladdr_pl, newpa); 2080 error = EINVAL; 2081 break; 2082 } 2083 } else 2084 newpa->kif = NULL; 2085 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2086 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2087 pfi_dynaddr_remove(&newpa->addr); 2088 pfi_detach_rule(newpa->kif); 2089 pool_put(&pf_pooladdr_pl, newpa); 2090 error = EINVAL; 2091 break; 2092 } 2093 } 2094 2095 s = splsoftnet(); 2096 2097 if (pca->action == PF_CHANGE_ADD_HEAD) 2098 oldpa = TAILQ_FIRST(&pool->list); 2099 else if (pca->action == PF_CHANGE_ADD_TAIL) 2100 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2101 else { 2102 int i = 0; 2103 2104 oldpa = TAILQ_FIRST(&pool->list); 2105 while ((oldpa != NULL) && (i < pca->nr)) { 2106 oldpa = TAILQ_NEXT(oldpa, entries); 2107 i++; 2108 } 2109 if (oldpa == NULL) { 2110 error = EINVAL; 2111 splx(s); 2112 break; 2113 } 2114 } 2115 2116 if (pca->action == PF_CHANGE_REMOVE) { 2117 TAILQ_REMOVE(&pool->list, oldpa, entries); 2118 pfi_dynaddr_remove(&oldpa->addr); 2119 pf_tbladdr_remove(&oldpa->addr); 2120 pfi_detach_rule(oldpa->kif); 2121 pool_put(&pf_pooladdr_pl, oldpa); 2122 } else { 2123 if (oldpa == NULL) 2124 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2125 else if (pca->action == PF_CHANGE_ADD_HEAD || 2126 pca->action == PF_CHANGE_ADD_BEFORE) 2127 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2128 else 2129 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2130 newpa, entries); 2131 } 2132 2133 pool->cur = TAILQ_FIRST(&pool->list); 2134 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2135 pca->af); 2136 splx(s); 2137 break; 2138 } 2139 2140 case DIOCGETANCHORS: { 2141 struct pfioc_anchor *pa = (struct pfioc_anchor *)addr; 2142 struct pf_anchor *anchor; 2143 2144 pa->nr = 0; 2145 TAILQ_FOREACH(anchor, &pf_anchors, entries) 2146 pa->nr++; 2147 break; 2148 } 2149 2150 case DIOCGETANCHOR: { 2151 struct pfioc_anchor *pa = (struct pfioc_anchor *)addr; 2152 struct pf_anchor *anchor; 2153 u_int32_t nr = 0; 2154 2155 anchor = TAILQ_FIRST(&pf_anchors); 2156 while (anchor != NULL && nr < pa->nr) { 2157 anchor = TAILQ_NEXT(anchor, entries); 2158 nr++; 2159 } 2160 if (anchor == NULL) 2161 error = EBUSY; 2162 else 2163 bcopy(anchor->name, pa->name, sizeof(pa->name)); 2164 break; 2165 } 2166 2167 case DIOCGETRULESETS: { 2168 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2169 struct pf_anchor *anchor; 2170 struct pf_ruleset *ruleset; 2171 2172 pr->anchor[PF_ANCHOR_NAME_SIZE-1] = 0; 2173 if ((anchor = pf_find_anchor(pr->anchor)) == NULL) { 2174 error = EINVAL; 2175 break; 2176 } 2177 pr->nr = 0; 2178 TAILQ_FOREACH(ruleset, &anchor->rulesets, entries) 2179 pr->nr++; 2180 break; 2181 } 2182 2183 case DIOCGETRULESET: { 2184 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2185 struct pf_anchor *anchor; 2186 struct pf_ruleset *ruleset; 2187 u_int32_t nr = 0; 2188 2189 if ((anchor = pf_find_anchor(pr->anchor)) == NULL) { 2190 error = EINVAL; 2191 break; 2192 } 2193 ruleset = TAILQ_FIRST(&anchor->rulesets); 2194 while (ruleset != NULL && nr < pr->nr) { 2195 ruleset = TAILQ_NEXT(ruleset, entries); 2196 nr++; 2197 } 2198 if (ruleset == NULL) 2199 error = EBUSY; 2200 else 2201 bcopy(ruleset->name, pr->name, sizeof(pr->name)); 2202 break; 2203 } 2204 2205 case DIOCRCLRTABLES: { 2206 struct pfioc_table *io = (struct pfioc_table *)addr; 2207 2208 if (io->pfrio_esize != 0) { 2209 error = ENODEV; 2210 break; 2211 } 2212 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2213 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2214 break; 2215 } 2216 2217 case DIOCRADDTABLES: { 2218 struct pfioc_table *io = (struct pfioc_table *)addr; 2219 2220 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2221 error = ENODEV; 2222 break; 2223 } 2224 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2225 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2226 break; 2227 } 2228 2229 case DIOCRDELTABLES: { 2230 struct pfioc_table *io = (struct pfioc_table *)addr; 2231 2232 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2233 error = ENODEV; 2234 break; 2235 } 2236 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2237 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2238 break; 2239 } 2240 2241 case DIOCRGETTABLES: { 2242 struct pfioc_table *io = (struct pfioc_table *)addr; 2243 2244 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2245 error = ENODEV; 2246 break; 2247 } 2248 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2249 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2250 break; 2251 } 2252 2253 case DIOCRGETTSTATS: { 2254 struct pfioc_table *io = (struct pfioc_table *)addr; 2255 2256 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2257 error = ENODEV; 2258 break; 2259 } 2260 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2261 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2262 break; 2263 } 2264 2265 case DIOCRCLRTSTATS: { 2266 struct pfioc_table *io = (struct pfioc_table *)addr; 2267 2268 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2269 error = ENODEV; 2270 break; 2271 } 2272 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2273 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2274 break; 2275 } 2276 2277 case DIOCRSETTFLAGS: { 2278 struct pfioc_table *io = (struct pfioc_table *)addr; 2279 2280 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2281 error = ENODEV; 2282 break; 2283 } 2284 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2285 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2286 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2287 break; 2288 } 2289 2290 case DIOCRCLRADDRS: { 2291 struct pfioc_table *io = (struct pfioc_table *)addr; 2292 2293 if (io->pfrio_esize != 0) { 2294 error = ENODEV; 2295 break; 2296 } 2297 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2298 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2299 break; 2300 } 2301 2302 case DIOCRADDADDRS: { 2303 struct pfioc_table *io = (struct pfioc_table *)addr; 2304 2305 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2306 error = ENODEV; 2307 break; 2308 } 2309 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2310 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2311 PFR_FLAG_USERIOCTL); 2312 break; 2313 } 2314 2315 case DIOCRDELADDRS: { 2316 struct pfioc_table *io = (struct pfioc_table *)addr; 2317 2318 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2319 error = ENODEV; 2320 break; 2321 } 2322 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2323 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2324 PFR_FLAG_USERIOCTL); 2325 break; 2326 } 2327 2328 case DIOCRSETADDRS: { 2329 struct pfioc_table *io = (struct pfioc_table *)addr; 2330 2331 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2332 error = ENODEV; 2333 break; 2334 } 2335 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2336 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2337 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2338 PFR_FLAG_USERIOCTL); 2339 break; 2340 } 2341 2342 case DIOCRGETADDRS: { 2343 struct pfioc_table *io = (struct pfioc_table *)addr; 2344 2345 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2346 error = ENODEV; 2347 break; 2348 } 2349 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2350 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2351 break; 2352 } 2353 2354 case DIOCRGETASTATS: { 2355 struct pfioc_table *io = (struct pfioc_table *)addr; 2356 2357 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2358 error = ENODEV; 2359 break; 2360 } 2361 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2362 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2363 break; 2364 } 2365 2366 case DIOCRCLRASTATS: { 2367 struct pfioc_table *io = (struct pfioc_table *)addr; 2368 2369 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2370 error = ENODEV; 2371 break; 2372 } 2373 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2374 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2375 PFR_FLAG_USERIOCTL); 2376 break; 2377 } 2378 2379 case DIOCRTSTADDRS: { 2380 struct pfioc_table *io = (struct pfioc_table *)addr; 2381 2382 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2383 error = ENODEV; 2384 break; 2385 } 2386 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2387 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2388 PFR_FLAG_USERIOCTL); 2389 break; 2390 } 2391 2392 case DIOCRINABEGIN: { 2393 struct pfioc_table *io = (struct pfioc_table *)addr; 2394 2395 if (io->pfrio_esize != 0) { 2396 error = ENODEV; 2397 break; 2398 } 2399 error = pfr_ina_begin(&io->pfrio_table, &io->pfrio_ticket, 2400 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2401 break; 2402 } 2403 2404 case DIOCRINACOMMIT: { 2405 struct pfioc_table *io = (struct pfioc_table *)addr; 2406 2407 if (io->pfrio_esize != 0) { 2408 error = ENODEV; 2409 break; 2410 } 2411 error = pfr_ina_commit(&io->pfrio_table, io->pfrio_ticket, 2412 &io->pfrio_nadd, &io->pfrio_nchange, io->pfrio_flags | 2413 PFR_FLAG_USERIOCTL); 2414 break; 2415 } 2416 2417 case DIOCRINADEFINE: { 2418 struct pfioc_table *io = (struct pfioc_table *)addr; 2419 2420 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2421 error = ENODEV; 2422 break; 2423 } 2424 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2425 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2426 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2427 break; 2428 } 2429 2430 case DIOCOSFPADD: { 2431 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2432 s = splsoftnet(); 2433 error = pf_osfp_add(io); 2434 splx(s); 2435 break; 2436 } 2437 2438 case DIOCOSFPGET: { 2439 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2440 s = splsoftnet(); 2441 error = pf_osfp_get(io); 2442 splx(s); 2443 break; 2444 } 2445 2446 case DIOCXBEGIN: { 2447 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2448 struct pfioc_trans_e ioe; 2449 struct pfr_table table; 2450 int i; 2451 2452 if (io->esize != sizeof(ioe)) { 2453 error = ENODEV; 2454 goto fail; 2455 } 2456 for (i = 0; i < io->size; i++) { 2457 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2458 error = EFAULT; 2459 goto fail; 2460 } 2461 switch (ioe.rs_num) { 2462 #ifdef ALTQ 2463 case PF_RULESET_ALTQ: 2464 if (ioe.anchor[0] || ioe.ruleset[0]) { 2465 error = EINVAL; 2466 goto fail; 2467 } 2468 if ((error = pf_begin_altq(&ioe.ticket))) 2469 goto fail; 2470 break; 2471 #endif /* ALTQ */ 2472 case PF_RULESET_TABLE: 2473 bzero(&table, sizeof(table)); 2474 strlcpy(table.pfrt_anchor, ioe.anchor, 2475 sizeof(table.pfrt_anchor)); 2476 strlcpy(table.pfrt_ruleset, ioe.ruleset, 2477 sizeof(table.pfrt_ruleset)); 2478 if ((error = pfr_ina_begin(&table, 2479 &ioe.ticket, NULL, 0))) 2480 goto fail; 2481 break; 2482 default: 2483 if ((error = pf_begin_rules(&ioe.ticket, 2484 ioe.rs_num, ioe.anchor, ioe.ruleset))) 2485 goto fail; 2486 break; 2487 } 2488 if (copyout(&ioe, io->array+i, sizeof(io->array[i]))) { 2489 error = EFAULT; 2490 goto fail; 2491 } 2492 } 2493 break; 2494 } 2495 2496 case DIOCXROLLBACK: { 2497 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2498 struct pfioc_trans_e ioe; 2499 struct pfr_table table; 2500 int i; 2501 2502 if (io->esize != sizeof(ioe)) { 2503 error = ENODEV; 2504 goto fail; 2505 } 2506 for (i = 0; i < io->size; i++) { 2507 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2508 error = EFAULT; 2509 goto fail; 2510 } 2511 switch (ioe.rs_num) { 2512 #ifdef ALTQ 2513 case PF_RULESET_ALTQ: 2514 if (ioe.anchor[0] || ioe.ruleset[0]) { 2515 error = EINVAL; 2516 goto fail; 2517 } 2518 if ((error = pf_rollback_altq(ioe.ticket))) 2519 goto fail; /* really bad */ 2520 break; 2521 #endif /* ALTQ */ 2522 case PF_RULESET_TABLE: 2523 bzero(&table, sizeof(table)); 2524 strlcpy(table.pfrt_anchor, ioe.anchor, 2525 sizeof(table.pfrt_anchor)); 2526 strlcpy(table.pfrt_ruleset, ioe.ruleset, 2527 sizeof(table.pfrt_ruleset)); 2528 if ((error = pfr_ina_rollback(&table, 2529 ioe.ticket, NULL, 0))) 2530 goto fail; /* really bad */ 2531 break; 2532 default: 2533 if ((error = pf_rollback_rules(ioe.ticket, 2534 ioe.rs_num, ioe.anchor, ioe.ruleset))) 2535 goto fail; /* really bad */ 2536 break; 2537 } 2538 } 2539 break; 2540 } 2541 2542 case DIOCXCOMMIT: { 2543 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2544 struct pfioc_trans_e ioe; 2545 struct pfr_table table; 2546 struct pf_ruleset *rs; 2547 int i; 2548 2549 if (io->esize != sizeof(ioe)) { 2550 error = ENODEV; 2551 goto fail; 2552 } 2553 /* first makes sure everything will succeed */ 2554 for (i = 0; i < io->size; i++) { 2555 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2556 error = EFAULT; 2557 goto fail; 2558 } 2559 switch (ioe.rs_num) { 2560 #ifdef ALTQ 2561 case PF_RULESET_ALTQ: 2562 if (ioe.anchor[0] || ioe.ruleset[0]) { 2563 error = EINVAL; 2564 goto fail; 2565 } 2566 if (!altqs_inactive_open || ioe.ticket != 2567 ticket_altqs_inactive) { 2568 error = EBUSY; 2569 goto fail; 2570 } 2571 break; 2572 #endif /* ALTQ */ 2573 case PF_RULESET_TABLE: 2574 rs = pf_find_ruleset(ioe.anchor, ioe.ruleset); 2575 if (rs == NULL || !rs->topen || ioe.ticket != 2576 rs->tticket) { 2577 error = EBUSY; 2578 goto fail; 2579 } 2580 break; 2581 default: 2582 if (ioe.rs_num < 0 || ioe.rs_num >= 2583 PF_RULESET_MAX) { 2584 error = EINVAL; 2585 goto fail; 2586 } 2587 rs = pf_find_ruleset(ioe.anchor, ioe.ruleset); 2588 if (rs == NULL || 2589 !rs->rules[ioe.rs_num].inactive.open || 2590 rs->rules[ioe.rs_num].inactive.ticket != 2591 ioe.ticket) { 2592 error = EBUSY; 2593 goto fail; 2594 } 2595 break; 2596 } 2597 } 2598 /* now do the commit - no errors should happen here */ 2599 for (i = 0; i < io->size; i++) { 2600 if (copyin(io->array+i, &ioe, sizeof(ioe))) { 2601 error = EFAULT; 2602 goto fail; 2603 } 2604 switch (ioe.rs_num) { 2605 #ifdef ALTQ 2606 case PF_RULESET_ALTQ: 2607 if ((error = pf_commit_altq(ioe.ticket))) 2608 goto fail; /* really bad */ 2609 break; 2610 #endif /* ALTQ */ 2611 case PF_RULESET_TABLE: 2612 bzero(&table, sizeof(table)); 2613 strlcpy(table.pfrt_anchor, ioe.anchor, 2614 sizeof(table.pfrt_anchor)); 2615 strlcpy(table.pfrt_ruleset, ioe.ruleset, 2616 sizeof(table.pfrt_ruleset)); 2617 if ((error = pfr_ina_commit(&table, ioe.ticket, 2618 NULL, NULL, 0))) 2619 goto fail; /* really bad */ 2620 break; 2621 default: 2622 if ((error = pf_commit_rules(ioe.ticket, 2623 ioe.rs_num, ioe.anchor, ioe.ruleset))) 2624 goto fail; /* really bad */ 2625 break; 2626 } 2627 } 2628 break; 2629 } 2630 2631 case DIOCGETSRCNODES: { 2632 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 2633 struct pf_src_node *n; 2634 struct pf_src_node *p, pstore; 2635 u_int32_t nr = 0; 2636 int space = psn->psn_len; 2637 2638 if (space == 0) { 2639 s = splsoftnet(); 2640 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 2641 nr++; 2642 splx(s); 2643 psn->psn_len = sizeof(struct pf_src_node) * nr; 2644 return (0); 2645 } 2646 2647 s = splsoftnet(); 2648 p = psn->psn_src_nodes; 2649 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2650 int secs = time.tv_sec; 2651 2652 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 2653 break; 2654 2655 bcopy(n, &pstore, sizeof(pstore)); 2656 if (n->rule.ptr != NULL) 2657 pstore.rule.nr = n->rule.ptr->nr; 2658 pstore.creation = secs - pstore.creation; 2659 if (pstore.expire > secs) 2660 pstore.expire -= secs; 2661 else 2662 pstore.expire = 0; 2663 error = copyout(&pstore, p, sizeof(*p)); 2664 if (error) { 2665 splx(s); 2666 goto fail; 2667 } 2668 p++; 2669 nr++; 2670 } 2671 psn->psn_len = sizeof(struct pf_src_node) * nr; 2672 splx(s); 2673 break; 2674 } 2675 2676 case DIOCCLRSRCNODES: { 2677 struct pf_src_node *n; 2678 struct pf_state *state; 2679 2680 s = splsoftnet(); 2681 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 2682 state->src_node = NULL; 2683 state->nat_src_node = NULL; 2684 } 2685 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 2686 n->expire = 1; 2687 n->states = 0; 2688 } 2689 pf_purge_expired_src_nodes(); 2690 pf_status.src_nodes = 0; 2691 splx(s); 2692 break; 2693 } 2694 2695 case DIOCSETHOSTID: { 2696 u_int32_t *hostid = (u_int32_t *)addr; 2697 2698 if (*hostid == 0) { 2699 error = EINVAL; 2700 goto fail; 2701 } 2702 pf_status.hostid = *hostid; 2703 break; 2704 } 2705 2706 case DIOCOSFPFLUSH: 2707 s = splsoftnet(); 2708 pf_osfp_flush(); 2709 splx(s); 2710 break; 2711 2712 case DIOCIGETIFACES: { 2713 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2714 2715 if (io->pfiio_esize != sizeof(struct pfi_if)) { 2716 error = ENODEV; 2717 break; 2718 } 2719 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 2720 &io->pfiio_size, io->pfiio_flags); 2721 break; 2722 } 2723 2724 case DIOCICLRISTATS: { 2725 struct pfioc_iface *io = (struct pfioc_iface *)addr; 2726 2727 error = pfi_clr_istats(io->pfiio_name, &io->pfiio_nzero, 2728 io->pfiio_flags); 2729 break; 2730 } 2731 2732 default: 2733 error = ENODEV; 2734 break; 2735 } 2736 fail: 2737 2738 return (error); 2739 } 2740 2741 #ifdef __NetBSD__ 2742 int 2743 pfil4_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2744 { 2745 2746 /* 2747 * If the packet is out-bound, we can't delay checksums 2748 * here. For in-bound, the checksum has already been 2749 * validated. 2750 */ 2751 if (dir == PFIL_OUT) { 2752 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 2753 in_delayed_cksum(*mp); 2754 (*mp)->m_pkthdr.csum_flags &= 2755 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 2756 } 2757 } 2758 2759 if (pf_test(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp) != PF_PASS) 2760 return EHOSTUNREACH; 2761 else 2762 return (0); 2763 } 2764 2765 #ifdef INET6 2766 int 2767 pfil6_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2768 { 2769 2770 if (pf_test6(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp) != PF_PASS) 2771 return EHOSTUNREACH; 2772 else 2773 return (0); 2774 } 2775 #endif 2776 2777 extern void pfi_kifaddr_update(void *); 2778 2779 int 2780 pfil_if_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 2781 { 2782 u_long cmd = (u_long)mp; 2783 2784 switch (cmd) { 2785 case 0: 2786 pfi_attach_ifnet(ifp); 2787 break; 2788 case SIOCSIFADDR: 2789 case SIOCGIFALIAS: 2790 case SIOCDIFADDR: 2791 pfi_kifaddr_update((struct ifnet *)arg); 2792 break; 2793 default: 2794 panic("unexpected ioctl"); 2795 } 2796 2797 return 0; 2798 } 2799 2800 static int 2801 pf_pfil_attach(void) 2802 { 2803 struct pfil_head *ph_inet; 2804 #ifdef INET6 2805 struct pfil_head *ph_inet6; 2806 #endif 2807 int error; 2808 int i; 2809 2810 error = pfil_add_hook(pfil_if_wrapper, NULL, PFIL_IFADDR|PFIL_NEWIF, 2811 &if_pfil); 2812 if (error) 2813 return (error); 2814 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 2815 if (ph_inet) 2816 error = pfil_add_hook((void *)pfil4_wrapper, NULL, 2817 PFIL_IN|PFIL_OUT, ph_inet); 2818 else 2819 error = ENOENT; 2820 if (error) { 2821 pfil_remove_hook(pfil_if_wrapper, NULL, PFIL_IFADDR|PFIL_NEWIF, 2822 &if_pfil); 2823 } 2824 #ifdef INET6 2825 if (error) { 2826 return (error); 2827 } 2828 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 2829 if (ph_inet6) 2830 error = pfil_add_hook((void *)pfil6_wrapper, NULL, 2831 PFIL_IN|PFIL_OUT, ph_inet6); 2832 else 2833 error = ENOENT; 2834 if (error) { 2835 pfil_remove_hook(pfil_if_wrapper, NULL, PFIL_IFADDR|PFIL_NEWIF, 2836 &if_pfil); 2837 pfil_remove_hook((void *)pfil4_wrapper, NULL, 2838 PFIL_IN|PFIL_OUT, ph_inet); 2839 } 2840 #endif 2841 if (!error) { 2842 for (i = 0; i < if_indexlim; i++) { 2843 if (ifindex2ifnet[i]) 2844 pfi_attach_ifnet(ifindex2ifnet[i]); 2845 } 2846 } 2847 return (error); 2848 } 2849 2850 int 2851 pf_pfil_detach(void) 2852 { 2853 struct pfil_head *ph_inet; 2854 #ifdef INET6 2855 struct pfil_head *ph_inet6; 2856 #endif 2857 int i; 2858 2859 for (i = 0; i < if_indexlim; i++) { 2860 if (pfi_index2kif[i]) 2861 pfi_detach_ifnet(ifindex2ifnet[i]); 2862 } 2863 pfil_remove_hook(pfil_if_wrapper, NULL, PFIL_IFADDR|PFIL_NEWIF, 2864 &if_pfil); 2865 ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 2866 if (ph_inet) 2867 pfil_remove_hook((void *)pfil4_wrapper, NULL, 2868 PFIL_IN|PFIL_OUT, ph_inet); 2869 #ifdef INET6 2870 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 2871 if (ph_inet) 2872 pfil_remove_hook((void *)pfil6_wrapper, NULL, 2873 PFIL_IN|PFIL_OUT, ph_inet6); 2874 #endif 2875 return (0); 2876 } 2877 #endif 2878
Indexes created Wed Sep 24 15:09:51 GMT 2025