pf_ioctl.c revision 1.50
1 /* $NetBSD: pf_ioctl.c,v 1.50 2014/07/25 08:10:39 dholland Exp $ */ 2 /* $OpenBSD: pf_ioctl.c,v 1.182 2007/06/24 11:17:13 mcbride Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: pf_ioctl.c,v 1.50 2014/07/25 08:10:39 dholland Exp $"); 41 42 #ifdef _KERNEL_OPT 43 #include "opt_inet.h" 44 #endif 45 46 #include "pfsync.h" 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/mbuf.h> 51 #include <sys/filio.h> 52 #include <sys/fcntl.h> 53 #include <sys/socket.h> 54 #include <sys/socketvar.h> 55 #include <sys/kernel.h> 56 #include <sys/time.h> 57 #include <sys/pool.h> 58 #include <sys/proc.h> 59 #include <sys/malloc.h> 60 #include <sys/kthread.h> 61 #include <sys/rwlock.h> 62 #include <uvm/uvm_extern.h> 63 #ifdef __NetBSD__ 64 #include <sys/conf.h> 65 #include <sys/lwp.h> 66 #include <sys/kauth.h> 67 #include <sys/module.h> 68 #include <sys/cprng.h> 69 #endif /* __NetBSD__ */ 70 71 #include <net/if.h> 72 #include <net/if_types.h> 73 #include <net/route.h> 74 75 #include <netinet/in.h> 76 #include <netinet/in_var.h> 77 #include <netinet/in_systm.h> 78 #include <netinet/ip.h> 79 #include <netinet/ip_var.h> 80 #include <netinet/ip_icmp.h> 81 82 #ifndef __NetBSD__ 83 #include <dev/rndvar.h> 84 #include <crypto/md5.h> 85 #else 86 #include <sys/md5.h> 87 #endif /* __NetBSD__ */ 88 #include <net/pfvar.h> 89 90 #if NPFSYNC > 0 91 #include <net/if_pfsync.h> 92 #endif /* NPFSYNC > 0 */ 93 94 #if NPFLOG > 0 95 #include <net/if_pflog.h> 96 #endif /* NPFLOG > 0 */ 97 98 #ifdef INET6 99 #include <netinet/ip6.h> 100 #include <netinet/in_pcb.h> 101 #endif /* INET6 */ 102 103 #ifdef ALTQ 104 #include <altq/altq.h> 105 #endif 106 107 void pfattach(int); 108 #ifdef _MODULE 109 void pfdetach(void); 110 #endif /* _MODULE */ 111 #ifndef __NetBSD__ 112 void pf_thread_create(void *); 113 #endif /* !__NetBSD__ */ 114 int pfopen(dev_t, int, int, struct lwp *); 115 int pfclose(dev_t, int, int, struct lwp *); 116 struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 117 u_int8_t, u_int8_t, u_int8_t); 118 119 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 120 void pf_empty_pool(struct pf_palist *); 121 int pfioctl(dev_t, u_long, void *, int, struct lwp *); 122 #ifdef ALTQ 123 int pf_begin_altq(u_int32_t *); 124 int pf_rollback_altq(u_int32_t); 125 int pf_commit_altq(u_int32_t); 126 int pf_enable_altq(struct pf_altq *); 127 int pf_disable_altq(struct pf_altq *); 128 #endif /* ALTQ */ 129 int pf_begin_rules(u_int32_t *, int, const char *); 130 int pf_rollback_rules(u_int32_t, int, char *); 131 int pf_setup_pfsync_matching(struct pf_ruleset *); 132 void pf_hash_rule(MD5_CTX *, struct pf_rule *); 133 void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 134 int pf_commit_rules(u_int32_t, int, char *); 135 void pf_state_export(struct pfsync_state *, 136 struct pf_state_key *, struct pf_state *); 137 void pf_state_import(struct pfsync_state *, 138 struct pf_state_key *, struct pf_state *); 139 140 static int pf_state_add(struct pfsync_state*); 141 142 struct pf_rule pf_default_rule; 143 #ifdef __NetBSD__ 144 krwlock_t pf_consistency_lock; 145 #else 146 struct rwlock pf_consistency_lock = RWLOCK_INITIALIZER("pfcnslk"); 147 #endif /* __NetBSD__ */ 148 #ifdef ALTQ 149 static int pf_altq_running; 150 #endif 151 152 int pf_state_lock = 0; 153 154 #define TAGID_MAX 50000 155 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 156 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 157 158 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 159 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 160 #endif 161 u_int16_t tagname2tag(struct pf_tags *, char *); 162 void tag2tagname(struct pf_tags *, u_int16_t, char *); 163 void tag_unref(struct pf_tags *, u_int16_t); 164 int pf_rtlabel_add(struct pf_addr_wrap *); 165 void pf_rtlabel_remove(struct pf_addr_wrap *); 166 void pf_rtlabel_copyout(struct pf_addr_wrap *); 167 168 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 169 170 #ifdef __NetBSD__ 171 const struct cdevsw pf_cdevsw = { 172 .d_open = pfopen, 173 .d_close = pfclose, 174 .d_read = noread, 175 .d_write = nowrite, 176 .d_ioctl = pfioctl, 177 .d_stop = nostop, 178 .d_tty = notty, 179 .d_poll = nopoll, 180 .d_mmap = nommap, 181 .d_kqfilter = nokqfilter, 182 .d_discard = nodiscard, 183 .d_flag = D_OTHER 184 }; 185 186 static int pfil4_wrapper(void *, struct mbuf **, struct ifnet *, int); 187 #ifdef INET6 188 static int pfil6_wrapper(void *, struct mbuf **, struct ifnet *, int); 189 #endif /* INET6 */ 190 191 static int pf_pfil_attach(void); 192 static int pf_pfil_detach(void); 193 194 static int pf_pfil_attached; 195 196 static kauth_listener_t pf_listener; 197 #endif /* __NetBSD__ */ 198 199 #ifdef __NetBSD__ 200 static int 201 pf_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 202 void *arg0, void *arg1, void *arg2, void *arg3) 203 { 204 int result; 205 enum kauth_network_req req; 206 207 result = KAUTH_RESULT_DEFER; 208 req = (enum kauth_network_req)arg0; 209 210 if (action != KAUTH_NETWORK_FIREWALL) 211 return result; 212 213 /* These must have came from device context. */ 214 if ((req == KAUTH_REQ_NETWORK_FIREWALL_FW) || 215 (req == KAUTH_REQ_NETWORK_FIREWALL_NAT)) 216 result = KAUTH_RESULT_ALLOW; 217 218 return result; 219 } 220 #endif /* __NetBSD__ */ 221 222 void 223 pfattach(int num) 224 { 225 u_int32_t *timeout = pf_default_rule.timeout; 226 227 #ifdef __NetBSD__ 228 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 229 &pool_allocator_nointr, IPL_NONE); 230 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 231 "pfsrctrpl", NULL, IPL_SOFTNET); 232 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 233 NULL, IPL_SOFTNET); 234 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 235 "pfstatekeypl", NULL, IPL_SOFTNET); 236 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 237 &pool_allocator_nointr, IPL_NONE); 238 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 239 "pfpooladdrpl", &pool_allocator_nointr, IPL_NONE); 240 #else 241 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 242 &pool_allocator_nointr); 243 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 244 "pfsrctrpl", NULL); 245 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 246 NULL); 247 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 248 "pfstatekeypl", NULL); 249 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 250 &pool_allocator_nointr); 251 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 252 "pfpooladdrpl", &pool_allocator_nointr); 253 #endif /* !__NetBSD__ */ 254 255 pfr_initialize(); 256 pfi_initialize(); 257 pf_osfp_initialize(); 258 259 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 260 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 261 262 if (ctob(physmem) <= 100*1024*1024) 263 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit = 264 PFR_KENTRY_HIWAT_SMALL; 265 266 RB_INIT(&tree_src_tracking); 267 RB_INIT(&pf_anchors); 268 pf_init_ruleset(&pf_main_ruleset); 269 TAILQ_INIT(&pf_altqs[0]); 270 TAILQ_INIT(&pf_altqs[1]); 271 TAILQ_INIT(&pf_pabuf); 272 pf_altqs_active = &pf_altqs[0]; 273 pf_altqs_inactive = &pf_altqs[1]; 274 TAILQ_INIT(&state_list); 275 276 #ifdef __NetBSD__ 277 rw_init(&pf_consistency_lock); 278 #endif /* __NetBSD__ */ 279 280 /* default rule should never be garbage collected */ 281 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 282 pf_default_rule.action = PF_PASS; 283 pf_default_rule.nr = -1; 284 pf_default_rule.rtableid = -1; 285 286 /* initialize default timeouts */ 287 timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 288 timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 289 timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 290 timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 291 timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 292 timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 293 timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 294 timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 295 timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 296 timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 297 timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 298 timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 299 timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 300 timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 301 timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 302 timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 303 timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 304 timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 305 timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 306 timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 307 308 pf_normalize_init(); 309 bzero(&pf_status, sizeof(pf_status)); 310 pf_status.debug = PF_DEBUG_URGENT; 311 312 /* XXX do our best to avoid a conflict */ 313 pf_status.hostid = cprng_fast32(); 314 315 /* require process context to purge states, so perform in a thread */ 316 #ifdef __NetBSD__ 317 if (kthread_create(PRI_NONE, 0, NULL, pf_purge_thread, NULL, NULL, 318 "pfpurge")) 319 panic("pfpurge thread"); 320 #else 321 kthread_create_deferred(pf_thread_create, NULL); 322 #endif /* !__NetBSD__ */ 323 324 #ifdef __NetBSD__ 325 pf_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 326 pf_listener_cb, NULL); 327 #endif /* __NetBSD__ */ 328 } 329 330 #ifdef _MODULE 331 void 332 pfdetach(void) 333 { 334 extern int pf_purge_thread_running; 335 extern int pf_purge_thread_stop; 336 struct pf_anchor *anchor; 337 struct pf_state *state; 338 struct pf_src_node *node; 339 struct pfioc_table pt; 340 u_int32_t ticket; 341 int i; 342 char r = '\0'; 343 344 pf_purge_thread_stop = 1; 345 wakeup(pf_purge_thread); 346 347 /* wait until the kthread exits */ 348 while (pf_purge_thread_running) 349 tsleep(&pf_purge_thread_running, PWAIT, "pfdown", 0); 350 351 (void)pf_pfil_detach(); 352 353 pf_status.running = 0; 354 355 /* clear the rulesets */ 356 for (i = 0; i < PF_RULESET_MAX; i++) 357 if (pf_begin_rules(&ticket, i, &r) == 0) 358 pf_commit_rules(ticket, i, &r); 359 #ifdef ALTQ 360 if (pf_begin_altq(&ticket) == 0) 361 pf_commit_altq(ticket); 362 #endif /* ALTQ */ 363 364 /* clear states */ 365 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 366 state->timeout = PFTM_PURGE; 367 #if NPFSYNC > 0 368 state->sync_flags = PFSTATE_NOSYNC; 369 #endif /* NPFSYNC > 0 */ 370 } 371 pf_purge_expired_states(pf_status.states); 372 #if NPFSYNC > 0 373 pfsync_clear_states(pf_status.hostid, NULL); 374 #endif /* NPFSYNC > 0 */ 375 376 /* clear source nodes */ 377 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 378 state->src_node = NULL; 379 state->nat_src_node = NULL; 380 } 381 RB_FOREACH(node, pf_src_tree, &tree_src_tracking) { 382 node->expire = 1; 383 node->states = 0; 384 } 385 pf_purge_expired_src_nodes(0); 386 387 /* clear tables */ 388 memset(&pt, '\0', sizeof(pt)); 389 pfr_clr_tables(&pt.pfrio_table, &pt.pfrio_ndel, pt.pfrio_flags); 390 391 /* destroy anchors */ 392 while ((anchor = RB_MIN(pf_anchor_global, &pf_anchors)) != NULL) { 393 for (i = 0; i < PF_RULESET_MAX; i++) 394 if (pf_begin_rules(&ticket, i, anchor->name) == 0) 395 pf_commit_rules(ticket, i, anchor->name); 396 } 397 398 /* destroy main ruleset */ 399 pf_remove_if_empty_ruleset(&pf_main_ruleset); 400 401 /* destroy the pools */ 402 pool_destroy(&pf_pooladdr_pl); 403 pool_destroy(&pf_altq_pl); 404 pool_destroy(&pf_state_key_pl); 405 pool_destroy(&pf_state_pl); 406 pool_destroy(&pf_rule_pl); 407 pool_destroy(&pf_src_tree_pl); 408 409 rw_destroy(&pf_consistency_lock); 410 411 /* destroy subsystems */ 412 pf_normalize_destroy(); 413 pf_osfp_destroy(); 414 pfr_destroy(); 415 pfi_destroy(); 416 417 /* cleanup kauth listener */ 418 kauth_unlisten_scope(pf_listener); 419 } 420 #endif /* _MODULE */ 421 422 #ifndef __NetBSD__ 423 void 424 pf_thread_create(void *v) 425 { 426 if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge")) 427 panic("pfpurge thread"); 428 } 429 #endif /* !__NetBSD__ */ 430 431 int 432 pfopen(dev_t dev, int flags, int fmt, struct lwp *l) 433 { 434 if (minor(dev) >= 1) 435 return (ENXIO); 436 return (0); 437 } 438 439 int 440 pfclose(dev_t dev, int flags, int fmt, struct lwp *l) 441 { 442 if (minor(dev) >= 1) 443 return (ENXIO); 444 return (0); 445 } 446 447 struct pf_pool * 448 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 449 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 450 u_int8_t check_ticket) 451 { 452 struct pf_ruleset *ruleset; 453 struct pf_rule *rule; 454 int rs_num; 455 456 ruleset = pf_find_ruleset(anchor); 457 if (ruleset == NULL) 458 return (NULL); 459 rs_num = pf_get_ruleset_number(rule_action); 460 if (rs_num >= PF_RULESET_MAX) 461 return (NULL); 462 if (active) { 463 if (check_ticket && ticket != 464 ruleset->rules[rs_num].active.ticket) 465 return (NULL); 466 if (r_last) 467 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 468 pf_rulequeue); 469 else 470 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 471 } else { 472 if (check_ticket && ticket != 473 ruleset->rules[rs_num].inactive.ticket) 474 return (NULL); 475 if (r_last) 476 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 477 pf_rulequeue); 478 else 479 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 480 } 481 if (!r_last) { 482 while ((rule != NULL) && (rule->nr != rule_number)) 483 rule = TAILQ_NEXT(rule, entries); 484 } 485 if (rule == NULL) 486 return (NULL); 487 488 return (&rule->rpool); 489 } 490 491 void 492 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 493 { 494 struct pf_pooladdr *mv_pool_pa; 495 496 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 497 TAILQ_REMOVE(poola, mv_pool_pa, entries); 498 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 499 } 500 } 501 502 void 503 pf_empty_pool(struct pf_palist *poola) 504 { 505 struct pf_pooladdr *empty_pool_pa; 506 507 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 508 pfi_dynaddr_remove(&empty_pool_pa->addr); 509 pf_tbladdr_remove(&empty_pool_pa->addr); 510 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE); 511 TAILQ_REMOVE(poola, empty_pool_pa, entries); 512 pool_put(&pf_pooladdr_pl, empty_pool_pa); 513 } 514 } 515 516 void 517 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 518 { 519 if (rulequeue != NULL) { 520 if (rule->states <= 0) { 521 /* 522 * XXX - we need to remove the table *before* detaching 523 * the rule to make sure the table code does not delete 524 * the anchor under our feet. 525 */ 526 pf_tbladdr_remove(&rule->src.addr); 527 pf_tbladdr_remove(&rule->dst.addr); 528 if (rule->overload_tbl) 529 pfr_detach_table(rule->overload_tbl); 530 } 531 TAILQ_REMOVE(rulequeue, rule, entries); 532 rule->entries.tqe_prev = NULL; 533 rule->nr = -1; 534 } 535 536 if (rule->states > 0 || rule->src_nodes > 0 || 537 rule->entries.tqe_prev != NULL) 538 return; 539 pf_tag_unref(rule->tag); 540 pf_tag_unref(rule->match_tag); 541 #ifdef ALTQ 542 if (rule->pqid != rule->qid) 543 pf_qid_unref(rule->pqid); 544 pf_qid_unref(rule->qid); 545 #endif 546 pf_rtlabel_remove(&rule->src.addr); 547 pf_rtlabel_remove(&rule->dst.addr); 548 pfi_dynaddr_remove(&rule->src.addr); 549 pfi_dynaddr_remove(&rule->dst.addr); 550 if (rulequeue == NULL) { 551 pf_tbladdr_remove(&rule->src.addr); 552 pf_tbladdr_remove(&rule->dst.addr); 553 if (rule->overload_tbl) 554 pfr_detach_table(rule->overload_tbl); 555 } 556 pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE); 557 pf_anchor_remove(rule); 558 pf_empty_pool(&rule->rpool.list); 559 pool_put(&pf_rule_pl, rule); 560 } 561 562 u_int16_t 563 tagname2tag(struct pf_tags *head, char *tagname) 564 { 565 struct pf_tagname *tag, *p = NULL; 566 u_int16_t new_tagid = 1; 567 568 TAILQ_FOREACH(tag, head, entries) 569 if (strcmp(tagname, tag->name) == 0) { 570 tag->ref++; 571 return (tag->tag); 572 } 573 574 /* 575 * to avoid fragmentation, we do a linear search from the beginning 576 * and take the first free slot we find. if there is none or the list 577 * is empty, append a new entry at the end. 578 */ 579 580 /* new entry */ 581 if (!TAILQ_EMPTY(head)) 582 for (p = TAILQ_FIRST(head); p != NULL && 583 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 584 new_tagid = p->tag + 1; 585 586 if (new_tagid > TAGID_MAX) 587 return (0); 588 589 /* allocate and fill new struct pf_tagname */ 590 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 591 M_TEMP, M_NOWAIT); 592 if (tag == NULL) 593 return (0); 594 bzero(tag, sizeof(struct pf_tagname)); 595 strlcpy(tag->name, tagname, sizeof(tag->name)); 596 tag->tag = new_tagid; 597 tag->ref++; 598 599 if (p != NULL) /* insert new entry before p */ 600 TAILQ_INSERT_BEFORE(p, tag, entries); 601 else /* either list empty or no free slot in between */ 602 TAILQ_INSERT_TAIL(head, tag, entries); 603 604 return (tag->tag); 605 } 606 607 void 608 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 609 { 610 struct pf_tagname *tag; 611 612 TAILQ_FOREACH(tag, head, entries) 613 if (tag->tag == tagid) { 614 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 615 return; 616 } 617 } 618 619 void 620 tag_unref(struct pf_tags *head, u_int16_t tag) 621 { 622 struct pf_tagname *p, *next; 623 624 if (tag == 0) 625 return; 626 627 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 628 next = TAILQ_NEXT(p, entries); 629 if (tag == p->tag) { 630 if (--p->ref == 0) { 631 TAILQ_REMOVE(head, p, entries); 632 free(p, M_TEMP); 633 } 634 break; 635 } 636 } 637 } 638 639 u_int16_t 640 pf_tagname2tag(char *tagname) 641 { 642 return (tagname2tag(&pf_tags, tagname)); 643 } 644 645 void 646 pf_tag2tagname(u_int16_t tagid, char *p) 647 { 648 tag2tagname(&pf_tags, tagid, p); 649 } 650 651 void 652 pf_tag_ref(u_int16_t tag) 653 { 654 struct pf_tagname *t; 655 656 TAILQ_FOREACH(t, &pf_tags, entries) 657 if (t->tag == tag) 658 break; 659 if (t != NULL) 660 t->ref++; 661 } 662 663 void 664 pf_tag_unref(u_int16_t tag) 665 { 666 tag_unref(&pf_tags, tag); 667 } 668 669 int 670 pf_rtlabel_add(struct pf_addr_wrap *a) 671 { 672 #ifndef __NetBSD__ 673 if (a->type == PF_ADDR_RTLABEL && 674 (a->v.rtlabel = rtlabel_name2id(a->v.rtlabelname)) == 0) 675 return (-1); 676 #endif /* !__NetBSD__ */ 677 return (0); 678 } 679 680 void 681 pf_rtlabel_remove(struct pf_addr_wrap *a) 682 { 683 #ifndef __NetBSD__ 684 if (a->type == PF_ADDR_RTLABEL) 685 rtlabel_unref(a->v.rtlabel); 686 #endif /* !__NetBSD__ */ 687 } 688 689 void 690 pf_rtlabel_copyout(struct pf_addr_wrap *a) 691 { 692 #ifndef __NetBSD__ 693 const char *name; 694 695 if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel) { 696 if ((name = rtlabel_id2name(a->v.rtlabel)) == NULL) 697 strlcpy(a->v.rtlabelname, "?", 698 sizeof(a->v.rtlabelname)); 699 else 700 strlcpy(a->v.rtlabelname, name, 701 sizeof(a->v.rtlabelname)); 702 } 703 #endif /* !__NetBSD__ */ 704 } 705 706 #ifdef ALTQ 707 u_int32_t 708 pf_qname2qid(char *qname) 709 { 710 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 711 } 712 713 void 714 pf_qid2qname(u_int32_t qid, char *p) 715 { 716 tag2tagname(&pf_qids, (u_int16_t)qid, p); 717 } 718 719 void 720 pf_qid_unref(u_int32_t qid) 721 { 722 tag_unref(&pf_qids, (u_int16_t)qid); 723 } 724 725 int 726 pf_begin_altq(u_int32_t *ticket) 727 { 728 struct pf_altq *altq; 729 int error = 0; 730 731 /* Purge the old altq list */ 732 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 733 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 734 if (altq->qname[0] == 0) { 735 /* detach and destroy the discipline */ 736 error = altq_remove(altq); 737 } else 738 pf_qid_unref(altq->qid); 739 pool_put(&pf_altq_pl, altq); 740 } 741 if (error) 742 return (error); 743 *ticket = ++ticket_altqs_inactive; 744 altqs_inactive_open = 1; 745 return (0); 746 } 747 748 int 749 pf_rollback_altq(u_int32_t ticket) 750 { 751 struct pf_altq *altq; 752 int error = 0; 753 754 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 755 return (0); 756 /* Purge the old altq list */ 757 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 758 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 759 if (altq->qname[0] == 0) { 760 /* detach and destroy the discipline */ 761 error = altq_remove(altq); 762 } else 763 pf_qid_unref(altq->qid); 764 pool_put(&pf_altq_pl, altq); 765 } 766 altqs_inactive_open = 0; 767 return (error); 768 } 769 770 int 771 pf_commit_altq(u_int32_t ticket) 772 { 773 struct pf_altqqueue *old_altqs; 774 struct pf_altq *altq; 775 int s, err, error = 0; 776 777 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 778 return (EBUSY); 779 780 /* swap altqs, keep the old. */ 781 s = splsoftnet(); 782 old_altqs = pf_altqs_active; 783 pf_altqs_active = pf_altqs_inactive; 784 pf_altqs_inactive = old_altqs; 785 ticket_altqs_active = ticket_altqs_inactive; 786 787 /* Attach new disciplines */ 788 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 789 if (altq->qname[0] == 0) { 790 /* attach the discipline */ 791 error = altq_pfattach(altq); 792 if (error == 0 && pf_altq_running) 793 error = pf_enable_altq(altq); 794 if (error != 0) { 795 splx(s); 796 return (error); 797 } 798 } 799 } 800 801 /* Purge the old altq list */ 802 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 803 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 804 if (altq->qname[0] == 0) { 805 /* detach and destroy the discipline */ 806 if (pf_altq_running) 807 error = pf_disable_altq(altq); 808 err = altq_pfdetach(altq); 809 if (err != 0 && error == 0) 810 error = err; 811 err = altq_remove(altq); 812 if (err != 0 && error == 0) 813 error = err; 814 } else 815 pf_qid_unref(altq->qid); 816 pool_put(&pf_altq_pl, altq); 817 } 818 splx(s); 819 820 altqs_inactive_open = 0; 821 return (error); 822 } 823 824 int 825 pf_enable_altq(struct pf_altq *altq) 826 { 827 struct ifnet *ifp; 828 struct tb_profile tb; 829 int s, error = 0; 830 831 if ((ifp = ifunit(altq->ifname)) == NULL) 832 return (EINVAL); 833 834 if (ifp->if_snd.altq_type != ALTQT_NONE) 835 error = altq_enable(&ifp->if_snd); 836 837 /* set tokenbucket regulator */ 838 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 839 tb.rate = altq->ifbandwidth; 840 tb.depth = altq->tbrsize; 841 s = splnet(); 842 error = tbr_set(&ifp->if_snd, &tb); 843 splx(s); 844 } 845 846 return (error); 847 } 848 849 int 850 pf_disable_altq(struct pf_altq *altq) 851 { 852 struct ifnet *ifp; 853 struct tb_profile tb; 854 int s, error; 855 856 if ((ifp = ifunit(altq->ifname)) == NULL) 857 return (EINVAL); 858 859 /* 860 * when the discipline is no longer referenced, it was overridden 861 * by a new one. if so, just return. 862 */ 863 if (altq->altq_disc != ifp->if_snd.altq_disc) 864 return (0); 865 866 error = altq_disable(&ifp->if_snd); 867 868 if (error == 0) { 869 /* clear tokenbucket regulator */ 870 tb.rate = 0; 871 s = splnet(); 872 error = tbr_set(&ifp->if_snd, &tb); 873 splx(s); 874 } 875 876 return (error); 877 } 878 #endif /* ALTQ */ 879 880 int 881 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 882 { 883 struct pf_ruleset *rs; 884 struct pf_rule *rule; 885 886 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 887 return (EINVAL); 888 rs = pf_find_or_create_ruleset(anchor); 889 if (rs == NULL) 890 return (EINVAL); 891 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 892 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 893 rs->rules[rs_num].inactive.rcount--; 894 } 895 *ticket = ++rs->rules[rs_num].inactive.ticket; 896 rs->rules[rs_num].inactive.open = 1; 897 return (0); 898 } 899 900 int 901 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 902 { 903 struct pf_ruleset *rs; 904 struct pf_rule *rule; 905 906 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 907 return (EINVAL); 908 rs = pf_find_ruleset(anchor); 909 if (rs == NULL || !rs->rules[rs_num].inactive.open || 910 rs->rules[rs_num].inactive.ticket != ticket) 911 return (0); 912 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 913 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 914 rs->rules[rs_num].inactive.rcount--; 915 } 916 rs->rules[rs_num].inactive.open = 0; 917 return (0); 918 } 919 920 #define PF_MD5_UPD(st, elm) \ 921 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 922 923 #define PF_MD5_UPD_STR(st, elm) \ 924 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 925 926 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 927 (stor) = htonl((st)->elm); \ 928 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 929 } while (0) 930 931 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 932 (stor) = htons((st)->elm); \ 933 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 934 } while (0) 935 936 void 937 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 938 { 939 PF_MD5_UPD(pfr, addr.type); 940 switch (pfr->addr.type) { 941 case PF_ADDR_DYNIFTL: 942 PF_MD5_UPD(pfr, addr.v.ifname); 943 PF_MD5_UPD(pfr, addr.iflags); 944 break; 945 case PF_ADDR_TABLE: 946 PF_MD5_UPD(pfr, addr.v.tblname); 947 break; 948 case PF_ADDR_ADDRMASK: 949 /* XXX ignore af? */ 950 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 951 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 952 break; 953 case PF_ADDR_RTLABEL: 954 PF_MD5_UPD(pfr, addr.v.rtlabelname); 955 break; 956 } 957 958 PF_MD5_UPD(pfr, port[0]); 959 PF_MD5_UPD(pfr, port[1]); 960 PF_MD5_UPD(pfr, neg); 961 PF_MD5_UPD(pfr, port_op); 962 } 963 964 void 965 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule) 966 { 967 u_int16_t x; 968 u_int32_t y; 969 970 pf_hash_rule_addr(ctx, &rule->src); 971 pf_hash_rule_addr(ctx, &rule->dst); 972 PF_MD5_UPD_STR(rule, label); 973 PF_MD5_UPD_STR(rule, ifname); 974 PF_MD5_UPD_STR(rule, match_tagname); 975 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 976 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 977 PF_MD5_UPD_HTONL(rule, prob, y); 978 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 979 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 980 PF_MD5_UPD(rule, uid.op); 981 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 982 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 983 PF_MD5_UPD(rule, gid.op); 984 PF_MD5_UPD_HTONL(rule, rule_flag, y); 985 PF_MD5_UPD(rule, action); 986 PF_MD5_UPD(rule, direction); 987 PF_MD5_UPD(rule, af); 988 PF_MD5_UPD(rule, quick); 989 PF_MD5_UPD(rule, ifnot); 990 PF_MD5_UPD(rule, match_tag_not); 991 PF_MD5_UPD(rule, natpass); 992 PF_MD5_UPD(rule, keep_state); 993 PF_MD5_UPD(rule, proto); 994 PF_MD5_UPD(rule, type); 995 PF_MD5_UPD(rule, code); 996 PF_MD5_UPD(rule, flags); 997 PF_MD5_UPD(rule, flagset); 998 PF_MD5_UPD(rule, allow_opts); 999 PF_MD5_UPD(rule, rt); 1000 PF_MD5_UPD(rule, tos); 1001 } 1002 1003 int 1004 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 1005 { 1006 struct pf_ruleset *rs; 1007 struct pf_rule *rule, **old_array; 1008 struct pf_rulequeue *old_rules; 1009 int s, error; 1010 u_int32_t old_rcount; 1011 1012 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 1013 return (EINVAL); 1014 rs = pf_find_ruleset(anchor); 1015 if (rs == NULL || !rs->rules[rs_num].inactive.open || 1016 ticket != rs->rules[rs_num].inactive.ticket) 1017 return (EBUSY); 1018 1019 /* Calculate checksum for the main ruleset */ 1020 if (rs == &pf_main_ruleset) { 1021 error = pf_setup_pfsync_matching(rs); 1022 if (error != 0) 1023 return (error); 1024 } 1025 1026 /* Swap rules, keep the old. */ 1027 s = splsoftnet(); 1028 old_rules = rs->rules[rs_num].active.ptr; 1029 old_rcount = rs->rules[rs_num].active.rcount; 1030 old_array = rs->rules[rs_num].active.ptr_array; 1031 1032 rs->rules[rs_num].active.ptr = 1033 rs->rules[rs_num].inactive.ptr; 1034 rs->rules[rs_num].active.ptr_array = 1035 rs->rules[rs_num].inactive.ptr_array; 1036 rs->rules[rs_num].active.rcount = 1037 rs->rules[rs_num].inactive.rcount; 1038 rs->rules[rs_num].inactive.ptr = old_rules; 1039 rs->rules[rs_num].inactive.ptr_array = old_array; 1040 rs->rules[rs_num].inactive.rcount = old_rcount; 1041 1042 rs->rules[rs_num].active.ticket = 1043 rs->rules[rs_num].inactive.ticket; 1044 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 1045 1046 1047 /* Purge the old rule list. */ 1048 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 1049 pf_rm_rule(old_rules, rule); 1050 if (rs->rules[rs_num].inactive.ptr_array) 1051 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 1052 rs->rules[rs_num].inactive.ptr_array = NULL; 1053 rs->rules[rs_num].inactive.rcount = 0; 1054 rs->rules[rs_num].inactive.open = 0; 1055 pf_remove_if_empty_ruleset(rs); 1056 splx(s); 1057 return (0); 1058 } 1059 1060 void 1061 pf_state_export(struct pfsync_state *sp, struct pf_state_key *sk, 1062 struct pf_state *s) 1063 { 1064 int secs = time_second; 1065 bzero(sp, sizeof(struct pfsync_state)); 1066 1067 /* copy from state key */ 1068 sp->lan.addr = sk->lan.addr; 1069 sp->lan.port = sk->lan.port; 1070 sp->gwy.addr = sk->gwy.addr; 1071 sp->gwy.port = sk->gwy.port; 1072 sp->ext.addr = sk->ext.addr; 1073 sp->ext.port = sk->ext.port; 1074 sp->proto = sk->proto; 1075 sp->af = sk->af; 1076 sp->direction = sk->direction; 1077 1078 /* copy from state */ 1079 memcpy(&sp->id, &s->id, sizeof(sp->id)); 1080 sp->creatorid = s->creatorid; 1081 strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname)); 1082 pf_state_peer_to_pfsync(&s->src, &sp->src); 1083 pf_state_peer_to_pfsync(&s->dst, &sp->dst); 1084 1085 sp->rule = s->rule.ptr->nr; 1086 sp->nat_rule = (s->nat_rule.ptr == NULL) ? -1 : s->nat_rule.ptr->nr; 1087 sp->anchor = (s->anchor.ptr == NULL) ? -1 : s->anchor.ptr->nr; 1088 1089 pf_state_counter_to_pfsync(s->bytes[0], sp->bytes[0]); 1090 pf_state_counter_to_pfsync(s->bytes[1], sp->bytes[1]); 1091 pf_state_counter_to_pfsync(s->packets[0], sp->packets[0]); 1092 pf_state_counter_to_pfsync(s->packets[1], sp->packets[1]); 1093 sp->creation = secs - s->creation; 1094 sp->expire = pf_state_expires(s); 1095 sp->log = s->log; 1096 sp->allow_opts = s->allow_opts; 1097 sp->timeout = s->timeout; 1098 1099 if (s->src_node) 1100 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 1101 if (s->nat_src_node) 1102 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 1103 1104 if (sp->expire > secs) 1105 sp->expire -= secs; 1106 else 1107 sp->expire = 0; 1108 1109 } 1110 1111 void 1112 pf_state_import(struct pfsync_state *sp, struct pf_state_key *sk, 1113 struct pf_state *s) 1114 { 1115 /* copy to state key */ 1116 sk->lan.addr = sp->lan.addr; 1117 sk->lan.port = sp->lan.port; 1118 sk->gwy.addr = sp->gwy.addr; 1119 sk->gwy.port = sp->gwy.port; 1120 sk->ext.addr = sp->ext.addr; 1121 sk->ext.port = sp->ext.port; 1122 sk->proto = sp->proto; 1123 sk->af = sp->af; 1124 sk->direction = sp->direction; 1125 1126 /* copy to state */ 1127 memcpy(&s->id, &sp->id, sizeof(sp->id)); 1128 s->creatorid = sp->creatorid; 1129 pf_state_peer_from_pfsync(&sp->src, &s->src); 1130 pf_state_peer_from_pfsync(&sp->dst, &s->dst); 1131 1132 s->rule.ptr = &pf_default_rule; 1133 s->rule.ptr->states++; 1134 s->nat_rule.ptr = NULL; 1135 s->anchor.ptr = NULL; 1136 s->rt_kif = NULL; 1137 s->creation = time_second; 1138 s->expire = time_second; 1139 s->timeout = sp->timeout; 1140 if (sp->expire > 0) 1141 s->expire -= pf_default_rule.timeout[sp->timeout] - sp->expire; 1142 s->pfsync_time = 0; 1143 s->packets[0] = s->packets[1] = 0; 1144 s->bytes[0] = s->bytes[1] = 0; 1145 } 1146 1147 int 1148 pf_state_add(struct pfsync_state* sp) 1149 { 1150 struct pf_state *s; 1151 struct pf_state_key *sk; 1152 struct pfi_kif *kif; 1153 1154 if (sp->timeout >= PFTM_MAX && 1155 sp->timeout != PFTM_UNTIL_PACKET) { 1156 return EINVAL; 1157 } 1158 s = pool_get(&pf_state_pl, PR_NOWAIT); 1159 if (s == NULL) { 1160 return ENOMEM; 1161 } 1162 bzero(s, sizeof(struct pf_state)); 1163 if ((sk = pf_alloc_state_key(s)) == NULL) { 1164 pool_put(&pf_state_pl, s); 1165 return ENOMEM; 1166 } 1167 pf_state_import(sp, sk, s); 1168 kif = pfi_kif_get(sp->ifname); 1169 if (kif == NULL) { 1170 pool_put(&pf_state_pl, s); 1171 pool_put(&pf_state_key_pl, sk); 1172 return ENOENT; 1173 } 1174 if (pf_insert_state(kif, s)) { 1175 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 1176 pool_put(&pf_state_pl, s); 1177 return ENOMEM; 1178 } 1179 1180 return 0; 1181 } 1182 1183 1184 int 1185 pf_setup_pfsync_matching(struct pf_ruleset *rs) 1186 { 1187 MD5_CTX ctx; 1188 struct pf_rule *rule; 1189 int rs_cnt; 1190 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 1191 1192 MD5Init(&ctx); 1193 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 1194 /* XXX PF_RULESET_SCRUB as well? */ 1195 if (rs_cnt == PF_RULESET_SCRUB) 1196 continue; 1197 1198 if (rs->rules[rs_cnt].inactive.ptr_array) 1199 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 1200 rs->rules[rs_cnt].inactive.ptr_array = NULL; 1201 1202 if (rs->rules[rs_cnt].inactive.rcount) { 1203 rs->rules[rs_cnt].inactive.ptr_array = 1204 malloc(sizeof(void *) * 1205 rs->rules[rs_cnt].inactive.rcount, 1206 M_TEMP, M_NOWAIT); 1207 1208 if (!rs->rules[rs_cnt].inactive.ptr_array) 1209 return (ENOMEM); 1210 } 1211 1212 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 1213 entries) { 1214 pf_hash_rule(&ctx, rule); 1215 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 1216 } 1217 } 1218 1219 MD5Final(digest, &ctx); 1220 memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum)); 1221 return (0); 1222 } 1223 1224 int 1225 pfioctl(dev_t dev, u_long cmd, void *addr, int flags, struct lwp *l) 1226 { 1227 struct pf_pooladdr *pa = NULL; 1228 struct pf_pool *pool = NULL; 1229 int s; 1230 int error = 0; 1231 1232 /* XXX keep in sync with switch() below */ 1233 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 1234 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) 1235 switch (cmd) { 1236 case DIOCGETRULES: 1237 case DIOCGETRULE: 1238 case DIOCGETADDRS: 1239 case DIOCGETADDR: 1240 case DIOCGETSTATE: 1241 case DIOCSETSTATUSIF: 1242 case DIOCGETSTATUS: 1243 case DIOCCLRSTATUS: 1244 case DIOCNATLOOK: 1245 case DIOCSETDEBUG: 1246 case DIOCGETSTATES: 1247 case DIOCGETTIMEOUT: 1248 case DIOCCLRRULECTRS: 1249 case DIOCGETLIMIT: 1250 case DIOCGETALTQS: 1251 case DIOCGETALTQ: 1252 case DIOCGETQSTATS: 1253 case DIOCGETRULESETS: 1254 case DIOCGETRULESET: 1255 case DIOCRGETTABLES: 1256 case DIOCRGETTSTATS: 1257 case DIOCRCLRTSTATS: 1258 case DIOCRCLRADDRS: 1259 case DIOCRADDADDRS: 1260 case DIOCRDELADDRS: 1261 case DIOCRSETADDRS: 1262 case DIOCRGETADDRS: 1263 case DIOCRGETASTATS: 1264 case DIOCRCLRASTATS: 1265 case DIOCRTSTADDRS: 1266 case DIOCOSFPGET: 1267 case DIOCGETSRCNODES: 1268 case DIOCCLRSRCNODES: 1269 case DIOCIGETIFACES: 1270 case DIOCSETIFFLAG: 1271 case DIOCCLRIFFLAG: 1272 case DIOCSETLCK: 1273 case DIOCADDSTATES: 1274 break; 1275 case DIOCRCLRTABLES: 1276 case DIOCRADDTABLES: 1277 case DIOCRDELTABLES: 1278 case DIOCRSETTFLAGS: 1279 if (((struct pfioc_table *)addr)->pfrio_flags & 1280 PFR_FLAG_DUMMY) 1281 break; /* dummy operation ok */ 1282 return (EPERM); 1283 default: 1284 return (EPERM); 1285 } 1286 1287 if (!(flags & FWRITE)) 1288 switch (cmd) { 1289 case DIOCGETRULES: 1290 case DIOCGETADDRS: 1291 case DIOCGETADDR: 1292 case DIOCGETSTATE: 1293 case DIOCGETSTATUS: 1294 case DIOCGETSTATES: 1295 case DIOCGETTIMEOUT: 1296 case DIOCGETLIMIT: 1297 case DIOCGETALTQS: 1298 case DIOCGETALTQ: 1299 case DIOCGETQSTATS: 1300 case DIOCGETRULESETS: 1301 case DIOCGETRULESET: 1302 case DIOCNATLOOK: 1303 case DIOCRGETTABLES: 1304 case DIOCRGETTSTATS: 1305 case DIOCRGETADDRS: 1306 case DIOCRGETASTATS: 1307 case DIOCRTSTADDRS: 1308 case DIOCOSFPGET: 1309 case DIOCGETSRCNODES: 1310 case DIOCIGETIFACES: 1311 case DIOCSETLCK: 1312 break; 1313 case DIOCRCLRTABLES: 1314 case DIOCRADDTABLES: 1315 case DIOCRDELTABLES: 1316 case DIOCRCLRTSTATS: 1317 case DIOCRCLRADDRS: 1318 case DIOCRADDADDRS: 1319 case DIOCRDELADDRS: 1320 case DIOCRSETADDRS: 1321 case DIOCRSETTFLAGS: 1322 case DIOCADDSTATES: 1323 if (((struct pfioc_table *)addr)->pfrio_flags & 1324 PFR_FLAG_DUMMY) { 1325 flags |= FWRITE; /* need write lock for dummy */ 1326 break; /* dummy operation ok */ 1327 } 1328 return (EACCES); 1329 case DIOCGETRULE: 1330 if (((struct pfioc_rule *)addr)->action == PF_GET_CLR_CNTR) 1331 return (EACCES); 1332 break; 1333 default: 1334 return (EACCES); 1335 } 1336 1337 if (flags & FWRITE) 1338 rw_enter_write(&pf_consistency_lock); 1339 else 1340 rw_enter_read(&pf_consistency_lock); 1341 1342 s = splsoftnet(); 1343 switch (cmd) { 1344 1345 case DIOCSTART: 1346 if (pf_status.running) 1347 error = EEXIST; 1348 else { 1349 #ifdef __NetBSD__ 1350 error = pf_pfil_attach(); 1351 if (error) 1352 break; 1353 #endif /* __NetBSD__ */ 1354 pf_status.running = 1; 1355 pf_status.since = time_second; 1356 if (pf_status.stateid == 0) { 1357 pf_status.stateid = time_second; 1358 pf_status.stateid = pf_status.stateid << 32; 1359 } 1360 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1361 } 1362 break; 1363 1364 case DIOCSTOP: 1365 if (!pf_status.running) 1366 error = ENOENT; 1367 else { 1368 #ifdef __NetBSD__ 1369 error = pf_pfil_detach(); 1370 if (error) 1371 break; 1372 #endif /* __NetBSD__ */ 1373 pf_status.running = 0; 1374 pf_status.since = time_second; 1375 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1376 } 1377 break; 1378 1379 case DIOCADDRULE: { 1380 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1381 struct pf_ruleset *ruleset; 1382 struct pf_rule *rule, *tail; 1383 int rs_num; 1384 1385 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1386 ruleset = pf_find_ruleset(pr->anchor); 1387 if (ruleset == NULL) { 1388 error = EINVAL; 1389 break; 1390 } 1391 rs_num = pf_get_ruleset_number(pr->rule.action); 1392 if (rs_num >= PF_RULESET_MAX) { 1393 error = EINVAL; 1394 break; 1395 } 1396 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1397 error = EINVAL; 1398 break; 1399 } 1400 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1401 error = EBUSY; 1402 break; 1403 } 1404 if (pr->pool_ticket != ticket_pabuf) { 1405 error = EBUSY; 1406 break; 1407 } 1408 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1409 if (rule == NULL) { 1410 error = ENOMEM; 1411 break; 1412 } 1413 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1414 #ifdef __NetBSD__ 1415 rule->cuid = kauth_cred_getuid(l->l_cred); 1416 rule->cpid = l->l_proc->p_pid; 1417 #else 1418 rule->cuid = p->p_cred->p_ruid; 1419 rule->cpid = p->p_pid; 1420 #endif /* !__NetBSD__ */ 1421 rule->anchor = NULL; 1422 rule->kif = NULL; 1423 TAILQ_INIT(&rule->rpool.list); 1424 /* initialize refcounting */ 1425 rule->states = 0; 1426 rule->src_nodes = 0; 1427 rule->entries.tqe_prev = NULL; 1428 #ifndef INET 1429 if (rule->af == AF_INET) { 1430 pool_put(&pf_rule_pl, rule); 1431 error = EAFNOSUPPORT; 1432 break; 1433 } 1434 #endif /* INET */ 1435 #ifndef INET6 1436 if (rule->af == AF_INET6) { 1437 pool_put(&pf_rule_pl, rule); 1438 error = EAFNOSUPPORT; 1439 break; 1440 } 1441 #endif /* INET6 */ 1442 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1443 pf_rulequeue); 1444 if (tail) 1445 rule->nr = tail->nr + 1; 1446 else 1447 rule->nr = 0; 1448 if (rule->ifname[0]) { 1449 rule->kif = pfi_kif_get(rule->ifname); 1450 if (rule->kif == NULL) { 1451 pool_put(&pf_rule_pl, rule); 1452 error = EINVAL; 1453 break; 1454 } 1455 pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE); 1456 } 1457 1458 #ifndef __NetBSD__ 1459 if (rule->rtableid > 0 && !rtable_exists(rule->rtableid)) 1460 error = EBUSY; 1461 #endif /* !__NetBSD__ */ 1462 1463 #ifdef ALTQ 1464 /* set queue IDs */ 1465 if (rule->qname[0] != 0) { 1466 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1467 error = EBUSY; 1468 else if (rule->pqname[0] != 0) { 1469 if ((rule->pqid = 1470 pf_qname2qid(rule->pqname)) == 0) 1471 error = EBUSY; 1472 } else 1473 rule->pqid = rule->qid; 1474 } 1475 #endif 1476 if (rule->tagname[0]) 1477 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1478 error = EBUSY; 1479 if (rule->match_tagname[0]) 1480 if ((rule->match_tag = 1481 pf_tagname2tag(rule->match_tagname)) == 0) 1482 error = EBUSY; 1483 if (rule->rt && !rule->direction) 1484 error = EINVAL; 1485 #if NPFLOG > 0 1486 if (!rule->log) 1487 rule->logif = 0; 1488 if (rule->logif >= PFLOGIFS_MAX) 1489 error = EINVAL; 1490 #endif 1491 if (pf_rtlabel_add(&rule->src.addr) || 1492 pf_rtlabel_add(&rule->dst.addr)) 1493 error = EBUSY; 1494 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1495 error = EINVAL; 1496 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1497 error = EINVAL; 1498 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1499 error = EINVAL; 1500 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1501 error = EINVAL; 1502 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1503 error = EINVAL; 1504 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1505 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1506 error = EINVAL; 1507 1508 rule->overload_tbl = NULL; 1509 if (rule->overload_tblname[0]) { 1510 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1511 rule->overload_tblname)) == NULL) 1512 error = EINVAL; 1513 else 1514 rule->overload_tbl->pfrkt_flags |= 1515 PFR_TFLAG_ACTIVE; 1516 } 1517 1518 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1519 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1520 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1521 (rule->rt > PF_FASTROUTE)) && 1522 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1523 error = EINVAL; 1524 1525 if (error) { 1526 pf_rm_rule(NULL, rule); 1527 break; 1528 } 1529 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1530 rule->evaluations = rule->packets[0] = rule->packets[1] = 1531 rule->bytes[0] = rule->bytes[1] = 0; 1532 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1533 rule, entries); 1534 ruleset->rules[rs_num].inactive.rcount++; 1535 break; 1536 } 1537 1538 case DIOCGETRULES: { 1539 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1540 struct pf_ruleset *ruleset; 1541 struct pf_rule *tail; 1542 int rs_num; 1543 1544 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1545 ruleset = pf_find_ruleset(pr->anchor); 1546 if (ruleset == NULL) { 1547 error = EINVAL; 1548 break; 1549 } 1550 rs_num = pf_get_ruleset_number(pr->rule.action); 1551 if (rs_num >= PF_RULESET_MAX) { 1552 error = EINVAL; 1553 break; 1554 } 1555 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1556 pf_rulequeue); 1557 if (tail) 1558 pr->nr = tail->nr + 1; 1559 else 1560 pr->nr = 0; 1561 pr->ticket = ruleset->rules[rs_num].active.ticket; 1562 break; 1563 } 1564 1565 case DIOCGETRULE: { 1566 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1567 struct pf_ruleset *ruleset; 1568 struct pf_rule *rule; 1569 int rs_num, i; 1570 1571 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1572 ruleset = pf_find_ruleset(pr->anchor); 1573 if (ruleset == NULL) { 1574 error = EINVAL; 1575 break; 1576 } 1577 rs_num = pf_get_ruleset_number(pr->rule.action); 1578 if (rs_num >= PF_RULESET_MAX) { 1579 error = EINVAL; 1580 break; 1581 } 1582 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1583 error = EBUSY; 1584 break; 1585 } 1586 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1587 while ((rule != NULL) && (rule->nr != pr->nr)) 1588 rule = TAILQ_NEXT(rule, entries); 1589 if (rule == NULL) { 1590 error = EBUSY; 1591 break; 1592 } 1593 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1594 if (pf_anchor_copyout(ruleset, rule, pr)) { 1595 error = EBUSY; 1596 break; 1597 } 1598 pfi_dynaddr_copyout(&pr->rule.src.addr); 1599 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1600 pf_tbladdr_copyout(&pr->rule.src.addr); 1601 pf_tbladdr_copyout(&pr->rule.dst.addr); 1602 pf_rtlabel_copyout(&pr->rule.src.addr); 1603 pf_rtlabel_copyout(&pr->rule.dst.addr); 1604 for (i = 0; i < PF_SKIP_COUNT; ++i) 1605 if (rule->skip[i].ptr == NULL) 1606 pr->rule.skip[i].nr = -1; 1607 else 1608 pr->rule.skip[i].nr = 1609 rule->skip[i].ptr->nr; 1610 1611 if (pr->action == PF_GET_CLR_CNTR) { 1612 rule->evaluations = 0; 1613 rule->packets[0] = rule->packets[1] = 0; 1614 rule->bytes[0] = rule->bytes[1] = 0; 1615 } 1616 break; 1617 } 1618 1619 case DIOCCHANGERULE: { 1620 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1621 struct pf_ruleset *ruleset; 1622 struct pf_rule *oldrule = NULL, *newrule = NULL; 1623 u_int32_t nr = 0; 1624 int rs_num; 1625 1626 if (!(pcr->action == PF_CHANGE_REMOVE || 1627 pcr->action == PF_CHANGE_GET_TICKET) && 1628 pcr->pool_ticket != ticket_pabuf) { 1629 error = EBUSY; 1630 break; 1631 } 1632 1633 if (pcr->action < PF_CHANGE_ADD_HEAD || 1634 pcr->action > PF_CHANGE_GET_TICKET) { 1635 error = EINVAL; 1636 break; 1637 } 1638 ruleset = pf_find_ruleset(pcr->anchor); 1639 if (ruleset == NULL) { 1640 error = EINVAL; 1641 break; 1642 } 1643 rs_num = pf_get_ruleset_number(pcr->rule.action); 1644 if (rs_num >= PF_RULESET_MAX) { 1645 error = EINVAL; 1646 break; 1647 } 1648 1649 if (pcr->action == PF_CHANGE_GET_TICKET) { 1650 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1651 break; 1652 } else { 1653 if (pcr->ticket != 1654 ruleset->rules[rs_num].active.ticket) { 1655 error = EINVAL; 1656 break; 1657 } 1658 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1659 error = EINVAL; 1660 break; 1661 } 1662 } 1663 1664 if (pcr->action != PF_CHANGE_REMOVE) { 1665 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1666 if (newrule == NULL) { 1667 error = ENOMEM; 1668 break; 1669 } 1670 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1671 #ifdef __NetBSD__ 1672 newrule->cuid = kauth_cred_getuid(l->l_cred); 1673 newrule->cpid = l->l_proc->p_pid; 1674 #else 1675 newrule->cuid = p->p_cred->p_ruid; 1676 newrule->cpid = p->p_pid; 1677 #endif /* !__NetBSD__ */ 1678 TAILQ_INIT(&newrule->rpool.list); 1679 /* initialize refcounting */ 1680 newrule->states = 0; 1681 newrule->entries.tqe_prev = NULL; 1682 #ifndef INET 1683 if (newrule->af == AF_INET) { 1684 pool_put(&pf_rule_pl, newrule); 1685 error = EAFNOSUPPORT; 1686 break; 1687 } 1688 #endif /* INET */ 1689 #ifndef INET6 1690 if (newrule->af == AF_INET6) { 1691 pool_put(&pf_rule_pl, newrule); 1692 error = EAFNOSUPPORT; 1693 break; 1694 } 1695 #endif /* INET6 */ 1696 if (newrule->ifname[0]) { 1697 newrule->kif = pfi_kif_get(newrule->ifname); 1698 if (newrule->kif == NULL) { 1699 pool_put(&pf_rule_pl, newrule); 1700 error = EINVAL; 1701 break; 1702 } 1703 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE); 1704 } else 1705 newrule->kif = NULL; 1706 1707 #ifndef __NetBSD__ 1708 if (newrule->rtableid > 0 && 1709 !rtable_exists(newrule->rtableid)) 1710 error = EBUSY; 1711 #endif /* !__NetBSD__ */ 1712 1713 #ifdef ALTQ 1714 /* set queue IDs */ 1715 if (newrule->qname[0] != 0) { 1716 if ((newrule->qid = 1717 pf_qname2qid(newrule->qname)) == 0) 1718 error = EBUSY; 1719 else if (newrule->pqname[0] != 0) { 1720 if ((newrule->pqid = 1721 pf_qname2qid(newrule->pqname)) == 0) 1722 error = EBUSY; 1723 } else 1724 newrule->pqid = newrule->qid; 1725 } 1726 #endif /* ALTQ */ 1727 if (newrule->tagname[0]) 1728 if ((newrule->tag = 1729 pf_tagname2tag(newrule->tagname)) == 0) 1730 error = EBUSY; 1731 if (newrule->match_tagname[0]) 1732 if ((newrule->match_tag = pf_tagname2tag( 1733 newrule->match_tagname)) == 0) 1734 error = EBUSY; 1735 if (newrule->rt && !newrule->direction) 1736 error = EINVAL; 1737 #if NPFLOG > 0 1738 if (!newrule->log) 1739 newrule->logif = 0; 1740 if (newrule->logif >= PFLOGIFS_MAX) 1741 error = EINVAL; 1742 #endif 1743 if (pf_rtlabel_add(&newrule->src.addr) || 1744 pf_rtlabel_add(&newrule->dst.addr)) 1745 error = EBUSY; 1746 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1747 error = EINVAL; 1748 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1749 error = EINVAL; 1750 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1751 error = EINVAL; 1752 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1753 error = EINVAL; 1754 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1755 error = EINVAL; 1756 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1757 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1758 error = EINVAL; 1759 1760 newrule->overload_tbl = NULL; 1761 if (newrule->overload_tblname[0]) { 1762 if ((newrule->overload_tbl = pfr_attach_table( 1763 ruleset, newrule->overload_tblname)) == 1764 NULL) 1765 error = EINVAL; 1766 else 1767 newrule->overload_tbl->pfrkt_flags |= 1768 PFR_TFLAG_ACTIVE; 1769 } 1770 1771 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1772 if (((((newrule->action == PF_NAT) || 1773 (newrule->action == PF_RDR) || 1774 (newrule->action == PF_BINAT) || 1775 (newrule->rt > PF_FASTROUTE)) && 1776 !newrule->anchor)) && 1777 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1778 error = EINVAL; 1779 1780 if (error) { 1781 pf_rm_rule(NULL, newrule); 1782 break; 1783 } 1784 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1785 newrule->evaluations = 0; 1786 newrule->packets[0] = newrule->packets[1] = 0; 1787 newrule->bytes[0] = newrule->bytes[1] = 0; 1788 } 1789 pf_empty_pool(&pf_pabuf); 1790 1791 if (pcr->action == PF_CHANGE_ADD_HEAD) 1792 oldrule = TAILQ_FIRST( 1793 ruleset->rules[rs_num].active.ptr); 1794 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1795 oldrule = TAILQ_LAST( 1796 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1797 else { 1798 oldrule = TAILQ_FIRST( 1799 ruleset->rules[rs_num].active.ptr); 1800 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1801 oldrule = TAILQ_NEXT(oldrule, entries); 1802 if (oldrule == NULL) { 1803 if (newrule != NULL) 1804 pf_rm_rule(NULL, newrule); 1805 error = EINVAL; 1806 break; 1807 } 1808 } 1809 1810 if (pcr->action == PF_CHANGE_REMOVE) { 1811 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1812 ruleset->rules[rs_num].active.rcount--; 1813 } else { 1814 if (oldrule == NULL) 1815 TAILQ_INSERT_TAIL( 1816 ruleset->rules[rs_num].active.ptr, 1817 newrule, entries); 1818 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1819 pcr->action == PF_CHANGE_ADD_BEFORE) 1820 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1821 else 1822 TAILQ_INSERT_AFTER( 1823 ruleset->rules[rs_num].active.ptr, 1824 oldrule, newrule, entries); 1825 ruleset->rules[rs_num].active.rcount++; 1826 } 1827 1828 nr = 0; 1829 TAILQ_FOREACH(oldrule, 1830 ruleset->rules[rs_num].active.ptr, entries) 1831 oldrule->nr = nr++; 1832 1833 ruleset->rules[rs_num].active.ticket++; 1834 1835 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1836 pf_remove_if_empty_ruleset(ruleset); 1837 1838 break; 1839 } 1840 1841 case DIOCCLRSTATES: { 1842 struct pf_state *ps, *nexts; 1843 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1844 int killed = 0; 1845 1846 for (ps = RB_MIN(pf_state_tree_id, &tree_id); ps; ps = nexts) { 1847 nexts = RB_NEXT(pf_state_tree_id, &tree_id, ps); 1848 1849 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1850 ps->kif->pfik_name)) { 1851 #if NPFSYNC 1852 /* don't send out individual delete messages */ 1853 ps->sync_flags = PFSTATE_NOSYNC; 1854 #endif 1855 pf_unlink_state(ps); 1856 killed++; 1857 } 1858 } 1859 psk->psk_af = killed; 1860 #if NPFSYNC 1861 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1862 #endif 1863 break; 1864 } 1865 1866 case DIOCKILLSTATES: { 1867 struct pf_state *ps, *nexts; 1868 struct pf_state_key *sk; 1869 struct pf_state_host *src, *dst; 1870 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1871 int killed = 0; 1872 1873 for (ps = RB_MIN(pf_state_tree_id, &tree_id); ps; 1874 ps = nexts) { 1875 nexts = RB_NEXT(pf_state_tree_id, &tree_id, ps); 1876 sk = ps->state_key; 1877 1878 if (sk->direction == PF_OUT) { 1879 src = &sk->lan; 1880 dst = &sk->ext; 1881 } else { 1882 src = &sk->ext; 1883 dst = &sk->lan; 1884 } 1885 if ((!psk->psk_af || sk->af == psk->psk_af) 1886 && (!psk->psk_proto || psk->psk_proto == 1887 sk->proto) && 1888 PF_MATCHA(psk->psk_src.neg, 1889 &psk->psk_src.addr.v.a.addr, 1890 &psk->psk_src.addr.v.a.mask, 1891 &src->addr, sk->af) && 1892 PF_MATCHA(psk->psk_dst.neg, 1893 &psk->psk_dst.addr.v.a.addr, 1894 &psk->psk_dst.addr.v.a.mask, 1895 &dst->addr, sk->af) && 1896 (psk->psk_src.port_op == 0 || 1897 pf_match_port(psk->psk_src.port_op, 1898 psk->psk_src.port[0], psk->psk_src.port[1], 1899 src->port)) && 1900 (psk->psk_dst.port_op == 0 || 1901 pf_match_port(psk->psk_dst.port_op, 1902 psk->psk_dst.port[0], psk->psk_dst.port[1], 1903 dst->port)) && 1904 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1905 ps->kif->pfik_name))) { 1906 #if NPFSYNC > 0 1907 /* send immediate delete of state */ 1908 pfsync_delete_state(ps); 1909 ps->sync_flags |= PFSTATE_NOSYNC; 1910 #endif 1911 pf_unlink_state(ps); 1912 killed++; 1913 } 1914 } 1915 psk->psk_af = killed; 1916 break; 1917 } 1918 1919 case DIOCADDSTATE: { 1920 struct pfioc_state *ps = (struct pfioc_state *)addr; 1921 struct pfsync_state *sp = (struct pfsync_state *)ps->state; 1922 1923 error = pf_state_add(sp); 1924 break; 1925 } 1926 1927 case DIOCADDSTATES: { 1928 struct pfioc_states *ps = (struct pfioc_states *)addr; 1929 struct pfsync_state *p = (struct pfsync_state *) ps->ps_states; 1930 struct pfsync_state *pk; 1931 int size = ps->ps_len; 1932 int i = 0; 1933 error = 0; 1934 1935 pk = malloc(sizeof(*pk), M_TEMP,M_WAITOK); 1936 1937 while (error == 0 && i < size) 1938 { 1939 if (copyin(p, pk, sizeof(struct pfsync_state))) 1940 { 1941 error = EFAULT; 1942 free(pk, M_TEMP); 1943 } else { 1944 error = pf_state_add(pk); 1945 i += sizeof(*p); 1946 p++; 1947 } 1948 } 1949 1950 free(pk, M_TEMP); 1951 break; 1952 } 1953 1954 1955 case DIOCGETSTATE: { 1956 struct pfioc_state *ps = (struct pfioc_state *)addr; 1957 struct pf_state *pfs; 1958 u_int32_t nr; 1959 1960 nr = 0; 1961 RB_FOREACH(pfs, pf_state_tree_id, &tree_id) { 1962 if (nr >= ps->nr) 1963 break; 1964 nr++; 1965 } 1966 if (pfs == NULL) { 1967 error = EBUSY; 1968 break; 1969 } 1970 1971 pf_state_export((struct pfsync_state *)&ps->state, 1972 pfs->state_key, pfs); 1973 break; 1974 } 1975 1976 case DIOCGETSTATES: { 1977 struct pfioc_states *ps = (struct pfioc_states *)addr; 1978 struct pf_state *state; 1979 struct pfsync_state *p, *pstore; 1980 u_int32_t nr = 0; 1981 1982 if (ps->ps_len == 0) { 1983 nr = pf_status.states; 1984 ps->ps_len = sizeof(struct pfsync_state) * nr; 1985 break; 1986 } 1987 1988 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 1989 1990 p = ps->ps_states; 1991 1992 state = TAILQ_FIRST(&state_list); 1993 while (state) { 1994 if (state->timeout != PFTM_UNLINKED) { 1995 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1996 break; 1997 1998 pf_state_export(pstore, 1999 state->state_key, state); 2000 error = copyout(pstore, p, sizeof(*p)); 2001 if (error) { 2002 free(pstore, M_TEMP); 2003 goto fail; 2004 } 2005 p++; 2006 nr++; 2007 } 2008 state = TAILQ_NEXT(state, entry_list); 2009 } 2010 2011 ps->ps_len = sizeof(struct pfsync_state) * nr; 2012 2013 free(pstore, M_TEMP); 2014 break; 2015 } 2016 2017 case DIOCGETSTATUS: { 2018 struct pf_status *ps = (struct pf_status *)addr; 2019 bcopy(&pf_status, ps, sizeof(struct pf_status)); 2020 pfi_fill_oldstatus(ps); 2021 break; 2022 } 2023 2024 case DIOCSETSTATUSIF: { 2025 struct pfioc_if *pi = (struct pfioc_if *)addr; 2026 2027 if (pi->ifname[0] == 0) { 2028 bzero(pf_status.ifname, IFNAMSIZ); 2029 break; 2030 } 2031 if (ifunit(pi->ifname) == NULL) { 2032 error = EINVAL; 2033 break; 2034 } 2035 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 2036 break; 2037 } 2038 2039 case DIOCCLRSTATUS: { 2040 bzero(pf_status.counters, sizeof(pf_status.counters)); 2041 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 2042 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 2043 pf_status.since = time_second; 2044 if (*pf_status.ifname) 2045 pfi_clr_istats(pf_status.ifname); 2046 break; 2047 } 2048 2049 case DIOCNATLOOK: { 2050 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 2051 struct pf_state_key *sk; 2052 struct pf_state *state; 2053 struct pf_state_key_cmp key; 2054 int m = 0, direction = pnl->direction; 2055 2056 key.af = pnl->af; 2057 key.proto = pnl->proto; 2058 2059 if (!pnl->proto || 2060 PF_AZERO(&pnl->saddr, pnl->af) || 2061 PF_AZERO(&pnl->daddr, pnl->af) || 2062 ((pnl->proto == IPPROTO_TCP || 2063 pnl->proto == IPPROTO_UDP) && 2064 (!pnl->dport || !pnl->sport))) 2065 error = EINVAL; 2066 else { 2067 /* 2068 * userland gives us source and dest of connection, 2069 * reverse the lookup so we ask for what happens with 2070 * the return traffic, enabling us to find it in the 2071 * state tree. 2072 */ 2073 if (direction == PF_IN) { 2074 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 2075 key.ext.port = pnl->dport; 2076 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 2077 key.gwy.port = pnl->sport; 2078 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 2079 } else { 2080 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 2081 key.lan.port = pnl->dport; 2082 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 2083 key.ext.port = pnl->sport; 2084 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 2085 } 2086 if (m > 1) 2087 error = E2BIG; /* more than one state */ 2088 else if (state != NULL) { 2089 sk = state->state_key; 2090 if (direction == PF_IN) { 2091 PF_ACPY(&pnl->rsaddr, &sk->lan.addr, 2092 sk->af); 2093 pnl->rsport = sk->lan.port; 2094 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 2095 pnl->af); 2096 pnl->rdport = pnl->dport; 2097 } else { 2098 PF_ACPY(&pnl->rdaddr, &sk->gwy.addr, 2099 sk->af); 2100 pnl->rdport = sk->gwy.port; 2101 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 2102 pnl->af); 2103 pnl->rsport = pnl->sport; 2104 } 2105 } else 2106 error = ENOENT; 2107 } 2108 break; 2109 } 2110 2111 case DIOCSETTIMEOUT: { 2112 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 2113 int old; 2114 2115 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 2116 pt->seconds < 0) { 2117 error = EINVAL; 2118 goto fail; 2119 } 2120 old = pf_default_rule.timeout[pt->timeout]; 2121 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 2122 pt->seconds = 1; 2123 pf_default_rule.timeout[pt->timeout] = pt->seconds; 2124 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 2125 wakeup(pf_purge_thread); 2126 pt->seconds = old; 2127 break; 2128 } 2129 2130 case DIOCGETTIMEOUT: { 2131 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 2132 2133 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 2134 error = EINVAL; 2135 goto fail; 2136 } 2137 pt->seconds = pf_default_rule.timeout[pt->timeout]; 2138 break; 2139 } 2140 2141 case DIOCGETLIMIT: { 2142 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 2143 2144 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 2145 error = EINVAL; 2146 goto fail; 2147 } 2148 pl->limit = pf_pool_limits[pl->index].limit; 2149 break; 2150 } 2151 2152 case DIOCSETLIMIT: { 2153 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 2154 int old_limit; 2155 2156 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 2157 pf_pool_limits[pl->index].pp == NULL) { 2158 error = EINVAL; 2159 goto fail; 2160 } 2161 #ifdef __NetBSD__ 2162 pool_sethardlimit(pf_pool_limits[pl->index].pp, 2163 pl->limit, NULL, 0); 2164 #else 2165 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 2166 pl->limit, NULL, 0) != 0) { 2167 error = EBUSY; 2168 goto fail; 2169 } 2170 #endif /* !__NetBSD__ */ 2171 old_limit = pf_pool_limits[pl->index].limit; 2172 pf_pool_limits[pl->index].limit = pl->limit; 2173 pl->limit = old_limit; 2174 break; 2175 } 2176 2177 case DIOCSETDEBUG: { 2178 u_int32_t *level = (u_int32_t *)addr; 2179 2180 pf_status.debug = *level; 2181 break; 2182 } 2183 2184 case DIOCCLRRULECTRS: { 2185 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 2186 struct pf_ruleset *ruleset = &pf_main_ruleset; 2187 struct pf_rule *rule; 2188 2189 TAILQ_FOREACH(rule, 2190 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 2191 rule->evaluations = 0; 2192 rule->packets[0] = rule->packets[1] = 0; 2193 rule->bytes[0] = rule->bytes[1] = 0; 2194 } 2195 break; 2196 } 2197 2198 #ifdef ALTQ 2199 case DIOCSTARTALTQ: { 2200 struct pf_altq *altq; 2201 2202 /* enable all altq interfaces on active list */ 2203 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2204 if (altq->qname[0] == 0) { 2205 error = pf_enable_altq(altq); 2206 if (error != 0) 2207 break; 2208 } 2209 } 2210 if (error == 0) 2211 pf_altq_running = 1; 2212 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 2213 break; 2214 } 2215 2216 case DIOCSTOPALTQ: { 2217 struct pf_altq *altq; 2218 2219 /* disable all altq interfaces on active list */ 2220 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2221 if (altq->qname[0] == 0) { 2222 error = pf_disable_altq(altq); 2223 if (error != 0) 2224 break; 2225 } 2226 } 2227 if (error == 0) 2228 pf_altq_running = 0; 2229 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 2230 break; 2231 } 2232 2233 case DIOCADDALTQ: { 2234 struct pfioc_altq *paa = (struct pfioc_altq *)addr; 2235 struct pf_altq *altq, *a; 2236 2237 if (paa->ticket != ticket_altqs_inactive) { 2238 error = EBUSY; 2239 break; 2240 } 2241 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 2242 if (altq == NULL) { 2243 error = ENOMEM; 2244 break; 2245 } 2246 bcopy(&paa->altq, altq, sizeof(struct pf_altq)); 2247 2248 /* 2249 * if this is for a queue, find the discipline and 2250 * copy the necessary fields 2251 */ 2252 if (altq->qname[0] != 0) { 2253 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 2254 error = EBUSY; 2255 pool_put(&pf_altq_pl, altq); 2256 break; 2257 } 2258 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 2259 if (strncmp(a->ifname, altq->ifname, 2260 IFNAMSIZ) == 0 && a->qname[0] == 0) { 2261 altq->altq_disc = a->altq_disc; 2262 break; 2263 } 2264 } 2265 } 2266 2267 error = altq_add(altq); 2268 if (error) { 2269 pool_put(&pf_altq_pl, altq); 2270 break; 2271 } 2272 2273 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 2274 bcopy(altq, &paa->altq, sizeof(struct pf_altq)); 2275 break; 2276 } 2277 2278 case DIOCGETALTQS: { 2279 struct pfioc_altq *paa = (struct pfioc_altq *)addr; 2280 struct pf_altq *altq; 2281 2282 paa->nr = 0; 2283 TAILQ_FOREACH(altq, pf_altqs_active, entries) 2284 paa->nr++; 2285 paa->ticket = ticket_altqs_active; 2286 break; 2287 } 2288 2289 case DIOCGETALTQ: { 2290 struct pfioc_altq *paa = (struct pfioc_altq *)addr; 2291 struct pf_altq *altq; 2292 u_int32_t nr; 2293 2294 if (paa->ticket != ticket_altqs_active) { 2295 error = EBUSY; 2296 break; 2297 } 2298 nr = 0; 2299 altq = TAILQ_FIRST(pf_altqs_active); 2300 while ((altq != NULL) && (nr < paa->nr)) { 2301 altq = TAILQ_NEXT(altq, entries); 2302 nr++; 2303 } 2304 if (altq == NULL) { 2305 error = EBUSY; 2306 break; 2307 } 2308 bcopy(altq, &paa->altq, sizeof(struct pf_altq)); 2309 break; 2310 } 2311 2312 case DIOCCHANGEALTQ: 2313 /* CHANGEALTQ not supported yet! */ 2314 error = ENODEV; 2315 break; 2316 2317 case DIOCGETQSTATS: { 2318 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 2319 struct pf_altq *altq; 2320 u_int32_t nr; 2321 int nbytes; 2322 2323 if (pq->ticket != ticket_altqs_active) { 2324 error = EBUSY; 2325 break; 2326 } 2327 nbytes = pq->nbytes; 2328 nr = 0; 2329 altq = TAILQ_FIRST(pf_altqs_active); 2330 while ((altq != NULL) && (nr < pq->nr)) { 2331 altq = TAILQ_NEXT(altq, entries); 2332 nr++; 2333 } 2334 if (altq == NULL) { 2335 error = EBUSY; 2336 break; 2337 } 2338 error = altq_getqstats(altq, pq->buf, &nbytes); 2339 if (error == 0) { 2340 pq->scheduler = altq->scheduler; 2341 pq->nbytes = nbytes; 2342 } 2343 break; 2344 } 2345 #endif /* ALTQ */ 2346 2347 case DIOCBEGINADDRS: { 2348 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2349 2350 pf_empty_pool(&pf_pabuf); 2351 pp->ticket = ++ticket_pabuf; 2352 break; 2353 } 2354 2355 case DIOCADDADDR: { 2356 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2357 2358 if (pp->ticket != ticket_pabuf) { 2359 error = EBUSY; 2360 break; 2361 } 2362 #ifndef INET 2363 if (pp->af == AF_INET) { 2364 error = EAFNOSUPPORT; 2365 break; 2366 } 2367 #endif /* INET */ 2368 #ifndef INET6 2369 if (pp->af == AF_INET6) { 2370 error = EAFNOSUPPORT; 2371 break; 2372 } 2373 #endif /* INET6 */ 2374 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2375 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2376 pp->addr.addr.type != PF_ADDR_TABLE) { 2377 error = EINVAL; 2378 break; 2379 } 2380 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2381 if (pa == NULL) { 2382 error = ENOMEM; 2383 break; 2384 } 2385 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2386 if (pa->ifname[0]) { 2387 pa->kif = pfi_kif_get(pa->ifname); 2388 if (pa->kif == NULL) { 2389 pool_put(&pf_pooladdr_pl, pa); 2390 error = EINVAL; 2391 break; 2392 } 2393 pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE); 2394 } 2395 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 2396 pfi_dynaddr_remove(&pa->addr); 2397 pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE); 2398 pool_put(&pf_pooladdr_pl, pa); 2399 error = EINVAL; 2400 break; 2401 } 2402 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 2403 break; 2404 } 2405 2406 case DIOCGETADDRS: { 2407 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2408 2409 pp->nr = 0; 2410 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2411 pp->r_num, 0, 1, 0); 2412 if (pool == NULL) { 2413 error = EBUSY; 2414 break; 2415 } 2416 TAILQ_FOREACH(pa, &pool->list, entries) 2417 pp->nr++; 2418 break; 2419 } 2420 2421 case DIOCGETADDR: { 2422 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2423 u_int32_t nr = 0; 2424 2425 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2426 pp->r_num, 0, 1, 1); 2427 if (pool == NULL) { 2428 error = EBUSY; 2429 break; 2430 } 2431 pa = TAILQ_FIRST(&pool->list); 2432 while ((pa != NULL) && (nr < pp->nr)) { 2433 pa = TAILQ_NEXT(pa, entries); 2434 nr++; 2435 } 2436 if (pa == NULL) { 2437 error = EBUSY; 2438 break; 2439 } 2440 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2441 pfi_dynaddr_copyout(&pp->addr.addr); 2442 pf_tbladdr_copyout(&pp->addr.addr); 2443 pf_rtlabel_copyout(&pp->addr.addr); 2444 break; 2445 } 2446 2447 case DIOCCHANGEADDR: { 2448 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2449 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2450 struct pf_ruleset *ruleset; 2451 2452 if (pca->action < PF_CHANGE_ADD_HEAD || 2453 pca->action > PF_CHANGE_REMOVE) { 2454 error = EINVAL; 2455 break; 2456 } 2457 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2458 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2459 pca->addr.addr.type != PF_ADDR_TABLE) { 2460 error = EINVAL; 2461 break; 2462 } 2463 2464 ruleset = pf_find_ruleset(pca->anchor); 2465 if (ruleset == NULL) { 2466 error = EBUSY; 2467 break; 2468 } 2469 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2470 pca->r_num, pca->r_last, 1, 1); 2471 if (pool == NULL) { 2472 error = EBUSY; 2473 break; 2474 } 2475 if (pca->action != PF_CHANGE_REMOVE) { 2476 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2477 if (newpa == NULL) { 2478 error = ENOMEM; 2479 break; 2480 } 2481 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2482 #ifndef INET 2483 if (pca->af == AF_INET) { 2484 pool_put(&pf_pooladdr_pl, newpa); 2485 error = EAFNOSUPPORT; 2486 break; 2487 } 2488 #endif /* INET */ 2489 #ifndef INET6 2490 if (pca->af == AF_INET6) { 2491 pool_put(&pf_pooladdr_pl, newpa); 2492 error = EAFNOSUPPORT; 2493 break; 2494 } 2495 #endif /* INET6 */ 2496 if (newpa->ifname[0]) { 2497 newpa->kif = pfi_kif_get(newpa->ifname); 2498 if (newpa->kif == NULL) { 2499 pool_put(&pf_pooladdr_pl, newpa); 2500 error = EINVAL; 2501 break; 2502 } 2503 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE); 2504 } else 2505 newpa->kif = NULL; 2506 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2507 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2508 pfi_dynaddr_remove(&newpa->addr); 2509 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE); 2510 pool_put(&pf_pooladdr_pl, newpa); 2511 error = EINVAL; 2512 break; 2513 } 2514 } 2515 2516 if (pca->action == PF_CHANGE_ADD_HEAD) 2517 oldpa = TAILQ_FIRST(&pool->list); 2518 else if (pca->action == PF_CHANGE_ADD_TAIL) 2519 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2520 else { 2521 int i = 0; 2522 2523 oldpa = TAILQ_FIRST(&pool->list); 2524 while ((oldpa != NULL) && (i < pca->nr)) { 2525 oldpa = TAILQ_NEXT(oldpa, entries); 2526 i++; 2527 } 2528 if (oldpa == NULL) { 2529 error = EINVAL; 2530 break; 2531 } 2532 } 2533 2534 if (pca->action == PF_CHANGE_REMOVE) { 2535 TAILQ_REMOVE(&pool->list, oldpa, entries); 2536 pfi_dynaddr_remove(&oldpa->addr); 2537 pf_tbladdr_remove(&oldpa->addr); 2538 pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE); 2539 pool_put(&pf_pooladdr_pl, oldpa); 2540 } else { 2541 if (oldpa == NULL) 2542 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2543 else if (pca->action == PF_CHANGE_ADD_HEAD || 2544 pca->action == PF_CHANGE_ADD_BEFORE) 2545 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2546 else 2547 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2548 newpa, entries); 2549 } 2550 2551 pool->cur = TAILQ_FIRST(&pool->list); 2552 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2553 pca->af); 2554 break; 2555 } 2556 2557 case DIOCGETRULESETS: { 2558 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2559 struct pf_ruleset *ruleset; 2560 struct pf_anchor *anchor; 2561 2562 pr->path[sizeof(pr->path) - 1] = 0; 2563 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2564 error = EINVAL; 2565 break; 2566 } 2567 pr->nr = 0; 2568 if (ruleset->anchor == NULL) { 2569 /* XXX kludge for pf_main_ruleset */ 2570 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2571 if (anchor->parent == NULL) 2572 pr->nr++; 2573 } else { 2574 RB_FOREACH(anchor, pf_anchor_node, 2575 &ruleset->anchor->children) 2576 pr->nr++; 2577 } 2578 break; 2579 } 2580 2581 case DIOCGETRULESET: { 2582 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2583 struct pf_ruleset *ruleset; 2584 struct pf_anchor *anchor; 2585 u_int32_t nr = 0; 2586 2587 pr->path[sizeof(pr->path) - 1] = 0; 2588 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2589 error = EINVAL; 2590 break; 2591 } 2592 pr->name[0] = 0; 2593 if (ruleset->anchor == NULL) { 2594 /* XXX kludge for pf_main_ruleset */ 2595 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2596 if (anchor->parent == NULL && nr++ == pr->nr) { 2597 strlcpy(pr->name, anchor->name, 2598 sizeof(pr->name)); 2599 break; 2600 } 2601 } else { 2602 RB_FOREACH(anchor, pf_anchor_node, 2603 &ruleset->anchor->children) 2604 if (nr++ == pr->nr) { 2605 strlcpy(pr->name, anchor->name, 2606 sizeof(pr->name)); 2607 break; 2608 } 2609 } 2610 if (!pr->name[0]) 2611 error = EBUSY; 2612 break; 2613 } 2614 2615 case DIOCRCLRTABLES: { 2616 struct pfioc_table *io = (struct pfioc_table *)addr; 2617 2618 if (io->pfrio_esize != 0) { 2619 error = ENODEV; 2620 break; 2621 } 2622 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2623 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2624 break; 2625 } 2626 2627 case DIOCRADDTABLES: { 2628 struct pfioc_table *io = (struct pfioc_table *)addr; 2629 2630 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2631 error = ENODEV; 2632 break; 2633 } 2634 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2635 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2636 break; 2637 } 2638 2639 case DIOCRDELTABLES: { 2640 struct pfioc_table *io = (struct pfioc_table *)addr; 2641 2642 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2643 error = ENODEV; 2644 break; 2645 } 2646 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2647 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2648 break; 2649 } 2650 2651 case DIOCRGETTABLES: { 2652 struct pfioc_table *io = (struct pfioc_table *)addr; 2653 2654 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2655 error = ENODEV; 2656 break; 2657 } 2658 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2659 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2660 break; 2661 } 2662 2663 case DIOCRGETTSTATS: { 2664 struct pfioc_table *io = (struct pfioc_table *)addr; 2665 2666 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2667 error = ENODEV; 2668 break; 2669 } 2670 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2671 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2672 break; 2673 } 2674 2675 case DIOCRCLRTSTATS: { 2676 struct pfioc_table *io = (struct pfioc_table *)addr; 2677 2678 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2679 error = ENODEV; 2680 break; 2681 } 2682 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2683 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2684 break; 2685 } 2686 2687 case DIOCRSETTFLAGS: { 2688 struct pfioc_table *io = (struct pfioc_table *)addr; 2689 2690 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2691 error = ENODEV; 2692 break; 2693 } 2694 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2695 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2696 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2697 break; 2698 } 2699 2700 case DIOCRCLRADDRS: { 2701 struct pfioc_table *io = (struct pfioc_table *)addr; 2702 2703 if (io->pfrio_esize != 0) { 2704 error = ENODEV; 2705 break; 2706 } 2707 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2708 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2709 break; 2710 } 2711 2712 case DIOCRADDADDRS: { 2713 struct pfioc_table *io = (struct pfioc_table *)addr; 2714 2715 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2716 error = ENODEV; 2717 break; 2718 } 2719 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2720 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2721 PFR_FLAG_USERIOCTL); 2722 break; 2723 } 2724 2725 case DIOCRDELADDRS: { 2726 struct pfioc_table *io = (struct pfioc_table *)addr; 2727 2728 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2729 error = ENODEV; 2730 break; 2731 } 2732 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2733 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2734 PFR_FLAG_USERIOCTL); 2735 break; 2736 } 2737 2738 case DIOCRSETADDRS: { 2739 struct pfioc_table *io = (struct pfioc_table *)addr; 2740 2741 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2742 error = ENODEV; 2743 break; 2744 } 2745 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2746 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2747 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2748 PFR_FLAG_USERIOCTL, 0); 2749 break; 2750 } 2751 2752 case DIOCRGETADDRS: { 2753 struct pfioc_table *io = (struct pfioc_table *)addr; 2754 2755 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2756 error = ENODEV; 2757 break; 2758 } 2759 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2760 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2761 break; 2762 } 2763 2764 case DIOCRGETASTATS: { 2765 struct pfioc_table *io = (struct pfioc_table *)addr; 2766 2767 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2768 error = ENODEV; 2769 break; 2770 } 2771 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2772 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2773 break; 2774 } 2775 2776 case DIOCRCLRASTATS: { 2777 struct pfioc_table *io = (struct pfioc_table *)addr; 2778 2779 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2780 error = ENODEV; 2781 break; 2782 } 2783 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2784 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2785 PFR_FLAG_USERIOCTL); 2786 break; 2787 } 2788 2789 case DIOCRTSTADDRS: { 2790 struct pfioc_table *io = (struct pfioc_table *)addr; 2791 2792 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2793 error = ENODEV; 2794 break; 2795 } 2796 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2797 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2798 PFR_FLAG_USERIOCTL); 2799 break; 2800 } 2801 2802 case DIOCRINADEFINE: { 2803 struct pfioc_table *io = (struct pfioc_table *)addr; 2804 2805 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2806 error = ENODEV; 2807 break; 2808 } 2809 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2810 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2811 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2812 break; 2813 } 2814 2815 case DIOCOSFPADD: { 2816 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2817 error = pf_osfp_add(io); 2818 break; 2819 } 2820 2821 case DIOCOSFPGET: { 2822 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2823 error = pf_osfp_get(io); 2824 break; 2825 } 2826 2827 case DIOCXBEGIN: { 2828 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2829 struct pfioc_trans_e *ioe; 2830 struct pfr_table *table; 2831 int i; 2832 2833 if (io->esize != sizeof(*ioe)) { 2834 error = ENODEV; 2835 goto fail; 2836 } 2837 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2838 M_TEMP, M_WAITOK); 2839 table = (struct pfr_table *)malloc(sizeof(*table), 2840 M_TEMP, M_WAITOK); 2841 for (i = 0; i < io->size; i++) { 2842 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2843 free(table, M_TEMP); 2844 free(ioe, M_TEMP); 2845 error = EFAULT; 2846 goto fail; 2847 } 2848 switch (ioe->rs_num) { 2849 #ifdef ALTQ 2850 case PF_RULESET_ALTQ: 2851 if (ioe->anchor[0]) { 2852 free(table, M_TEMP); 2853 free(ioe, M_TEMP); 2854 error = EINVAL; 2855 goto fail; 2856 } 2857 if ((error = pf_begin_altq(&ioe->ticket))) { 2858 free(table, M_TEMP); 2859 free(ioe, M_TEMP); 2860 goto fail; 2861 } 2862 break; 2863 #endif /* ALTQ */ 2864 case PF_RULESET_TABLE: 2865 bzero(table, sizeof(*table)); 2866 strlcpy(table->pfrt_anchor, ioe->anchor, 2867 sizeof(table->pfrt_anchor)); 2868 if ((error = pfr_ina_begin(table, 2869 &ioe->ticket, NULL, 0))) { 2870 free(table, M_TEMP); 2871 free(ioe, M_TEMP); 2872 goto fail; 2873 } 2874 break; 2875 default: 2876 if ((error = pf_begin_rules(&ioe->ticket, 2877 ioe->rs_num, ioe->anchor))) { 2878 free(table, M_TEMP); 2879 free(ioe, M_TEMP); 2880 goto fail; 2881 } 2882 break; 2883 } 2884 if (copyout(ioe, io->array+i, sizeof(io->array[i]))) { 2885 free(table, M_TEMP); 2886 free(ioe, M_TEMP); 2887 error = EFAULT; 2888 goto fail; 2889 } 2890 } 2891 free(table, M_TEMP); 2892 free(ioe, M_TEMP); 2893 break; 2894 } 2895 2896 case DIOCXROLLBACK: { 2897 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2898 struct pfioc_trans_e *ioe; 2899 struct pfr_table *table; 2900 int i; 2901 2902 if (io->esize != sizeof(*ioe)) { 2903 error = ENODEV; 2904 goto fail; 2905 } 2906 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2907 M_TEMP, M_WAITOK); 2908 table = (struct pfr_table *)malloc(sizeof(*table), 2909 M_TEMP, M_WAITOK); 2910 for (i = 0; i < io->size; i++) { 2911 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2912 free(table, M_TEMP); 2913 free(ioe, M_TEMP); 2914 error = EFAULT; 2915 goto fail; 2916 } 2917 switch (ioe->rs_num) { 2918 #ifdef ALTQ 2919 case PF_RULESET_ALTQ: 2920 if (ioe->anchor[0]) { 2921 free(table, M_TEMP); 2922 free(ioe, M_TEMP); 2923 error = EINVAL; 2924 goto fail; 2925 } 2926 if ((error = pf_rollback_altq(ioe->ticket))) { 2927 free(table, M_TEMP); 2928 free(ioe, M_TEMP); 2929 goto fail; /* really bad */ 2930 } 2931 break; 2932 #endif /* ALTQ */ 2933 case PF_RULESET_TABLE: 2934 bzero(table, sizeof(*table)); 2935 strlcpy(table->pfrt_anchor, ioe->anchor, 2936 sizeof(table->pfrt_anchor)); 2937 if ((error = pfr_ina_rollback(table, 2938 ioe->ticket, NULL, 0))) { 2939 free(table, M_TEMP); 2940 free(ioe, M_TEMP); 2941 goto fail; /* really bad */ 2942 } 2943 break; 2944 default: 2945 if ((error = pf_rollback_rules(ioe->ticket, 2946 ioe->rs_num, ioe->anchor))) { 2947 free(table, M_TEMP); 2948 free(ioe, M_TEMP); 2949 goto fail; /* really bad */ 2950 } 2951 break; 2952 } 2953 } 2954 free(table, M_TEMP); 2955 free(ioe, M_TEMP); 2956 break; 2957 } 2958 2959 case DIOCXCOMMIT: { 2960 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2961 struct pfioc_trans_e *ioe; 2962 struct pfr_table *table; 2963 struct pf_ruleset *rs; 2964 int i; 2965 2966 if (io->esize != sizeof(*ioe)) { 2967 error = ENODEV; 2968 goto fail; 2969 } 2970 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2971 M_TEMP, M_WAITOK); 2972 table = (struct pfr_table *)malloc(sizeof(*table), 2973 M_TEMP, M_WAITOK); 2974 /* first makes sure everything will succeed */ 2975 for (i = 0; i < io->size; i++) { 2976 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2977 free(table, M_TEMP); 2978 free(ioe, M_TEMP); 2979 error = EFAULT; 2980 goto fail; 2981 } 2982 switch (ioe->rs_num) { 2983 #ifdef ALTQ 2984 case PF_RULESET_ALTQ: 2985 if (ioe->anchor[0]) { 2986 free(table, M_TEMP); 2987 free(ioe, M_TEMP); 2988 error = EINVAL; 2989 goto fail; 2990 } 2991 if (!altqs_inactive_open || ioe->ticket != 2992 ticket_altqs_inactive) { 2993 free(table, M_TEMP); 2994 free(ioe, M_TEMP); 2995 error = EBUSY; 2996 goto fail; 2997 } 2998 break; 2999 #endif /* ALTQ */ 3000 case PF_RULESET_TABLE: 3001 rs = pf_find_ruleset(ioe->anchor); 3002 if (rs == NULL || !rs->topen || ioe->ticket != 3003 rs->tticket) { 3004 free(table, M_TEMP); 3005 free(ioe, M_TEMP); 3006 error = EBUSY; 3007 goto fail; 3008 } 3009 break; 3010 default: 3011 if (ioe->rs_num < 0 || ioe->rs_num >= 3012 PF_RULESET_MAX) { 3013 free(table, M_TEMP); 3014 free(ioe, M_TEMP); 3015 error = EINVAL; 3016 goto fail; 3017 } 3018 rs = pf_find_ruleset(ioe->anchor); 3019 if (rs == NULL || 3020 !rs->rules[ioe->rs_num].inactive.open || 3021 rs->rules[ioe->rs_num].inactive.ticket != 3022 ioe->ticket) { 3023 free(table, M_TEMP); 3024 free(ioe, M_TEMP); 3025 error = EBUSY; 3026 goto fail; 3027 } 3028 break; 3029 } 3030 } 3031 /* now do the commit - no errors should happen here */ 3032 for (i = 0; i < io->size; i++) { 3033 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 3034 free(table, M_TEMP); 3035 free(ioe, M_TEMP); 3036 error = EFAULT; 3037 goto fail; 3038 } 3039 switch (ioe->rs_num) { 3040 #ifdef ALTQ 3041 case PF_RULESET_ALTQ: 3042 if ((error = pf_commit_altq(ioe->ticket))) { 3043 free(table, M_TEMP); 3044 free(ioe, M_TEMP); 3045 goto fail; /* really bad */ 3046 } 3047 break; 3048 #endif /* ALTQ */ 3049 case PF_RULESET_TABLE: 3050 bzero(table, sizeof(*table)); 3051 strlcpy(table->pfrt_anchor, ioe->anchor, 3052 sizeof(table->pfrt_anchor)); 3053 if ((error = pfr_ina_commit(table, ioe->ticket, 3054 NULL, NULL, 0))) { 3055 free(table, M_TEMP); 3056 free(ioe, M_TEMP); 3057 goto fail; /* really bad */ 3058 } 3059 break; 3060 default: 3061 if ((error = pf_commit_rules(ioe->ticket, 3062 ioe->rs_num, ioe->anchor))) { 3063 free(table, M_TEMP); 3064 free(ioe, M_TEMP); 3065 goto fail; /* really bad */ 3066 } 3067 break; 3068 } 3069 } 3070 free(table, M_TEMP); 3071 free(ioe, M_TEMP); 3072 break; 3073 } 3074 3075 case DIOCGETSRCNODES: { 3076 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 3077 struct pf_src_node *n, *p, *pstore; 3078 u_int32_t nr = 0; 3079 int space = psn->psn_len; 3080 3081 if (space == 0) { 3082 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 3083 nr++; 3084 psn->psn_len = sizeof(struct pf_src_node) * nr; 3085 break; 3086 } 3087 3088 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 3089 3090 p = psn->psn_src_nodes; 3091 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 3092 int secs = time_second, diff; 3093 3094 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 3095 break; 3096 3097 bcopy(n, pstore, sizeof(*pstore)); 3098 if (n->rule.ptr != NULL) 3099 pstore->rule.nr = n->rule.ptr->nr; 3100 pstore->creation = secs - pstore->creation; 3101 if (pstore->expire > secs) 3102 pstore->expire -= secs; 3103 else 3104 pstore->expire = 0; 3105 3106 /* adjust the connection rate estimate */ 3107 diff = secs - n->conn_rate.last; 3108 if (diff >= n->conn_rate.seconds) 3109 pstore->conn_rate.count = 0; 3110 else 3111 pstore->conn_rate.count -= 3112 n->conn_rate.count * diff / 3113 n->conn_rate.seconds; 3114 3115 error = copyout(pstore, p, sizeof(*p)); 3116 if (error) { 3117 free(pstore, M_TEMP); 3118 goto fail; 3119 } 3120 p++; 3121 nr++; 3122 } 3123 psn->psn_len = sizeof(struct pf_src_node) * nr; 3124 3125 free(pstore, M_TEMP); 3126 break; 3127 } 3128 3129 case DIOCCLRSRCNODES: { 3130 struct pf_src_node *n; 3131 struct pf_state *state; 3132 3133 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 3134 state->src_node = NULL; 3135 state->nat_src_node = NULL; 3136 } 3137 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 3138 n->expire = 1; 3139 n->states = 0; 3140 } 3141 pf_purge_expired_src_nodes(1); 3142 pf_status.src_nodes = 0; 3143 break; 3144 } 3145 3146 case DIOCKILLSRCNODES: { 3147 struct pf_src_node *sn; 3148 struct pf_state *ps; 3149 struct pfioc_src_node_kill *psnk = \ 3150 (struct pfioc_src_node_kill *) addr; 3151 int killed = 0; 3152 3153 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) { 3154 if (PF_MATCHA(psnk->psnk_src.neg, \ 3155 &psnk->psnk_src.addr.v.a.addr, \ 3156 &psnk->psnk_src.addr.v.a.mask, \ 3157 &sn->addr, sn->af) && 3158 PF_MATCHA(psnk->psnk_dst.neg, \ 3159 &psnk->psnk_dst.addr.v.a.addr, \ 3160 &psnk->psnk_dst.addr.v.a.mask, \ 3161 &sn->raddr, sn->af)) { 3162 /* Handle state to src_node linkage */ 3163 if (sn->states != 0) { 3164 RB_FOREACH(ps, pf_state_tree_id, 3165 &tree_id) { 3166 if (ps->src_node == sn) 3167 ps->src_node = NULL; 3168 if (ps->nat_src_node == sn) 3169 ps->nat_src_node = NULL; 3170 } 3171 sn->states = 0; 3172 } 3173 sn->expire = 1; 3174 killed++; 3175 } 3176 } 3177 3178 if (killed > 0) 3179 pf_purge_expired_src_nodes(1); 3180 3181 psnk->psnk_af = killed; 3182 break; 3183 } 3184 3185 case DIOCSETHOSTID: { 3186 u_int32_t *hid = (u_int32_t *)addr; 3187 3188 if (*hid == 0) 3189 pf_status.hostid = cprng_fast32(); 3190 else 3191 pf_status.hostid = *hid; 3192 break; 3193 } 3194 3195 case DIOCOSFPFLUSH: 3196 pf_osfp_flush(); 3197 break; 3198 3199 case DIOCIGETIFACES: { 3200 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3201 3202 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 3203 error = ENODEV; 3204 break; 3205 } 3206 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 3207 &io->pfiio_size); 3208 break; 3209 } 3210 3211 case DIOCSETIFFLAG: { 3212 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3213 3214 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 3215 break; 3216 } 3217 3218 case DIOCCLRIFFLAG: { 3219 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3220 3221 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 3222 break; 3223 } 3224 3225 case DIOCSETLCK: { 3226 pf_state_lock = *(uint32_t*)addr; 3227 break; 3228 } 3229 3230 default: 3231 error = ENODEV; 3232 break; 3233 } 3234 fail: 3235 splx(s); 3236 if (flags & FWRITE) 3237 rw_exit_write(&pf_consistency_lock); 3238 else 3239 rw_exit_read(&pf_consistency_lock); 3240 return (error); 3241 } 3242 3243 #ifdef __NetBSD__ 3244 #ifdef INET 3245 static int 3246 pfil4_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3247 { 3248 int error; 3249 3250 /* 3251 * ensure that mbufs are writable beforehand 3252 * as it's assumed by pf code. 3253 * ip hdr (60 bytes) + tcp hdr (60 bytes) should be enough. 3254 * XXX inefficient 3255 */ 3256 error = m_makewritable(mp, 0, 60 + 60, M_DONTWAIT); 3257 if (error) { 3258 m_freem(*mp); 3259 *mp = NULL; 3260 return error; 3261 } 3262 3263 /* 3264 * If the packet is out-bound, we can't delay checksums 3265 * here. For in-bound, the checksum has already been 3266 * validated. 3267 */ 3268 if (dir == PFIL_OUT) { 3269 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 3270 in_delayed_cksum(*mp); 3271 (*mp)->m_pkthdr.csum_flags &= 3272 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 3273 } 3274 } 3275 3276 if (pf_test(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3277 != PF_PASS) { 3278 m_freem(*mp); 3279 *mp = NULL; 3280 return EHOSTUNREACH; 3281 } 3282 3283 /* 3284 * we're not compatible with fast-forward. 3285 */ 3286 3287 if (dir == PFIL_IN && *mp) { 3288 (*mp)->m_flags &= ~M_CANFASTFWD; 3289 } 3290 3291 return (0); 3292 } 3293 #endif /* INET */ 3294 3295 #ifdef INET6 3296 static int 3297 pfil6_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3298 { 3299 int error; 3300 3301 /* 3302 * ensure that mbufs are writable beforehand 3303 * as it's assumed by pf code. 3304 * XXX inefficient 3305 */ 3306 error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 3307 if (error) { 3308 m_freem(*mp); 3309 *mp = NULL; 3310 return error; 3311 } 3312 3313 /* 3314 * If the packet is out-bound, we can't delay checksums 3315 * here. For in-bound, the checksum has already been 3316 * validated. 3317 */ 3318 if (dir == PFIL_OUT) { 3319 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 3320 in6_delayed_cksum(*mp); 3321 (*mp)->m_pkthdr.csum_flags &= 3322 ~(M_CSUM_TCPv6|M_CSUM_UDPv6); 3323 } 3324 } 3325 3326 if (pf_test6(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3327 != PF_PASS) { 3328 m_freem(*mp); 3329 *mp = NULL; 3330 return EHOSTUNREACH; 3331 } else 3332 return (0); 3333 } 3334 #endif /* INET6 */ 3335 3336 static int 3337 pf_pfil_attach(void) 3338 { 3339 pfil_head_t *ph_inet; 3340 #ifdef INET6 3341 pfil_head_t *ph_inet6; 3342 #endif /* INET6 */ 3343 int error; 3344 3345 if (pf_pfil_attached) 3346 return (EBUSY); 3347 3348 ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 3349 if (ph_inet) 3350 error = pfil_add_hook((void *)pfil4_wrapper, NULL, 3351 PFIL_IN|PFIL_OUT, ph_inet); 3352 else 3353 error = ENOENT; 3354 if (error) 3355 return (error); 3356 3357 #ifdef INET6 3358 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 3359 if (ph_inet6) 3360 error = pfil_add_hook((void *)pfil6_wrapper, NULL, 3361 PFIL_IN|PFIL_OUT, ph_inet6); 3362 else 3363 error = ENOENT; 3364 if (error) 3365 goto bad; 3366 #endif /* INET6 */ 3367 3368 pf_pfil_attached = 1; 3369 3370 return (0); 3371 3372 #ifdef INET6 3373 bad: 3374 pfil_remove_hook(pfil4_wrapper, NULL, PFIL_IN|PFIL_OUT, ph_inet); 3375 #endif /* INET6 */ 3376 3377 return (error); 3378 } 3379 3380 static int 3381 pf_pfil_detach(void) 3382 { 3383 pfil_head_t *ph_inet; 3384 #ifdef INET6 3385 pfil_head_t *ph_inet6; 3386 #endif /* INET6 */ 3387 3388 if (pf_pfil_attached == 0) 3389 return (EBUSY); 3390 3391 ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 3392 if (ph_inet) 3393 pfil_remove_hook((void *)pfil4_wrapper, NULL, 3394 PFIL_IN|PFIL_OUT, ph_inet); 3395 #ifdef INET6 3396 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 3397 if (ph_inet6) 3398 pfil_remove_hook((void *)pfil6_wrapper, NULL, 3399 PFIL_IN|PFIL_OUT, ph_inet6); 3400 #endif /* INET6 */ 3401 pf_pfil_attached = 0; 3402 3403 return (0); 3404 } 3405 #endif /* __NetBSD__ */ 3406 3407 #if defined(__NetBSD__) 3408 MODULE(MODULE_CLASS_DRIVER, pf, "bpf"); 3409 3410 static int 3411 pf_modcmd(modcmd_t cmd, void *opaque) 3412 { 3413 #ifdef _MODULE 3414 extern void pflogattach(int); 3415 extern void pflogdetach(void); 3416 3417 devmajor_t cmajor = NODEVMAJOR, bmajor = NODEVMAJOR; 3418 int err; 3419 3420 switch (cmd) { 3421 case MODULE_CMD_INIT: 3422 err = devsw_attach("pf", NULL, &bmajor, &pf_cdevsw, &cmajor); 3423 if (err) 3424 return err; 3425 pfattach(1); 3426 pflogattach(1); 3427 return 0; 3428 case MODULE_CMD_FINI: 3429 if (pf_status.running) { 3430 return EBUSY; 3431 } else { 3432 pfdetach(); 3433 pflogdetach(); 3434 return devsw_detach(NULL, &pf_cdevsw); 3435 } 3436 default: 3437 return ENOTTY; 3438 } 3439 #else 3440 if (cmd == MODULE_CMD_INIT) 3441 return 0; 3442 return ENOTTY; 3443 #endif 3444 } 3445 #endif 3446
Indexes created Mon Sep 29 03:10:08 GMT 2025