pf_ioctl.c revision 1.51.8.1
1 /* $NetBSD: pf_ioctl.c,v 1.51.8.1 2017/04/29 09:17:59 pgoyette Exp $ */ 2 /* $OpenBSD: pf_ioctl.c,v 1.182 2007/06/24 11:17:13 mcbride Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Daniel Hartmeier 6 * Copyright (c) 2002,2003 Henning Brauer 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 */ 38 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: pf_ioctl.c,v 1.51.8.1 2017/04/29 09:17:59 pgoyette Exp $"); 41 42 #ifdef _KERNEL_OPT 43 #include "opt_inet.h" 44 #endif 45 46 #include "pfsync.h" 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/mbuf.h> 51 #include <sys/filio.h> 52 #include <sys/fcntl.h> 53 #include <sys/socket.h> 54 #include <sys/socketvar.h> 55 #include <sys/kernel.h> 56 #include <sys/time.h> 57 #include <sys/pool.h> 58 #include <sys/proc.h> 59 #include <sys/malloc.h> 60 #include <sys/kthread.h> 61 #include <sys/rwlock.h> 62 #include <uvm/uvm_extern.h> 63 #ifdef __NetBSD__ 64 #include <sys/localcount.h> 65 #include <sys/conf.h> 66 #include <sys/lwp.h> 67 #include <sys/kauth.h> 68 #include <sys/module.h> 69 #include <sys/cprng.h> 70 #endif /* __NetBSD__ */ 71 72 #include <net/if.h> 73 #include <net/if_types.h> 74 #include <net/route.h> 75 76 #include <netinet/in.h> 77 #include <netinet/in_var.h> 78 #include <netinet/in_systm.h> 79 #include <netinet/ip.h> 80 #include <netinet/ip_var.h> 81 #include <netinet/ip_icmp.h> 82 83 #ifndef __NetBSD__ 84 #include <dev/rndvar.h> 85 #include <crypto/md5.h> 86 #else 87 #include <sys/md5.h> 88 #endif /* __NetBSD__ */ 89 #include <net/pfvar.h> 90 91 #if NPFSYNC > 0 92 #include <net/if_pfsync.h> 93 #endif /* NPFSYNC > 0 */ 94 95 #if NPFLOG > 0 96 #include <net/if_pflog.h> 97 #endif /* NPFLOG > 0 */ 98 99 #ifdef INET6 100 #include <netinet/ip6.h> 101 #include <netinet/in_pcb.h> 102 #endif /* INET6 */ 103 104 #ifdef ALTQ 105 #include <altq/altq.h> 106 #endif 107 108 #include "ioconf.h" 109 110 #ifdef _MODULE 111 void pfdetach(void); 112 #endif /* _MODULE */ 113 #ifndef __NetBSD__ 114 void pf_thread_create(void *); 115 #endif /* !__NetBSD__ */ 116 int pfopen(dev_t, int, int, struct lwp *); 117 int pfclose(dev_t, int, int, struct lwp *); 118 struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 119 u_int8_t, u_int8_t, u_int8_t); 120 121 void pf_mv_pool(struct pf_palist *, struct pf_palist *); 122 void pf_empty_pool(struct pf_palist *); 123 int pfioctl(dev_t, u_long, void *, int, struct lwp *); 124 #ifdef ALTQ 125 int pf_begin_altq(u_int32_t *); 126 int pf_rollback_altq(u_int32_t); 127 int pf_commit_altq(u_int32_t); 128 int pf_enable_altq(struct pf_altq *); 129 int pf_disable_altq(struct pf_altq *); 130 #endif /* ALTQ */ 131 int pf_begin_rules(u_int32_t *, int, const char *); 132 int pf_rollback_rules(u_int32_t, int, char *); 133 int pf_setup_pfsync_matching(struct pf_ruleset *); 134 void pf_hash_rule(MD5_CTX *, struct pf_rule *); 135 void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 136 int pf_commit_rules(u_int32_t, int, char *); 137 void pf_state_export(struct pfsync_state *, 138 struct pf_state_key *, struct pf_state *); 139 void pf_state_import(struct pfsync_state *, 140 struct pf_state_key *, struct pf_state *); 141 142 static int pf_state_add(struct pfsync_state*); 143 144 struct pf_rule pf_default_rule; 145 #ifdef __NetBSD__ 146 krwlock_t pf_consistency_lock; 147 #else 148 struct rwlock pf_consistency_lock = RWLOCK_INITIALIZER("pfcnslk"); 149 #endif /* __NetBSD__ */ 150 #ifdef ALTQ 151 static int pf_altq_running; 152 #endif 153 154 int pf_state_lock = 0; 155 156 #define TAGID_MAX 50000 157 TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags), 158 pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids); 159 160 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 161 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 162 #endif 163 u_int16_t tagname2tag(struct pf_tags *, char *); 164 void tag2tagname(struct pf_tags *, u_int16_t, char *); 165 void tag_unref(struct pf_tags *, u_int16_t); 166 int pf_rtlabel_add(struct pf_addr_wrap *); 167 void pf_rtlabel_remove(struct pf_addr_wrap *); 168 void pf_rtlabel_copyout(struct pf_addr_wrap *); 169 170 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x 171 172 #ifdef __NetBSD__ 173 const struct cdevsw pf_cdevsw = { 174 DEVSW_MODULE_INIT 175 .d_open = pfopen, 176 .d_close = pfclose, 177 .d_read = noread, 178 .d_write = nowrite, 179 .d_ioctl = pfioctl, 180 .d_stop = nostop, 181 .d_tty = notty, 182 .d_poll = nopoll, 183 .d_mmap = nommap, 184 .d_kqfilter = nokqfilter, 185 .d_discard = nodiscard, 186 .d_flag = D_OTHER 187 }; 188 189 static int pfil4_wrapper(void *, struct mbuf **, struct ifnet *, int); 190 #ifdef INET6 191 static int pfil6_wrapper(void *, struct mbuf **, struct ifnet *, int); 192 #endif /* INET6 */ 193 194 static int pf_pfil_attach(void); 195 static int pf_pfil_detach(void); 196 197 static int pf_pfil_attached; 198 199 static kauth_listener_t pf_listener; 200 #endif /* __NetBSD__ */ 201 202 #ifdef __NetBSD__ 203 static int 204 pf_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 205 void *arg0, void *arg1, void *arg2, void *arg3) 206 { 207 int result; 208 enum kauth_network_req req; 209 210 result = KAUTH_RESULT_DEFER; 211 req = (enum kauth_network_req)arg0; 212 213 if (action != KAUTH_NETWORK_FIREWALL) 214 return result; 215 216 /* These must have came from device context. */ 217 if ((req == KAUTH_REQ_NETWORK_FIREWALL_FW) || 218 (req == KAUTH_REQ_NETWORK_FIREWALL_NAT)) 219 result = KAUTH_RESULT_ALLOW; 220 221 return result; 222 } 223 #endif /* __NetBSD__ */ 224 225 void 226 pfattach(int num) 227 { 228 u_int32_t *timeout = pf_default_rule.timeout; 229 230 #ifdef __NetBSD__ 231 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 232 &pool_allocator_nointr, IPL_NONE); 233 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 234 "pfsrctrpl", NULL, IPL_SOFTNET); 235 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 236 NULL, IPL_SOFTNET); 237 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 238 "pfstatekeypl", NULL, IPL_SOFTNET); 239 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 240 &pool_allocator_nointr, IPL_NONE); 241 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 242 "pfpooladdrpl", &pool_allocator_nointr, IPL_NONE); 243 #else 244 pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl", 245 &pool_allocator_nointr); 246 pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0, 247 "pfsrctrpl", NULL); 248 pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl", 249 NULL); 250 pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0, 251 "pfstatekeypl", NULL); 252 pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl", 253 &pool_allocator_nointr); 254 pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0, 255 "pfpooladdrpl", &pool_allocator_nointr); 256 #endif /* !__NetBSD__ */ 257 258 pfr_initialize(); 259 pfi_initialize(); 260 pf_osfp_initialize(); 261 262 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp, 263 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0); 264 265 if (ctob(physmem) <= 100*1024*1024) 266 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit = 267 PFR_KENTRY_HIWAT_SMALL; 268 269 RB_INIT(&tree_src_tracking); 270 RB_INIT(&pf_anchors); 271 pf_init_ruleset(&pf_main_ruleset); 272 TAILQ_INIT(&pf_altqs[0]); 273 TAILQ_INIT(&pf_altqs[1]); 274 TAILQ_INIT(&pf_pabuf); 275 pf_altqs_active = &pf_altqs[0]; 276 pf_altqs_inactive = &pf_altqs[1]; 277 TAILQ_INIT(&state_list); 278 279 #ifdef __NetBSD__ 280 rw_init(&pf_consistency_lock); 281 #endif /* __NetBSD__ */ 282 283 /* default rule should never be garbage collected */ 284 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next; 285 pf_default_rule.action = PF_PASS; 286 pf_default_rule.nr = -1; 287 pf_default_rule.rtableid = -1; 288 289 /* initialize default timeouts */ 290 timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 291 timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 292 timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 293 timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 294 timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 295 timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 296 timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 297 timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 298 timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 299 timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 300 timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 301 timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 302 timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 303 timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 304 timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 305 timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 306 timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 307 timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 308 timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 309 timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 310 311 pf_normalize_init(); 312 bzero(&pf_status, sizeof(pf_status)); 313 pf_status.debug = PF_DEBUG_URGENT; 314 315 /* XXX do our best to avoid a conflict */ 316 pf_status.hostid = cprng_fast32(); 317 318 /* require process context to purge states, so perform in a thread */ 319 #ifdef __NetBSD__ 320 if (kthread_create(PRI_NONE, 0, NULL, pf_purge_thread, NULL, NULL, 321 "pfpurge")) 322 panic("pfpurge thread"); 323 #else 324 kthread_create_deferred(pf_thread_create, NULL); 325 #endif /* !__NetBSD__ */ 326 327 #ifdef __NetBSD__ 328 pf_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 329 pf_listener_cb, NULL); 330 #endif /* __NetBSD__ */ 331 } 332 333 #ifdef _MODULE 334 void 335 pfdetach(void) 336 { 337 extern int pf_purge_thread_running; 338 extern int pf_purge_thread_stop; 339 struct pf_anchor *anchor; 340 struct pf_state *state; 341 struct pf_src_node *node; 342 struct pfioc_table pt; 343 u_int32_t ticket; 344 int i; 345 char r = '\0'; 346 347 pf_purge_thread_stop = 1; 348 wakeup(pf_purge_thread); 349 350 /* wait until the kthread exits */ 351 while (pf_purge_thread_running) 352 tsleep(&pf_purge_thread_running, PWAIT, "pfdown", 0); 353 354 (void)pf_pfil_detach(); 355 356 pf_status.running = 0; 357 358 /* clear the rulesets */ 359 for (i = 0; i < PF_RULESET_MAX; i++) 360 if (pf_begin_rules(&ticket, i, &r) == 0) 361 pf_commit_rules(ticket, i, &r); 362 #ifdef ALTQ 363 if (pf_begin_altq(&ticket) == 0) 364 pf_commit_altq(ticket); 365 #endif /* ALTQ */ 366 367 /* clear states */ 368 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 369 state->timeout = PFTM_PURGE; 370 #if NPFSYNC > 0 371 state->sync_flags = PFSTATE_NOSYNC; 372 #endif /* NPFSYNC > 0 */ 373 } 374 pf_purge_expired_states(pf_status.states); 375 #if NPFSYNC > 0 376 pfsync_clear_states(pf_status.hostid, NULL); 377 #endif /* NPFSYNC > 0 */ 378 379 /* clear source nodes */ 380 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 381 state->src_node = NULL; 382 state->nat_src_node = NULL; 383 } 384 RB_FOREACH(node, pf_src_tree, &tree_src_tracking) { 385 node->expire = 1; 386 node->states = 0; 387 } 388 pf_purge_expired_src_nodes(0); 389 390 /* clear tables */ 391 memset(&pt, '\0', sizeof(pt)); 392 pfr_clr_tables(&pt.pfrio_table, &pt.pfrio_ndel, pt.pfrio_flags); 393 394 /* destroy anchors */ 395 while ((anchor = RB_MIN(pf_anchor_global, &pf_anchors)) != NULL) { 396 for (i = 0; i < PF_RULESET_MAX; i++) 397 if (pf_begin_rules(&ticket, i, anchor->name) == 0) 398 pf_commit_rules(ticket, i, anchor->name); 399 } 400 401 /* destroy main ruleset */ 402 pf_remove_if_empty_ruleset(&pf_main_ruleset); 403 404 /* destroy the pools */ 405 pool_destroy(&pf_pooladdr_pl); 406 pool_destroy(&pf_altq_pl); 407 pool_destroy(&pf_state_key_pl); 408 pool_destroy(&pf_state_pl); 409 pool_destroy(&pf_rule_pl); 410 pool_destroy(&pf_src_tree_pl); 411 412 rw_destroy(&pf_consistency_lock); 413 414 /* destroy subsystems */ 415 pf_normalize_destroy(); 416 pf_osfp_destroy(); 417 pfr_destroy(); 418 pfi_destroy(); 419 420 /* cleanup kauth listener */ 421 kauth_unlisten_scope(pf_listener); 422 } 423 #endif /* _MODULE */ 424 425 #ifndef __NetBSD__ 426 void 427 pf_thread_create(void *v) 428 { 429 if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge")) 430 panic("pfpurge thread"); 431 } 432 #endif /* !__NetBSD__ */ 433 434 int 435 pfopen(dev_t dev, int flags, int fmt, struct lwp *l) 436 { 437 if (minor(dev) >= 1) 438 return (ENXIO); 439 return (0); 440 } 441 442 int 443 pfclose(dev_t dev, int flags, int fmt, struct lwp *l) 444 { 445 if (minor(dev) >= 1) 446 return (ENXIO); 447 return (0); 448 } 449 450 struct pf_pool * 451 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 452 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 453 u_int8_t check_ticket) 454 { 455 struct pf_ruleset *ruleset; 456 struct pf_rule *rule; 457 int rs_num; 458 459 ruleset = pf_find_ruleset(anchor); 460 if (ruleset == NULL) 461 return (NULL); 462 rs_num = pf_get_ruleset_number(rule_action); 463 if (rs_num >= PF_RULESET_MAX) 464 return (NULL); 465 if (active) { 466 if (check_ticket && ticket != 467 ruleset->rules[rs_num].active.ticket) 468 return (NULL); 469 if (r_last) 470 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 471 pf_rulequeue); 472 else 473 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 474 } else { 475 if (check_ticket && ticket != 476 ruleset->rules[rs_num].inactive.ticket) 477 return (NULL); 478 if (r_last) 479 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 480 pf_rulequeue); 481 else 482 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 483 } 484 if (!r_last) { 485 while ((rule != NULL) && (rule->nr != rule_number)) 486 rule = TAILQ_NEXT(rule, entries); 487 } 488 if (rule == NULL) 489 return (NULL); 490 491 return (&rule->rpool); 492 } 493 494 void 495 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 496 { 497 struct pf_pooladdr *mv_pool_pa; 498 499 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 500 TAILQ_REMOVE(poola, mv_pool_pa, entries); 501 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 502 } 503 } 504 505 void 506 pf_empty_pool(struct pf_palist *poola) 507 { 508 struct pf_pooladdr *empty_pool_pa; 509 510 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) { 511 pfi_dynaddr_remove(&empty_pool_pa->addr); 512 pf_tbladdr_remove(&empty_pool_pa->addr); 513 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE); 514 TAILQ_REMOVE(poola, empty_pool_pa, entries); 515 pool_put(&pf_pooladdr_pl, empty_pool_pa); 516 } 517 } 518 519 void 520 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 521 { 522 if (rulequeue != NULL) { 523 if (rule->states <= 0) { 524 /* 525 * XXX - we need to remove the table *before* detaching 526 * the rule to make sure the table code does not delete 527 * the anchor under our feet. 528 */ 529 pf_tbladdr_remove(&rule->src.addr); 530 pf_tbladdr_remove(&rule->dst.addr); 531 if (rule->overload_tbl) 532 pfr_detach_table(rule->overload_tbl); 533 } 534 TAILQ_REMOVE(rulequeue, rule, entries); 535 rule->entries.tqe_prev = NULL; 536 rule->nr = -1; 537 } 538 539 if (rule->states > 0 || rule->src_nodes > 0 || 540 rule->entries.tqe_prev != NULL) 541 return; 542 pf_tag_unref(rule->tag); 543 pf_tag_unref(rule->match_tag); 544 #ifdef ALTQ 545 if (rule->pqid != rule->qid) 546 pf_qid_unref(rule->pqid); 547 pf_qid_unref(rule->qid); 548 #endif 549 pf_rtlabel_remove(&rule->src.addr); 550 pf_rtlabel_remove(&rule->dst.addr); 551 pfi_dynaddr_remove(&rule->src.addr); 552 pfi_dynaddr_remove(&rule->dst.addr); 553 if (rulequeue == NULL) { 554 pf_tbladdr_remove(&rule->src.addr); 555 pf_tbladdr_remove(&rule->dst.addr); 556 if (rule->overload_tbl) 557 pfr_detach_table(rule->overload_tbl); 558 } 559 pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE); 560 pf_anchor_remove(rule); 561 pf_empty_pool(&rule->rpool.list); 562 pool_put(&pf_rule_pl, rule); 563 } 564 565 u_int16_t 566 tagname2tag(struct pf_tags *head, char *tagname) 567 { 568 struct pf_tagname *tag, *p = NULL; 569 u_int16_t new_tagid = 1; 570 571 TAILQ_FOREACH(tag, head, entries) 572 if (strcmp(tagname, tag->name) == 0) { 573 tag->ref++; 574 return (tag->tag); 575 } 576 577 /* 578 * to avoid fragmentation, we do a linear search from the beginning 579 * and take the first free slot we find. if there is none or the list 580 * is empty, append a new entry at the end. 581 */ 582 583 /* new entry */ 584 if (!TAILQ_EMPTY(head)) 585 for (p = TAILQ_FIRST(head); p != NULL && 586 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 587 new_tagid = p->tag + 1; 588 589 if (new_tagid > TAGID_MAX) 590 return (0); 591 592 /* allocate and fill new struct pf_tagname */ 593 tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname), 594 M_TEMP, M_NOWAIT); 595 if (tag == NULL) 596 return (0); 597 bzero(tag, sizeof(struct pf_tagname)); 598 strlcpy(tag->name, tagname, sizeof(tag->name)); 599 tag->tag = new_tagid; 600 tag->ref++; 601 602 if (p != NULL) /* insert new entry before p */ 603 TAILQ_INSERT_BEFORE(p, tag, entries); 604 else /* either list empty or no free slot in between */ 605 TAILQ_INSERT_TAIL(head, tag, entries); 606 607 return (tag->tag); 608 } 609 610 void 611 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p) 612 { 613 struct pf_tagname *tag; 614 615 TAILQ_FOREACH(tag, head, entries) 616 if (tag->tag == tagid) { 617 strlcpy(p, tag->name, PF_TAG_NAME_SIZE); 618 return; 619 } 620 } 621 622 void 623 tag_unref(struct pf_tags *head, u_int16_t tag) 624 { 625 struct pf_tagname *p, *next; 626 627 if (tag == 0) 628 return; 629 630 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 631 next = TAILQ_NEXT(p, entries); 632 if (tag == p->tag) { 633 if (--p->ref == 0) { 634 TAILQ_REMOVE(head, p, entries); 635 free(p, M_TEMP); 636 } 637 break; 638 } 639 } 640 } 641 642 u_int16_t 643 pf_tagname2tag(char *tagname) 644 { 645 return (tagname2tag(&pf_tags, tagname)); 646 } 647 648 void 649 pf_tag2tagname(u_int16_t tagid, char *p) 650 { 651 tag2tagname(&pf_tags, tagid, p); 652 } 653 654 void 655 pf_tag_ref(u_int16_t tag) 656 { 657 struct pf_tagname *t; 658 659 TAILQ_FOREACH(t, &pf_tags, entries) 660 if (t->tag == tag) 661 break; 662 if (t != NULL) 663 t->ref++; 664 } 665 666 void 667 pf_tag_unref(u_int16_t tag) 668 { 669 tag_unref(&pf_tags, tag); 670 } 671 672 int 673 pf_rtlabel_add(struct pf_addr_wrap *a) 674 { 675 #ifndef __NetBSD__ 676 if (a->type == PF_ADDR_RTLABEL && 677 (a->v.rtlabel = rtlabel_name2id(a->v.rtlabelname)) == 0) 678 return (-1); 679 #endif /* !__NetBSD__ */ 680 return (0); 681 } 682 683 void 684 pf_rtlabel_remove(struct pf_addr_wrap *a) 685 { 686 #ifndef __NetBSD__ 687 if (a->type == PF_ADDR_RTLABEL) 688 rtlabel_unref(a->v.rtlabel); 689 #endif /* !__NetBSD__ */ 690 } 691 692 void 693 pf_rtlabel_copyout(struct pf_addr_wrap *a) 694 { 695 #ifndef __NetBSD__ 696 const char *name; 697 698 if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel) { 699 if ((name = rtlabel_id2name(a->v.rtlabel)) == NULL) 700 strlcpy(a->v.rtlabelname, "?", 701 sizeof(a->v.rtlabelname)); 702 else 703 strlcpy(a->v.rtlabelname, name, 704 sizeof(a->v.rtlabelname)); 705 } 706 #endif /* !__NetBSD__ */ 707 } 708 709 #ifdef ALTQ 710 u_int32_t 711 pf_qname2qid(char *qname) 712 { 713 return ((u_int32_t)tagname2tag(&pf_qids, qname)); 714 } 715 716 void 717 pf_qid2qname(u_int32_t qid, char *p) 718 { 719 tag2tagname(&pf_qids, (u_int16_t)qid, p); 720 } 721 722 void 723 pf_qid_unref(u_int32_t qid) 724 { 725 tag_unref(&pf_qids, (u_int16_t)qid); 726 } 727 728 int 729 pf_begin_altq(u_int32_t *ticket) 730 { 731 struct pf_altq *altq; 732 int error = 0; 733 734 /* Purge the old altq list */ 735 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 736 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 737 if (altq->qname[0] == 0) { 738 /* detach and destroy the discipline */ 739 error = altq_remove(altq); 740 } else 741 pf_qid_unref(altq->qid); 742 pool_put(&pf_altq_pl, altq); 743 } 744 if (error) 745 return (error); 746 *ticket = ++ticket_altqs_inactive; 747 altqs_inactive_open = 1; 748 return (0); 749 } 750 751 int 752 pf_rollback_altq(u_int32_t ticket) 753 { 754 struct pf_altq *altq; 755 int error = 0; 756 757 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 758 return (0); 759 /* Purge the old altq list */ 760 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 761 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 762 if (altq->qname[0] == 0) { 763 /* detach and destroy the discipline */ 764 error = altq_remove(altq); 765 } else 766 pf_qid_unref(altq->qid); 767 pool_put(&pf_altq_pl, altq); 768 } 769 altqs_inactive_open = 0; 770 return (error); 771 } 772 773 int 774 pf_commit_altq(u_int32_t ticket) 775 { 776 struct pf_altqqueue *old_altqs; 777 struct pf_altq *altq; 778 int s, err, error = 0; 779 780 if (!altqs_inactive_open || ticket != ticket_altqs_inactive) 781 return (EBUSY); 782 783 /* swap altqs, keep the old. */ 784 s = splsoftnet(); 785 old_altqs = pf_altqs_active; 786 pf_altqs_active = pf_altqs_inactive; 787 pf_altqs_inactive = old_altqs; 788 ticket_altqs_active = ticket_altqs_inactive; 789 790 /* Attach new disciplines */ 791 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 792 if (altq->qname[0] == 0) { 793 /* attach the discipline */ 794 error = altq_pfattach(altq); 795 if (error == 0 && pf_altq_running) 796 error = pf_enable_altq(altq); 797 if (error != 0) { 798 splx(s); 799 return (error); 800 } 801 } 802 } 803 804 /* Purge the old altq list */ 805 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) { 806 TAILQ_REMOVE(pf_altqs_inactive, altq, entries); 807 if (altq->qname[0] == 0) { 808 /* detach and destroy the discipline */ 809 if (pf_altq_running) 810 error = pf_disable_altq(altq); 811 err = altq_pfdetach(altq); 812 if (err != 0 && error == 0) 813 error = err; 814 err = altq_remove(altq); 815 if (err != 0 && error == 0) 816 error = err; 817 } else 818 pf_qid_unref(altq->qid); 819 pool_put(&pf_altq_pl, altq); 820 } 821 splx(s); 822 823 altqs_inactive_open = 0; 824 return (error); 825 } 826 827 int 828 pf_enable_altq(struct pf_altq *altq) 829 { 830 struct ifnet *ifp; 831 struct tb_profile tb; 832 int s, error = 0; 833 834 if ((ifp = ifunit(altq->ifname)) == NULL) 835 return (EINVAL); 836 837 if (ifp->if_snd.altq_type != ALTQT_NONE) 838 error = altq_enable(&ifp->if_snd); 839 840 /* set tokenbucket regulator */ 841 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 842 tb.rate = altq->ifbandwidth; 843 tb.depth = altq->tbrsize; 844 s = splnet(); 845 error = tbr_set(&ifp->if_snd, &tb); 846 splx(s); 847 } 848 849 return (error); 850 } 851 852 int 853 pf_disable_altq(struct pf_altq *altq) 854 { 855 struct ifnet *ifp; 856 struct tb_profile tb; 857 int s, error; 858 859 if ((ifp = ifunit(altq->ifname)) == NULL) 860 return (EINVAL); 861 862 /* 863 * when the discipline is no longer referenced, it was overridden 864 * by a new one. if so, just return. 865 */ 866 if (altq->altq_disc != ifp->if_snd.altq_disc) 867 return (0); 868 869 error = altq_disable(&ifp->if_snd); 870 871 if (error == 0) { 872 /* clear tokenbucket regulator */ 873 tb.rate = 0; 874 s = splnet(); 875 error = tbr_set(&ifp->if_snd, &tb); 876 splx(s); 877 } 878 879 return (error); 880 } 881 #endif /* ALTQ */ 882 883 int 884 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 885 { 886 struct pf_ruleset *rs; 887 struct pf_rule *rule; 888 889 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 890 return (EINVAL); 891 rs = pf_find_or_create_ruleset(anchor); 892 if (rs == NULL) 893 return (EINVAL); 894 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 895 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 896 rs->rules[rs_num].inactive.rcount--; 897 } 898 *ticket = ++rs->rules[rs_num].inactive.ticket; 899 rs->rules[rs_num].inactive.open = 1; 900 return (0); 901 } 902 903 int 904 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 905 { 906 struct pf_ruleset *rs; 907 struct pf_rule *rule; 908 909 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 910 return (EINVAL); 911 rs = pf_find_ruleset(anchor); 912 if (rs == NULL || !rs->rules[rs_num].inactive.open || 913 rs->rules[rs_num].inactive.ticket != ticket) 914 return (0); 915 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 916 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule); 917 rs->rules[rs_num].inactive.rcount--; 918 } 919 rs->rules[rs_num].inactive.open = 0; 920 return (0); 921 } 922 923 #define PF_MD5_UPD(st, elm) \ 924 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 925 926 #define PF_MD5_UPD_STR(st, elm) \ 927 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 928 929 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 930 (stor) = htonl((st)->elm); \ 931 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 932 } while (0) 933 934 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 935 (stor) = htons((st)->elm); \ 936 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 937 } while (0) 938 939 void 940 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 941 { 942 PF_MD5_UPD(pfr, addr.type); 943 switch (pfr->addr.type) { 944 case PF_ADDR_DYNIFTL: 945 PF_MD5_UPD(pfr, addr.v.ifname); 946 PF_MD5_UPD(pfr, addr.iflags); 947 break; 948 case PF_ADDR_TABLE: 949 PF_MD5_UPD(pfr, addr.v.tblname); 950 break; 951 case PF_ADDR_ADDRMASK: 952 /* XXX ignore af? */ 953 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 954 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 955 break; 956 case PF_ADDR_RTLABEL: 957 PF_MD5_UPD(pfr, addr.v.rtlabelname); 958 break; 959 } 960 961 PF_MD5_UPD(pfr, port[0]); 962 PF_MD5_UPD(pfr, port[1]); 963 PF_MD5_UPD(pfr, neg); 964 PF_MD5_UPD(pfr, port_op); 965 } 966 967 void 968 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule) 969 { 970 u_int16_t x; 971 u_int32_t y; 972 973 pf_hash_rule_addr(ctx, &rule->src); 974 pf_hash_rule_addr(ctx, &rule->dst); 975 PF_MD5_UPD_STR(rule, label); 976 PF_MD5_UPD_STR(rule, ifname); 977 PF_MD5_UPD_STR(rule, match_tagname); 978 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 979 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 980 PF_MD5_UPD_HTONL(rule, prob, y); 981 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 982 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 983 PF_MD5_UPD(rule, uid.op); 984 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 985 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 986 PF_MD5_UPD(rule, gid.op); 987 PF_MD5_UPD_HTONL(rule, rule_flag, y); 988 PF_MD5_UPD(rule, action); 989 PF_MD5_UPD(rule, direction); 990 PF_MD5_UPD(rule, af); 991 PF_MD5_UPD(rule, quick); 992 PF_MD5_UPD(rule, ifnot); 993 PF_MD5_UPD(rule, match_tag_not); 994 PF_MD5_UPD(rule, natpass); 995 PF_MD5_UPD(rule, keep_state); 996 PF_MD5_UPD(rule, proto); 997 PF_MD5_UPD(rule, type); 998 PF_MD5_UPD(rule, code); 999 PF_MD5_UPD(rule, flags); 1000 PF_MD5_UPD(rule, flagset); 1001 PF_MD5_UPD(rule, allow_opts); 1002 PF_MD5_UPD(rule, rt); 1003 PF_MD5_UPD(rule, tos); 1004 } 1005 1006 int 1007 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 1008 { 1009 struct pf_ruleset *rs; 1010 struct pf_rule *rule, **old_array; 1011 struct pf_rulequeue *old_rules; 1012 int s, error; 1013 u_int32_t old_rcount; 1014 1015 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 1016 return (EINVAL); 1017 rs = pf_find_ruleset(anchor); 1018 if (rs == NULL || !rs->rules[rs_num].inactive.open || 1019 ticket != rs->rules[rs_num].inactive.ticket) 1020 return (EBUSY); 1021 1022 /* Calculate checksum for the main ruleset */ 1023 if (rs == &pf_main_ruleset) { 1024 error = pf_setup_pfsync_matching(rs); 1025 if (error != 0) 1026 return (error); 1027 } 1028 1029 /* Swap rules, keep the old. */ 1030 s = splsoftnet(); 1031 old_rules = rs->rules[rs_num].active.ptr; 1032 old_rcount = rs->rules[rs_num].active.rcount; 1033 old_array = rs->rules[rs_num].active.ptr_array; 1034 1035 rs->rules[rs_num].active.ptr = 1036 rs->rules[rs_num].inactive.ptr; 1037 rs->rules[rs_num].active.ptr_array = 1038 rs->rules[rs_num].inactive.ptr_array; 1039 rs->rules[rs_num].active.rcount = 1040 rs->rules[rs_num].inactive.rcount; 1041 rs->rules[rs_num].inactive.ptr = old_rules; 1042 rs->rules[rs_num].inactive.ptr_array = old_array; 1043 rs->rules[rs_num].inactive.rcount = old_rcount; 1044 1045 rs->rules[rs_num].active.ticket = 1046 rs->rules[rs_num].inactive.ticket; 1047 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 1048 1049 1050 /* Purge the old rule list. */ 1051 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 1052 pf_rm_rule(old_rules, rule); 1053 if (rs->rules[rs_num].inactive.ptr_array) 1054 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 1055 rs->rules[rs_num].inactive.ptr_array = NULL; 1056 rs->rules[rs_num].inactive.rcount = 0; 1057 rs->rules[rs_num].inactive.open = 0; 1058 pf_remove_if_empty_ruleset(rs); 1059 splx(s); 1060 return (0); 1061 } 1062 1063 void 1064 pf_state_export(struct pfsync_state *sp, struct pf_state_key *sk, 1065 struct pf_state *s) 1066 { 1067 int secs = time_second; 1068 bzero(sp, sizeof(struct pfsync_state)); 1069 1070 /* copy from state key */ 1071 sp->lan.addr = sk->lan.addr; 1072 sp->lan.port = sk->lan.port; 1073 sp->gwy.addr = sk->gwy.addr; 1074 sp->gwy.port = sk->gwy.port; 1075 sp->ext.addr = sk->ext.addr; 1076 sp->ext.port = sk->ext.port; 1077 sp->proto = sk->proto; 1078 sp->af = sk->af; 1079 sp->direction = sk->direction; 1080 1081 /* copy from state */ 1082 memcpy(&sp->id, &s->id, sizeof(sp->id)); 1083 sp->creatorid = s->creatorid; 1084 strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname)); 1085 pf_state_peer_to_pfsync(&s->src, &sp->src); 1086 pf_state_peer_to_pfsync(&s->dst, &sp->dst); 1087 1088 sp->rule = s->rule.ptr->nr; 1089 sp->nat_rule = (s->nat_rule.ptr == NULL) ? -1 : s->nat_rule.ptr->nr; 1090 sp->anchor = (s->anchor.ptr == NULL) ? -1 : s->anchor.ptr->nr; 1091 1092 pf_state_counter_to_pfsync(s->bytes[0], sp->bytes[0]); 1093 pf_state_counter_to_pfsync(s->bytes[1], sp->bytes[1]); 1094 pf_state_counter_to_pfsync(s->packets[0], sp->packets[0]); 1095 pf_state_counter_to_pfsync(s->packets[1], sp->packets[1]); 1096 sp->creation = secs - s->creation; 1097 sp->expire = pf_state_expires(s); 1098 sp->log = s->log; 1099 sp->allow_opts = s->allow_opts; 1100 sp->timeout = s->timeout; 1101 1102 if (s->src_node) 1103 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 1104 if (s->nat_src_node) 1105 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 1106 1107 if (sp->expire > secs) 1108 sp->expire -= secs; 1109 else 1110 sp->expire = 0; 1111 1112 } 1113 1114 void 1115 pf_state_import(struct pfsync_state *sp, struct pf_state_key *sk, 1116 struct pf_state *s) 1117 { 1118 /* copy to state key */ 1119 sk->lan.addr = sp->lan.addr; 1120 sk->lan.port = sp->lan.port; 1121 sk->gwy.addr = sp->gwy.addr; 1122 sk->gwy.port = sp->gwy.port; 1123 sk->ext.addr = sp->ext.addr; 1124 sk->ext.port = sp->ext.port; 1125 sk->proto = sp->proto; 1126 sk->af = sp->af; 1127 sk->direction = sp->direction; 1128 1129 /* copy to state */ 1130 memcpy(&s->id, &sp->id, sizeof(sp->id)); 1131 s->creatorid = sp->creatorid; 1132 pf_state_peer_from_pfsync(&sp->src, &s->src); 1133 pf_state_peer_from_pfsync(&sp->dst, &s->dst); 1134 1135 s->rule.ptr = &pf_default_rule; 1136 s->rule.ptr->states++; 1137 s->nat_rule.ptr = NULL; 1138 s->anchor.ptr = NULL; 1139 s->rt_kif = NULL; 1140 s->creation = time_second; 1141 s->expire = time_second; 1142 s->timeout = sp->timeout; 1143 if (sp->expire > 0) 1144 s->expire -= pf_default_rule.timeout[sp->timeout] - sp->expire; 1145 s->pfsync_time = 0; 1146 s->packets[0] = s->packets[1] = 0; 1147 s->bytes[0] = s->bytes[1] = 0; 1148 } 1149 1150 int 1151 pf_state_add(struct pfsync_state* sp) 1152 { 1153 struct pf_state *s; 1154 struct pf_state_key *sk; 1155 struct pfi_kif *kif; 1156 1157 if (sp->timeout >= PFTM_MAX && 1158 sp->timeout != PFTM_UNTIL_PACKET) { 1159 return EINVAL; 1160 } 1161 s = pool_get(&pf_state_pl, PR_NOWAIT); 1162 if (s == NULL) { 1163 return ENOMEM; 1164 } 1165 bzero(s, sizeof(struct pf_state)); 1166 if ((sk = pf_alloc_state_key(s)) == NULL) { 1167 pool_put(&pf_state_pl, s); 1168 return ENOMEM; 1169 } 1170 pf_state_import(sp, sk, s); 1171 kif = pfi_kif_get(sp->ifname); 1172 if (kif == NULL) { 1173 pool_put(&pf_state_pl, s); 1174 pool_put(&pf_state_key_pl, sk); 1175 return ENOENT; 1176 } 1177 if (pf_insert_state(kif, s)) { 1178 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 1179 pool_put(&pf_state_pl, s); 1180 return ENOMEM; 1181 } 1182 1183 return 0; 1184 } 1185 1186 1187 int 1188 pf_setup_pfsync_matching(struct pf_ruleset *rs) 1189 { 1190 MD5_CTX ctx; 1191 struct pf_rule *rule; 1192 int rs_cnt; 1193 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 1194 1195 MD5Init(&ctx); 1196 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 1197 /* XXX PF_RULESET_SCRUB as well? */ 1198 if (rs_cnt == PF_RULESET_SCRUB) 1199 continue; 1200 1201 if (rs->rules[rs_cnt].inactive.ptr_array) 1202 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 1203 rs->rules[rs_cnt].inactive.ptr_array = NULL; 1204 1205 if (rs->rules[rs_cnt].inactive.rcount) { 1206 rs->rules[rs_cnt].inactive.ptr_array = 1207 malloc(sizeof(void *) * 1208 rs->rules[rs_cnt].inactive.rcount, 1209 M_TEMP, M_NOWAIT); 1210 1211 if (!rs->rules[rs_cnt].inactive.ptr_array) 1212 return (ENOMEM); 1213 } 1214 1215 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 1216 entries) { 1217 pf_hash_rule(&ctx, rule); 1218 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 1219 } 1220 } 1221 1222 MD5Final(digest, &ctx); 1223 memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum)); 1224 return (0); 1225 } 1226 1227 int 1228 pfioctl(dev_t dev, u_long cmd, void *addr, int flags, struct lwp *l) 1229 { 1230 struct pf_pooladdr *pa = NULL; 1231 struct pf_pool *pool = NULL; 1232 int s; 1233 int error = 0; 1234 1235 /* XXX keep in sync with switch() below */ 1236 if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_FIREWALL, 1237 KAUTH_REQ_NETWORK_FIREWALL_FW, NULL, NULL, NULL)) 1238 switch (cmd) { 1239 case DIOCGETRULES: 1240 case DIOCGETRULE: 1241 case DIOCGETADDRS: 1242 case DIOCGETADDR: 1243 case DIOCGETSTATE: 1244 case DIOCSETSTATUSIF: 1245 case DIOCGETSTATUS: 1246 case DIOCCLRSTATUS: 1247 case DIOCNATLOOK: 1248 case DIOCSETDEBUG: 1249 case DIOCGETSTATES: 1250 case DIOCGETTIMEOUT: 1251 case DIOCCLRRULECTRS: 1252 case DIOCGETLIMIT: 1253 case DIOCGETALTQS: 1254 case DIOCGETALTQ: 1255 case DIOCGETQSTATS: 1256 case DIOCGETRULESETS: 1257 case DIOCGETRULESET: 1258 case DIOCRGETTABLES: 1259 case DIOCRGETTSTATS: 1260 case DIOCRCLRTSTATS: 1261 case DIOCRCLRADDRS: 1262 case DIOCRADDADDRS: 1263 case DIOCRDELADDRS: 1264 case DIOCRSETADDRS: 1265 case DIOCRGETADDRS: 1266 case DIOCRGETASTATS: 1267 case DIOCRCLRASTATS: 1268 case DIOCRTSTADDRS: 1269 case DIOCOSFPGET: 1270 case DIOCGETSRCNODES: 1271 case DIOCCLRSRCNODES: 1272 case DIOCIGETIFACES: 1273 case DIOCSETIFFLAG: 1274 case DIOCCLRIFFLAG: 1275 case DIOCSETLCK: 1276 case DIOCADDSTATES: 1277 break; 1278 case DIOCRCLRTABLES: 1279 case DIOCRADDTABLES: 1280 case DIOCRDELTABLES: 1281 case DIOCRSETTFLAGS: 1282 if (((struct pfioc_table *)addr)->pfrio_flags & 1283 PFR_FLAG_DUMMY) 1284 break; /* dummy operation ok */ 1285 return (EPERM); 1286 default: 1287 return (EPERM); 1288 } 1289 1290 if (!(flags & FWRITE)) 1291 switch (cmd) { 1292 case DIOCGETRULES: 1293 case DIOCGETADDRS: 1294 case DIOCGETADDR: 1295 case DIOCGETSTATE: 1296 case DIOCGETSTATUS: 1297 case DIOCGETSTATES: 1298 case DIOCGETTIMEOUT: 1299 case DIOCGETLIMIT: 1300 case DIOCGETALTQS: 1301 case DIOCGETALTQ: 1302 case DIOCGETQSTATS: 1303 case DIOCGETRULESETS: 1304 case DIOCGETRULESET: 1305 case DIOCNATLOOK: 1306 case DIOCRGETTABLES: 1307 case DIOCRGETTSTATS: 1308 case DIOCRGETADDRS: 1309 case DIOCRGETASTATS: 1310 case DIOCRTSTADDRS: 1311 case DIOCOSFPGET: 1312 case DIOCGETSRCNODES: 1313 case DIOCIGETIFACES: 1314 case DIOCSETLCK: 1315 break; 1316 case DIOCRCLRTABLES: 1317 case DIOCRADDTABLES: 1318 case DIOCRDELTABLES: 1319 case DIOCRCLRTSTATS: 1320 case DIOCRCLRADDRS: 1321 case DIOCRADDADDRS: 1322 case DIOCRDELADDRS: 1323 case DIOCRSETADDRS: 1324 case DIOCRSETTFLAGS: 1325 case DIOCADDSTATES: 1326 if (((struct pfioc_table *)addr)->pfrio_flags & 1327 PFR_FLAG_DUMMY) { 1328 flags |= FWRITE; /* need write lock for dummy */ 1329 break; /* dummy operation ok */ 1330 } 1331 return (EACCES); 1332 case DIOCGETRULE: 1333 if (((struct pfioc_rule *)addr)->action == PF_GET_CLR_CNTR) 1334 return (EACCES); 1335 break; 1336 default: 1337 return (EACCES); 1338 } 1339 1340 if (flags & FWRITE) 1341 rw_enter_write(&pf_consistency_lock); 1342 else 1343 rw_enter_read(&pf_consistency_lock); 1344 1345 s = splsoftnet(); 1346 switch (cmd) { 1347 1348 case DIOCSTART: 1349 if (pf_status.running) 1350 error = EEXIST; 1351 else { 1352 #ifdef __NetBSD__ 1353 error = pf_pfil_attach(); 1354 if (error) 1355 break; 1356 #endif /* __NetBSD__ */ 1357 pf_status.running = 1; 1358 pf_status.since = time_second; 1359 if (pf_status.stateid == 0) { 1360 pf_status.stateid = time_second; 1361 pf_status.stateid = pf_status.stateid << 32; 1362 } 1363 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1364 } 1365 break; 1366 1367 case DIOCSTOP: 1368 if (!pf_status.running) 1369 error = ENOENT; 1370 else { 1371 #ifdef __NetBSD__ 1372 error = pf_pfil_detach(); 1373 if (error) 1374 break; 1375 #endif /* __NetBSD__ */ 1376 pf_status.running = 0; 1377 pf_status.since = time_second; 1378 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1379 } 1380 break; 1381 1382 case DIOCADDRULE: { 1383 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1384 struct pf_ruleset *ruleset; 1385 struct pf_rule *rule, *tail; 1386 int rs_num; 1387 1388 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1389 ruleset = pf_find_ruleset(pr->anchor); 1390 if (ruleset == NULL) { 1391 error = EINVAL; 1392 break; 1393 } 1394 rs_num = pf_get_ruleset_number(pr->rule.action); 1395 if (rs_num >= PF_RULESET_MAX) { 1396 error = EINVAL; 1397 break; 1398 } 1399 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1400 error = EINVAL; 1401 break; 1402 } 1403 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1404 error = EBUSY; 1405 break; 1406 } 1407 if (pr->pool_ticket != ticket_pabuf) { 1408 error = EBUSY; 1409 break; 1410 } 1411 rule = pool_get(&pf_rule_pl, PR_NOWAIT); 1412 if (rule == NULL) { 1413 error = ENOMEM; 1414 break; 1415 } 1416 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1417 #ifdef __NetBSD__ 1418 rule->cuid = kauth_cred_getuid(l->l_cred); 1419 rule->cpid = l->l_proc->p_pid; 1420 #else 1421 rule->cuid = p->p_cred->p_ruid; 1422 rule->cpid = p->p_pid; 1423 #endif /* !__NetBSD__ */ 1424 rule->anchor = NULL; 1425 rule->kif = NULL; 1426 TAILQ_INIT(&rule->rpool.list); 1427 /* initialize refcounting */ 1428 rule->states = 0; 1429 rule->src_nodes = 0; 1430 rule->entries.tqe_prev = NULL; 1431 #ifndef INET 1432 if (rule->af == AF_INET) { 1433 pool_put(&pf_rule_pl, rule); 1434 error = EAFNOSUPPORT; 1435 break; 1436 } 1437 #endif /* INET */ 1438 #ifndef INET6 1439 if (rule->af == AF_INET6) { 1440 pool_put(&pf_rule_pl, rule); 1441 error = EAFNOSUPPORT; 1442 break; 1443 } 1444 #endif /* INET6 */ 1445 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1446 pf_rulequeue); 1447 if (tail) 1448 rule->nr = tail->nr + 1; 1449 else 1450 rule->nr = 0; 1451 if (rule->ifname[0]) { 1452 rule->kif = pfi_kif_get(rule->ifname); 1453 if (rule->kif == NULL) { 1454 pool_put(&pf_rule_pl, rule); 1455 error = EINVAL; 1456 break; 1457 } 1458 pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE); 1459 } 1460 1461 #ifndef __NetBSD__ 1462 if (rule->rtableid > 0 && !rtable_exists(rule->rtableid)) 1463 error = EBUSY; 1464 #endif /* !__NetBSD__ */ 1465 1466 #ifdef ALTQ 1467 /* set queue IDs */ 1468 if (rule->qname[0] != 0) { 1469 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1470 error = EBUSY; 1471 else if (rule->pqname[0] != 0) { 1472 if ((rule->pqid = 1473 pf_qname2qid(rule->pqname)) == 0) 1474 error = EBUSY; 1475 } else 1476 rule->pqid = rule->qid; 1477 } 1478 #endif 1479 if (rule->tagname[0]) 1480 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1481 error = EBUSY; 1482 if (rule->match_tagname[0]) 1483 if ((rule->match_tag = 1484 pf_tagname2tag(rule->match_tagname)) == 0) 1485 error = EBUSY; 1486 if (rule->rt && !rule->direction) 1487 error = EINVAL; 1488 #if NPFLOG > 0 1489 if (!rule->log) 1490 rule->logif = 0; 1491 if (rule->logif >= PFLOGIFS_MAX) 1492 error = EINVAL; 1493 #endif 1494 if (pf_rtlabel_add(&rule->src.addr) || 1495 pf_rtlabel_add(&rule->dst.addr)) 1496 error = EBUSY; 1497 if (pfi_dynaddr_setup(&rule->src.addr, rule->af)) 1498 error = EINVAL; 1499 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af)) 1500 error = EINVAL; 1501 if (pf_tbladdr_setup(ruleset, &rule->src.addr)) 1502 error = EINVAL; 1503 if (pf_tbladdr_setup(ruleset, &rule->dst.addr)) 1504 error = EINVAL; 1505 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1506 error = EINVAL; 1507 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1508 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1509 error = EINVAL; 1510 1511 rule->overload_tbl = NULL; 1512 if (rule->overload_tblname[0]) { 1513 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1514 rule->overload_tblname)) == NULL) 1515 error = EINVAL; 1516 else 1517 rule->overload_tbl->pfrkt_flags |= 1518 PFR_TFLAG_ACTIVE; 1519 } 1520 1521 pf_mv_pool(&pf_pabuf, &rule->rpool.list); 1522 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1523 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1524 (rule->rt > PF_FASTROUTE)) && 1525 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1526 error = EINVAL; 1527 1528 if (error) { 1529 pf_rm_rule(NULL, rule); 1530 break; 1531 } 1532 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1533 rule->evaluations = rule->packets[0] = rule->packets[1] = 1534 rule->bytes[0] = rule->bytes[1] = 0; 1535 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1536 rule, entries); 1537 ruleset->rules[rs_num].inactive.rcount++; 1538 break; 1539 } 1540 1541 case DIOCGETRULES: { 1542 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1543 struct pf_ruleset *ruleset; 1544 struct pf_rule *tail; 1545 int rs_num; 1546 1547 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1548 ruleset = pf_find_ruleset(pr->anchor); 1549 if (ruleset == NULL) { 1550 error = EINVAL; 1551 break; 1552 } 1553 rs_num = pf_get_ruleset_number(pr->rule.action); 1554 if (rs_num >= PF_RULESET_MAX) { 1555 error = EINVAL; 1556 break; 1557 } 1558 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1559 pf_rulequeue); 1560 if (tail) 1561 pr->nr = tail->nr + 1; 1562 else 1563 pr->nr = 0; 1564 pr->ticket = ruleset->rules[rs_num].active.ticket; 1565 break; 1566 } 1567 1568 case DIOCGETRULE: { 1569 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1570 struct pf_ruleset *ruleset; 1571 struct pf_rule *rule; 1572 int rs_num, i; 1573 1574 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1575 ruleset = pf_find_ruleset(pr->anchor); 1576 if (ruleset == NULL) { 1577 error = EINVAL; 1578 break; 1579 } 1580 rs_num = pf_get_ruleset_number(pr->rule.action); 1581 if (rs_num >= PF_RULESET_MAX) { 1582 error = EINVAL; 1583 break; 1584 } 1585 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1586 error = EBUSY; 1587 break; 1588 } 1589 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1590 while ((rule != NULL) && (rule->nr != pr->nr)) 1591 rule = TAILQ_NEXT(rule, entries); 1592 if (rule == NULL) { 1593 error = EBUSY; 1594 break; 1595 } 1596 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1597 if (pf_anchor_copyout(ruleset, rule, pr)) { 1598 error = EBUSY; 1599 break; 1600 } 1601 pfi_dynaddr_copyout(&pr->rule.src.addr); 1602 pfi_dynaddr_copyout(&pr->rule.dst.addr); 1603 pf_tbladdr_copyout(&pr->rule.src.addr); 1604 pf_tbladdr_copyout(&pr->rule.dst.addr); 1605 pf_rtlabel_copyout(&pr->rule.src.addr); 1606 pf_rtlabel_copyout(&pr->rule.dst.addr); 1607 for (i = 0; i < PF_SKIP_COUNT; ++i) 1608 if (rule->skip[i].ptr == NULL) 1609 pr->rule.skip[i].nr = -1; 1610 else 1611 pr->rule.skip[i].nr = 1612 rule->skip[i].ptr->nr; 1613 1614 if (pr->action == PF_GET_CLR_CNTR) { 1615 rule->evaluations = 0; 1616 rule->packets[0] = rule->packets[1] = 0; 1617 rule->bytes[0] = rule->bytes[1] = 0; 1618 } 1619 break; 1620 } 1621 1622 case DIOCCHANGERULE: { 1623 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1624 struct pf_ruleset *ruleset; 1625 struct pf_rule *oldrule = NULL, *newrule = NULL; 1626 u_int32_t nr = 0; 1627 int rs_num; 1628 1629 if (!(pcr->action == PF_CHANGE_REMOVE || 1630 pcr->action == PF_CHANGE_GET_TICKET) && 1631 pcr->pool_ticket != ticket_pabuf) { 1632 error = EBUSY; 1633 break; 1634 } 1635 1636 if (pcr->action < PF_CHANGE_ADD_HEAD || 1637 pcr->action > PF_CHANGE_GET_TICKET) { 1638 error = EINVAL; 1639 break; 1640 } 1641 ruleset = pf_find_ruleset(pcr->anchor); 1642 if (ruleset == NULL) { 1643 error = EINVAL; 1644 break; 1645 } 1646 rs_num = pf_get_ruleset_number(pcr->rule.action); 1647 if (rs_num >= PF_RULESET_MAX) { 1648 error = EINVAL; 1649 break; 1650 } 1651 1652 if (pcr->action == PF_CHANGE_GET_TICKET) { 1653 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1654 break; 1655 } else { 1656 if (pcr->ticket != 1657 ruleset->rules[rs_num].active.ticket) { 1658 error = EINVAL; 1659 break; 1660 } 1661 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1662 error = EINVAL; 1663 break; 1664 } 1665 } 1666 1667 if (pcr->action != PF_CHANGE_REMOVE) { 1668 newrule = pool_get(&pf_rule_pl, PR_NOWAIT); 1669 if (newrule == NULL) { 1670 error = ENOMEM; 1671 break; 1672 } 1673 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1674 #ifdef __NetBSD__ 1675 newrule->cuid = kauth_cred_getuid(l->l_cred); 1676 newrule->cpid = l->l_proc->p_pid; 1677 #else 1678 newrule->cuid = p->p_cred->p_ruid; 1679 newrule->cpid = p->p_pid; 1680 #endif /* !__NetBSD__ */ 1681 TAILQ_INIT(&newrule->rpool.list); 1682 /* initialize refcounting */ 1683 newrule->states = 0; 1684 newrule->entries.tqe_prev = NULL; 1685 #ifndef INET 1686 if (newrule->af == AF_INET) { 1687 pool_put(&pf_rule_pl, newrule); 1688 error = EAFNOSUPPORT; 1689 break; 1690 } 1691 #endif /* INET */ 1692 #ifndef INET6 1693 if (newrule->af == AF_INET6) { 1694 pool_put(&pf_rule_pl, newrule); 1695 error = EAFNOSUPPORT; 1696 break; 1697 } 1698 #endif /* INET6 */ 1699 if (newrule->ifname[0]) { 1700 newrule->kif = pfi_kif_get(newrule->ifname); 1701 if (newrule->kif == NULL) { 1702 pool_put(&pf_rule_pl, newrule); 1703 error = EINVAL; 1704 break; 1705 } 1706 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE); 1707 } else 1708 newrule->kif = NULL; 1709 1710 #ifndef __NetBSD__ 1711 if (newrule->rtableid > 0 && 1712 !rtable_exists(newrule->rtableid)) 1713 error = EBUSY; 1714 #endif /* !__NetBSD__ */ 1715 1716 #ifdef ALTQ 1717 /* set queue IDs */ 1718 if (newrule->qname[0] != 0) { 1719 if ((newrule->qid = 1720 pf_qname2qid(newrule->qname)) == 0) 1721 error = EBUSY; 1722 else if (newrule->pqname[0] != 0) { 1723 if ((newrule->pqid = 1724 pf_qname2qid(newrule->pqname)) == 0) 1725 error = EBUSY; 1726 } else 1727 newrule->pqid = newrule->qid; 1728 } 1729 #endif /* ALTQ */ 1730 if (newrule->tagname[0]) 1731 if ((newrule->tag = 1732 pf_tagname2tag(newrule->tagname)) == 0) 1733 error = EBUSY; 1734 if (newrule->match_tagname[0]) 1735 if ((newrule->match_tag = pf_tagname2tag( 1736 newrule->match_tagname)) == 0) 1737 error = EBUSY; 1738 if (newrule->rt && !newrule->direction) 1739 error = EINVAL; 1740 #if NPFLOG > 0 1741 if (!newrule->log) 1742 newrule->logif = 0; 1743 if (newrule->logif >= PFLOGIFS_MAX) 1744 error = EINVAL; 1745 #endif 1746 if (pf_rtlabel_add(&newrule->src.addr) || 1747 pf_rtlabel_add(&newrule->dst.addr)) 1748 error = EBUSY; 1749 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af)) 1750 error = EINVAL; 1751 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af)) 1752 error = EINVAL; 1753 if (pf_tbladdr_setup(ruleset, &newrule->src.addr)) 1754 error = EINVAL; 1755 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr)) 1756 error = EINVAL; 1757 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1758 error = EINVAL; 1759 TAILQ_FOREACH(pa, &pf_pabuf, entries) 1760 if (pf_tbladdr_setup(ruleset, &pa->addr)) 1761 error = EINVAL; 1762 1763 newrule->overload_tbl = NULL; 1764 if (newrule->overload_tblname[0]) { 1765 if ((newrule->overload_tbl = pfr_attach_table( 1766 ruleset, newrule->overload_tblname)) == 1767 NULL) 1768 error = EINVAL; 1769 else 1770 newrule->overload_tbl->pfrkt_flags |= 1771 PFR_TFLAG_ACTIVE; 1772 } 1773 1774 pf_mv_pool(&pf_pabuf, &newrule->rpool.list); 1775 if (((((newrule->action == PF_NAT) || 1776 (newrule->action == PF_RDR) || 1777 (newrule->action == PF_BINAT) || 1778 (newrule->rt > PF_FASTROUTE)) && 1779 !newrule->anchor)) && 1780 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1781 error = EINVAL; 1782 1783 if (error) { 1784 pf_rm_rule(NULL, newrule); 1785 break; 1786 } 1787 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1788 newrule->evaluations = 0; 1789 newrule->packets[0] = newrule->packets[1] = 0; 1790 newrule->bytes[0] = newrule->bytes[1] = 0; 1791 } 1792 pf_empty_pool(&pf_pabuf); 1793 1794 if (pcr->action == PF_CHANGE_ADD_HEAD) 1795 oldrule = TAILQ_FIRST( 1796 ruleset->rules[rs_num].active.ptr); 1797 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1798 oldrule = TAILQ_LAST( 1799 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1800 else { 1801 oldrule = TAILQ_FIRST( 1802 ruleset->rules[rs_num].active.ptr); 1803 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1804 oldrule = TAILQ_NEXT(oldrule, entries); 1805 if (oldrule == NULL) { 1806 if (newrule != NULL) 1807 pf_rm_rule(NULL, newrule); 1808 error = EINVAL; 1809 break; 1810 } 1811 } 1812 1813 if (pcr->action == PF_CHANGE_REMOVE) { 1814 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule); 1815 ruleset->rules[rs_num].active.rcount--; 1816 } else { 1817 if (oldrule == NULL) 1818 TAILQ_INSERT_TAIL( 1819 ruleset->rules[rs_num].active.ptr, 1820 newrule, entries); 1821 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1822 pcr->action == PF_CHANGE_ADD_BEFORE) 1823 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1824 else 1825 TAILQ_INSERT_AFTER( 1826 ruleset->rules[rs_num].active.ptr, 1827 oldrule, newrule, entries); 1828 ruleset->rules[rs_num].active.rcount++; 1829 } 1830 1831 nr = 0; 1832 TAILQ_FOREACH(oldrule, 1833 ruleset->rules[rs_num].active.ptr, entries) 1834 oldrule->nr = nr++; 1835 1836 ruleset->rules[rs_num].active.ticket++; 1837 1838 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1839 pf_remove_if_empty_ruleset(ruleset); 1840 1841 break; 1842 } 1843 1844 case DIOCCLRSTATES: { 1845 struct pf_state *ps, *nexts; 1846 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1847 int killed = 0; 1848 1849 for (ps = RB_MIN(pf_state_tree_id, &tree_id); ps; ps = nexts) { 1850 nexts = RB_NEXT(pf_state_tree_id, &tree_id, ps); 1851 1852 if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1853 ps->kif->pfik_name)) { 1854 #if NPFSYNC 1855 /* don't send out individual delete messages */ 1856 ps->sync_flags = PFSTATE_NOSYNC; 1857 #endif 1858 pf_unlink_state(ps); 1859 killed++; 1860 } 1861 } 1862 psk->psk_af = killed; 1863 #if NPFSYNC 1864 pfsync_clear_states(pf_status.hostid, psk->psk_ifname); 1865 #endif 1866 break; 1867 } 1868 1869 case DIOCKILLSTATES: { 1870 struct pf_state *ps, *nexts; 1871 struct pf_state_key *sk; 1872 struct pf_state_host *src, *dst; 1873 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1874 int killed = 0; 1875 1876 for (ps = RB_MIN(pf_state_tree_id, &tree_id); ps; 1877 ps = nexts) { 1878 nexts = RB_NEXT(pf_state_tree_id, &tree_id, ps); 1879 sk = ps->state_key; 1880 1881 if (sk->direction == PF_OUT) { 1882 src = &sk->lan; 1883 dst = &sk->ext; 1884 } else { 1885 src = &sk->ext; 1886 dst = &sk->lan; 1887 } 1888 if ((!psk->psk_af || sk->af == psk->psk_af) 1889 && (!psk->psk_proto || psk->psk_proto == 1890 sk->proto) && 1891 PF_MATCHA(psk->psk_src.neg, 1892 &psk->psk_src.addr.v.a.addr, 1893 &psk->psk_src.addr.v.a.mask, 1894 &src->addr, sk->af) && 1895 PF_MATCHA(psk->psk_dst.neg, 1896 &psk->psk_dst.addr.v.a.addr, 1897 &psk->psk_dst.addr.v.a.mask, 1898 &dst->addr, sk->af) && 1899 (psk->psk_src.port_op == 0 || 1900 pf_match_port(psk->psk_src.port_op, 1901 psk->psk_src.port[0], psk->psk_src.port[1], 1902 src->port)) && 1903 (psk->psk_dst.port_op == 0 || 1904 pf_match_port(psk->psk_dst.port_op, 1905 psk->psk_dst.port[0], psk->psk_dst.port[1], 1906 dst->port)) && 1907 (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname, 1908 ps->kif->pfik_name))) { 1909 #if NPFSYNC > 0 1910 /* send immediate delete of state */ 1911 pfsync_delete_state(ps); 1912 ps->sync_flags |= PFSTATE_NOSYNC; 1913 #endif 1914 pf_unlink_state(ps); 1915 killed++; 1916 } 1917 } 1918 psk->psk_af = killed; 1919 break; 1920 } 1921 1922 case DIOCADDSTATE: { 1923 struct pfioc_state *ps = (struct pfioc_state *)addr; 1924 struct pfsync_state *sp = (struct pfsync_state *)ps->state; 1925 1926 error = pf_state_add(sp); 1927 break; 1928 } 1929 1930 case DIOCADDSTATES: { 1931 struct pfioc_states *ps = (struct pfioc_states *)addr; 1932 struct pfsync_state *p = (struct pfsync_state *) ps->ps_states; 1933 struct pfsync_state *pk; 1934 int size = ps->ps_len; 1935 int i = 0; 1936 error = 0; 1937 1938 pk = malloc(sizeof(*pk), M_TEMP,M_WAITOK); 1939 1940 while (error == 0 && i < size) 1941 { 1942 if (copyin(p, pk, sizeof(struct pfsync_state))) 1943 { 1944 error = EFAULT; 1945 free(pk, M_TEMP); 1946 } else { 1947 error = pf_state_add(pk); 1948 i += sizeof(*p); 1949 p++; 1950 } 1951 } 1952 1953 free(pk, M_TEMP); 1954 break; 1955 } 1956 1957 1958 case DIOCGETSTATE: { 1959 struct pfioc_state *ps = (struct pfioc_state *)addr; 1960 struct pf_state *pfs; 1961 u_int32_t nr; 1962 1963 nr = 0; 1964 RB_FOREACH(pfs, pf_state_tree_id, &tree_id) { 1965 if (nr >= ps->nr) 1966 break; 1967 nr++; 1968 } 1969 if (pfs == NULL) { 1970 error = EBUSY; 1971 break; 1972 } 1973 1974 pf_state_export((struct pfsync_state *)&ps->state, 1975 pfs->state_key, pfs); 1976 break; 1977 } 1978 1979 case DIOCGETSTATES: { 1980 struct pfioc_states *ps = (struct pfioc_states *)addr; 1981 struct pf_state *state; 1982 struct pfsync_state *p, *pstore; 1983 u_int32_t nr = 0; 1984 1985 if (ps->ps_len == 0) { 1986 nr = pf_status.states; 1987 ps->ps_len = sizeof(struct pfsync_state) * nr; 1988 break; 1989 } 1990 1991 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 1992 1993 p = ps->ps_states; 1994 1995 state = TAILQ_FIRST(&state_list); 1996 while (state) { 1997 if (state->timeout != PFTM_UNLINKED) { 1998 if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len) 1999 break; 2000 2001 pf_state_export(pstore, 2002 state->state_key, state); 2003 error = copyout(pstore, p, sizeof(*p)); 2004 if (error) { 2005 free(pstore, M_TEMP); 2006 goto fail; 2007 } 2008 p++; 2009 nr++; 2010 } 2011 state = TAILQ_NEXT(state, entry_list); 2012 } 2013 2014 ps->ps_len = sizeof(struct pfsync_state) * nr; 2015 2016 free(pstore, M_TEMP); 2017 break; 2018 } 2019 2020 case DIOCGETSTATUS: { 2021 struct pf_status *ps = (struct pf_status *)addr; 2022 bcopy(&pf_status, ps, sizeof(struct pf_status)); 2023 pfi_fill_oldstatus(ps); 2024 break; 2025 } 2026 2027 case DIOCSETSTATUSIF: { 2028 struct pfioc_if *pi = (struct pfioc_if *)addr; 2029 2030 if (pi->ifname[0] == 0) { 2031 bzero(pf_status.ifname, IFNAMSIZ); 2032 break; 2033 } 2034 if (ifunit(pi->ifname) == NULL) { 2035 error = EINVAL; 2036 break; 2037 } 2038 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ); 2039 break; 2040 } 2041 2042 case DIOCCLRSTATUS: { 2043 bzero(pf_status.counters, sizeof(pf_status.counters)); 2044 bzero(pf_status.fcounters, sizeof(pf_status.fcounters)); 2045 bzero(pf_status.scounters, sizeof(pf_status.scounters)); 2046 pf_status.since = time_second; 2047 if (*pf_status.ifname) 2048 pfi_clr_istats(pf_status.ifname); 2049 break; 2050 } 2051 2052 case DIOCNATLOOK: { 2053 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 2054 struct pf_state_key *sk; 2055 struct pf_state *state; 2056 struct pf_state_key_cmp key; 2057 int m = 0, direction = pnl->direction; 2058 2059 key.af = pnl->af; 2060 key.proto = pnl->proto; 2061 2062 if (!pnl->proto || 2063 PF_AZERO(&pnl->saddr, pnl->af) || 2064 PF_AZERO(&pnl->daddr, pnl->af) || 2065 ((pnl->proto == IPPROTO_TCP || 2066 pnl->proto == IPPROTO_UDP) && 2067 (!pnl->dport || !pnl->sport))) 2068 error = EINVAL; 2069 else { 2070 /* 2071 * userland gives us source and dest of connection, 2072 * reverse the lookup so we ask for what happens with 2073 * the return traffic, enabling us to find it in the 2074 * state tree. 2075 */ 2076 if (direction == PF_IN) { 2077 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af); 2078 key.ext.port = pnl->dport; 2079 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af); 2080 key.gwy.port = pnl->sport; 2081 state = pf_find_state_all(&key, PF_EXT_GWY, &m); 2082 } else { 2083 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af); 2084 key.lan.port = pnl->dport; 2085 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af); 2086 key.ext.port = pnl->sport; 2087 state = pf_find_state_all(&key, PF_LAN_EXT, &m); 2088 } 2089 if (m > 1) 2090 error = E2BIG; /* more than one state */ 2091 else if (state != NULL) { 2092 sk = state->state_key; 2093 if (direction == PF_IN) { 2094 PF_ACPY(&pnl->rsaddr, &sk->lan.addr, 2095 sk->af); 2096 pnl->rsport = sk->lan.port; 2097 PF_ACPY(&pnl->rdaddr, &pnl->daddr, 2098 pnl->af); 2099 pnl->rdport = pnl->dport; 2100 } else { 2101 PF_ACPY(&pnl->rdaddr, &sk->gwy.addr, 2102 sk->af); 2103 pnl->rdport = sk->gwy.port; 2104 PF_ACPY(&pnl->rsaddr, &pnl->saddr, 2105 pnl->af); 2106 pnl->rsport = pnl->sport; 2107 } 2108 } else 2109 error = ENOENT; 2110 } 2111 break; 2112 } 2113 2114 case DIOCSETTIMEOUT: { 2115 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 2116 int old; 2117 2118 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 2119 pt->seconds < 0) { 2120 error = EINVAL; 2121 goto fail; 2122 } 2123 old = pf_default_rule.timeout[pt->timeout]; 2124 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 2125 pt->seconds = 1; 2126 pf_default_rule.timeout[pt->timeout] = pt->seconds; 2127 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 2128 wakeup(pf_purge_thread); 2129 pt->seconds = old; 2130 break; 2131 } 2132 2133 case DIOCGETTIMEOUT: { 2134 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 2135 2136 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 2137 error = EINVAL; 2138 goto fail; 2139 } 2140 pt->seconds = pf_default_rule.timeout[pt->timeout]; 2141 break; 2142 } 2143 2144 case DIOCGETLIMIT: { 2145 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 2146 2147 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 2148 error = EINVAL; 2149 goto fail; 2150 } 2151 pl->limit = pf_pool_limits[pl->index].limit; 2152 break; 2153 } 2154 2155 case DIOCSETLIMIT: { 2156 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 2157 int old_limit; 2158 2159 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 2160 pf_pool_limits[pl->index].pp == NULL) { 2161 error = EINVAL; 2162 goto fail; 2163 } 2164 #ifdef __NetBSD__ 2165 pool_sethardlimit(pf_pool_limits[pl->index].pp, 2166 pl->limit, NULL, 0); 2167 #else 2168 if (pool_sethardlimit(pf_pool_limits[pl->index].pp, 2169 pl->limit, NULL, 0) != 0) { 2170 error = EBUSY; 2171 goto fail; 2172 } 2173 #endif /* !__NetBSD__ */ 2174 old_limit = pf_pool_limits[pl->index].limit; 2175 pf_pool_limits[pl->index].limit = pl->limit; 2176 pl->limit = old_limit; 2177 break; 2178 } 2179 2180 case DIOCSETDEBUG: { 2181 u_int32_t *level = (u_int32_t *)addr; 2182 2183 pf_status.debug = *level; 2184 break; 2185 } 2186 2187 case DIOCCLRRULECTRS: { 2188 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 2189 struct pf_ruleset *ruleset = &pf_main_ruleset; 2190 struct pf_rule *rule; 2191 2192 TAILQ_FOREACH(rule, 2193 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 2194 rule->evaluations = 0; 2195 rule->packets[0] = rule->packets[1] = 0; 2196 rule->bytes[0] = rule->bytes[1] = 0; 2197 } 2198 break; 2199 } 2200 2201 #ifdef ALTQ 2202 case DIOCSTARTALTQ: { 2203 struct pf_altq *altq; 2204 2205 /* enable all altq interfaces on active list */ 2206 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2207 if (altq->qname[0] == 0) { 2208 error = pf_enable_altq(altq); 2209 if (error != 0) 2210 break; 2211 } 2212 } 2213 if (error == 0) 2214 pf_altq_running = 1; 2215 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 2216 break; 2217 } 2218 2219 case DIOCSTOPALTQ: { 2220 struct pf_altq *altq; 2221 2222 /* disable all altq interfaces on active list */ 2223 TAILQ_FOREACH(altq, pf_altqs_active, entries) { 2224 if (altq->qname[0] == 0) { 2225 error = pf_disable_altq(altq); 2226 if (error != 0) 2227 break; 2228 } 2229 } 2230 if (error == 0) 2231 pf_altq_running = 0; 2232 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 2233 break; 2234 } 2235 2236 case DIOCADDALTQ: { 2237 struct pfioc_altq *paa = (struct pfioc_altq *)addr; 2238 struct pf_altq *altq, *a; 2239 2240 if (paa->ticket != ticket_altqs_inactive) { 2241 error = EBUSY; 2242 break; 2243 } 2244 altq = pool_get(&pf_altq_pl, PR_NOWAIT); 2245 if (altq == NULL) { 2246 error = ENOMEM; 2247 break; 2248 } 2249 bcopy(&paa->altq, altq, sizeof(struct pf_altq)); 2250 2251 /* 2252 * if this is for a queue, find the discipline and 2253 * copy the necessary fields 2254 */ 2255 if (altq->qname[0] != 0) { 2256 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 2257 error = EBUSY; 2258 pool_put(&pf_altq_pl, altq); 2259 break; 2260 } 2261 TAILQ_FOREACH(a, pf_altqs_inactive, entries) { 2262 if (strncmp(a->ifname, altq->ifname, 2263 IFNAMSIZ) == 0 && a->qname[0] == 0) { 2264 altq->altq_disc = a->altq_disc; 2265 break; 2266 } 2267 } 2268 } 2269 2270 error = altq_add(altq); 2271 if (error) { 2272 pool_put(&pf_altq_pl, altq); 2273 break; 2274 } 2275 2276 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries); 2277 bcopy(altq, &paa->altq, sizeof(struct pf_altq)); 2278 break; 2279 } 2280 2281 case DIOCGETALTQS: { 2282 struct pfioc_altq *paa = (struct pfioc_altq *)addr; 2283 struct pf_altq *altq; 2284 2285 paa->nr = 0; 2286 TAILQ_FOREACH(altq, pf_altqs_active, entries) 2287 paa->nr++; 2288 paa->ticket = ticket_altqs_active; 2289 break; 2290 } 2291 2292 case DIOCGETALTQ: { 2293 struct pfioc_altq *paa = (struct pfioc_altq *)addr; 2294 struct pf_altq *altq; 2295 u_int32_t nr; 2296 2297 if (paa->ticket != ticket_altqs_active) { 2298 error = EBUSY; 2299 break; 2300 } 2301 nr = 0; 2302 altq = TAILQ_FIRST(pf_altqs_active); 2303 while ((altq != NULL) && (nr < paa->nr)) { 2304 altq = TAILQ_NEXT(altq, entries); 2305 nr++; 2306 } 2307 if (altq == NULL) { 2308 error = EBUSY; 2309 break; 2310 } 2311 bcopy(altq, &paa->altq, sizeof(struct pf_altq)); 2312 break; 2313 } 2314 2315 case DIOCCHANGEALTQ: 2316 /* CHANGEALTQ not supported yet! */ 2317 error = ENODEV; 2318 break; 2319 2320 case DIOCGETQSTATS: { 2321 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 2322 struct pf_altq *altq; 2323 u_int32_t nr; 2324 int nbytes; 2325 2326 if (pq->ticket != ticket_altqs_active) { 2327 error = EBUSY; 2328 break; 2329 } 2330 nbytes = pq->nbytes; 2331 nr = 0; 2332 altq = TAILQ_FIRST(pf_altqs_active); 2333 while ((altq != NULL) && (nr < pq->nr)) { 2334 altq = TAILQ_NEXT(altq, entries); 2335 nr++; 2336 } 2337 if (altq == NULL) { 2338 error = EBUSY; 2339 break; 2340 } 2341 error = altq_getqstats(altq, pq->buf, &nbytes); 2342 if (error == 0) { 2343 pq->scheduler = altq->scheduler; 2344 pq->nbytes = nbytes; 2345 } 2346 break; 2347 } 2348 #endif /* ALTQ */ 2349 2350 case DIOCBEGINADDRS: { 2351 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2352 2353 pf_empty_pool(&pf_pabuf); 2354 pp->ticket = ++ticket_pabuf; 2355 break; 2356 } 2357 2358 case DIOCADDADDR: { 2359 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2360 2361 if (pp->ticket != ticket_pabuf) { 2362 error = EBUSY; 2363 break; 2364 } 2365 #ifndef INET 2366 if (pp->af == AF_INET) { 2367 error = EAFNOSUPPORT; 2368 break; 2369 } 2370 #endif /* INET */ 2371 #ifndef INET6 2372 if (pp->af == AF_INET6) { 2373 error = EAFNOSUPPORT; 2374 break; 2375 } 2376 #endif /* INET6 */ 2377 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2378 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2379 pp->addr.addr.type != PF_ADDR_TABLE) { 2380 error = EINVAL; 2381 break; 2382 } 2383 pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2384 if (pa == NULL) { 2385 error = ENOMEM; 2386 break; 2387 } 2388 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2389 if (pa->ifname[0]) { 2390 pa->kif = pfi_kif_get(pa->ifname); 2391 if (pa->kif == NULL) { 2392 pool_put(&pf_pooladdr_pl, pa); 2393 error = EINVAL; 2394 break; 2395 } 2396 pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE); 2397 } 2398 if (pfi_dynaddr_setup(&pa->addr, pp->af)) { 2399 pfi_dynaddr_remove(&pa->addr); 2400 pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE); 2401 pool_put(&pf_pooladdr_pl, pa); 2402 error = EINVAL; 2403 break; 2404 } 2405 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries); 2406 break; 2407 } 2408 2409 case DIOCGETADDRS: { 2410 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2411 2412 pp->nr = 0; 2413 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2414 pp->r_num, 0, 1, 0); 2415 if (pool == NULL) { 2416 error = EBUSY; 2417 break; 2418 } 2419 TAILQ_FOREACH(pa, &pool->list, entries) 2420 pp->nr++; 2421 break; 2422 } 2423 2424 case DIOCGETADDR: { 2425 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2426 u_int32_t nr = 0; 2427 2428 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2429 pp->r_num, 0, 1, 1); 2430 if (pool == NULL) { 2431 error = EBUSY; 2432 break; 2433 } 2434 pa = TAILQ_FIRST(&pool->list); 2435 while ((pa != NULL) && (nr < pp->nr)) { 2436 pa = TAILQ_NEXT(pa, entries); 2437 nr++; 2438 } 2439 if (pa == NULL) { 2440 error = EBUSY; 2441 break; 2442 } 2443 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2444 pfi_dynaddr_copyout(&pp->addr.addr); 2445 pf_tbladdr_copyout(&pp->addr.addr); 2446 pf_rtlabel_copyout(&pp->addr.addr); 2447 break; 2448 } 2449 2450 case DIOCCHANGEADDR: { 2451 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2452 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2453 struct pf_ruleset *ruleset; 2454 2455 if (pca->action < PF_CHANGE_ADD_HEAD || 2456 pca->action > PF_CHANGE_REMOVE) { 2457 error = EINVAL; 2458 break; 2459 } 2460 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2461 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2462 pca->addr.addr.type != PF_ADDR_TABLE) { 2463 error = EINVAL; 2464 break; 2465 } 2466 2467 ruleset = pf_find_ruleset(pca->anchor); 2468 if (ruleset == NULL) { 2469 error = EBUSY; 2470 break; 2471 } 2472 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2473 pca->r_num, pca->r_last, 1, 1); 2474 if (pool == NULL) { 2475 error = EBUSY; 2476 break; 2477 } 2478 if (pca->action != PF_CHANGE_REMOVE) { 2479 newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT); 2480 if (newpa == NULL) { 2481 error = ENOMEM; 2482 break; 2483 } 2484 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2485 #ifndef INET 2486 if (pca->af == AF_INET) { 2487 pool_put(&pf_pooladdr_pl, newpa); 2488 error = EAFNOSUPPORT; 2489 break; 2490 } 2491 #endif /* INET */ 2492 #ifndef INET6 2493 if (pca->af == AF_INET6) { 2494 pool_put(&pf_pooladdr_pl, newpa); 2495 error = EAFNOSUPPORT; 2496 break; 2497 } 2498 #endif /* INET6 */ 2499 if (newpa->ifname[0]) { 2500 newpa->kif = pfi_kif_get(newpa->ifname); 2501 if (newpa->kif == NULL) { 2502 pool_put(&pf_pooladdr_pl, newpa); 2503 error = EINVAL; 2504 break; 2505 } 2506 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE); 2507 } else 2508 newpa->kif = NULL; 2509 if (pfi_dynaddr_setup(&newpa->addr, pca->af) || 2510 pf_tbladdr_setup(ruleset, &newpa->addr)) { 2511 pfi_dynaddr_remove(&newpa->addr); 2512 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE); 2513 pool_put(&pf_pooladdr_pl, newpa); 2514 error = EINVAL; 2515 break; 2516 } 2517 } 2518 2519 if (pca->action == PF_CHANGE_ADD_HEAD) 2520 oldpa = TAILQ_FIRST(&pool->list); 2521 else if (pca->action == PF_CHANGE_ADD_TAIL) 2522 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2523 else { 2524 int i = 0; 2525 2526 oldpa = TAILQ_FIRST(&pool->list); 2527 while ((oldpa != NULL) && (i < pca->nr)) { 2528 oldpa = TAILQ_NEXT(oldpa, entries); 2529 i++; 2530 } 2531 if (oldpa == NULL) { 2532 error = EINVAL; 2533 break; 2534 } 2535 } 2536 2537 if (pca->action == PF_CHANGE_REMOVE) { 2538 TAILQ_REMOVE(&pool->list, oldpa, entries); 2539 pfi_dynaddr_remove(&oldpa->addr); 2540 pf_tbladdr_remove(&oldpa->addr); 2541 pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE); 2542 pool_put(&pf_pooladdr_pl, oldpa); 2543 } else { 2544 if (oldpa == NULL) 2545 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2546 else if (pca->action == PF_CHANGE_ADD_HEAD || 2547 pca->action == PF_CHANGE_ADD_BEFORE) 2548 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2549 else 2550 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2551 newpa, entries); 2552 } 2553 2554 pool->cur = TAILQ_FIRST(&pool->list); 2555 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2556 pca->af); 2557 break; 2558 } 2559 2560 case DIOCGETRULESETS: { 2561 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2562 struct pf_ruleset *ruleset; 2563 struct pf_anchor *anchor; 2564 2565 pr->path[sizeof(pr->path) - 1] = 0; 2566 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2567 error = EINVAL; 2568 break; 2569 } 2570 pr->nr = 0; 2571 if (ruleset->anchor == NULL) { 2572 /* XXX kludge for pf_main_ruleset */ 2573 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2574 if (anchor->parent == NULL) 2575 pr->nr++; 2576 } else { 2577 RB_FOREACH(anchor, pf_anchor_node, 2578 &ruleset->anchor->children) 2579 pr->nr++; 2580 } 2581 break; 2582 } 2583 2584 case DIOCGETRULESET: { 2585 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2586 struct pf_ruleset *ruleset; 2587 struct pf_anchor *anchor; 2588 u_int32_t nr = 0; 2589 2590 pr->path[sizeof(pr->path) - 1] = 0; 2591 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2592 error = EINVAL; 2593 break; 2594 } 2595 pr->name[0] = 0; 2596 if (ruleset->anchor == NULL) { 2597 /* XXX kludge for pf_main_ruleset */ 2598 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors) 2599 if (anchor->parent == NULL && nr++ == pr->nr) { 2600 strlcpy(pr->name, anchor->name, 2601 sizeof(pr->name)); 2602 break; 2603 } 2604 } else { 2605 RB_FOREACH(anchor, pf_anchor_node, 2606 &ruleset->anchor->children) 2607 if (nr++ == pr->nr) { 2608 strlcpy(pr->name, anchor->name, 2609 sizeof(pr->name)); 2610 break; 2611 } 2612 } 2613 if (!pr->name[0]) 2614 error = EBUSY; 2615 break; 2616 } 2617 2618 case DIOCRCLRTABLES: { 2619 struct pfioc_table *io = (struct pfioc_table *)addr; 2620 2621 if (io->pfrio_esize != 0) { 2622 error = ENODEV; 2623 break; 2624 } 2625 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2626 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2627 break; 2628 } 2629 2630 case DIOCRADDTABLES: { 2631 struct pfioc_table *io = (struct pfioc_table *)addr; 2632 2633 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2634 error = ENODEV; 2635 break; 2636 } 2637 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size, 2638 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2639 break; 2640 } 2641 2642 case DIOCRDELTABLES: { 2643 struct pfioc_table *io = (struct pfioc_table *)addr; 2644 2645 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2646 error = ENODEV; 2647 break; 2648 } 2649 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size, 2650 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2651 break; 2652 } 2653 2654 case DIOCRGETTABLES: { 2655 struct pfioc_table *io = (struct pfioc_table *)addr; 2656 2657 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2658 error = ENODEV; 2659 break; 2660 } 2661 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer, 2662 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2663 break; 2664 } 2665 2666 case DIOCRGETTSTATS: { 2667 struct pfioc_table *io = (struct pfioc_table *)addr; 2668 2669 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2670 error = ENODEV; 2671 break; 2672 } 2673 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer, 2674 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2675 break; 2676 } 2677 2678 case DIOCRCLRTSTATS: { 2679 struct pfioc_table *io = (struct pfioc_table *)addr; 2680 2681 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2682 error = ENODEV; 2683 break; 2684 } 2685 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size, 2686 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2687 break; 2688 } 2689 2690 case DIOCRSETTFLAGS: { 2691 struct pfioc_table *io = (struct pfioc_table *)addr; 2692 2693 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2694 error = ENODEV; 2695 break; 2696 } 2697 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size, 2698 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2699 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2700 break; 2701 } 2702 2703 case DIOCRCLRADDRS: { 2704 struct pfioc_table *io = (struct pfioc_table *)addr; 2705 2706 if (io->pfrio_esize != 0) { 2707 error = ENODEV; 2708 break; 2709 } 2710 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2711 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2712 break; 2713 } 2714 2715 case DIOCRADDADDRS: { 2716 struct pfioc_table *io = (struct pfioc_table *)addr; 2717 2718 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2719 error = ENODEV; 2720 break; 2721 } 2722 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer, 2723 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2724 PFR_FLAG_USERIOCTL); 2725 break; 2726 } 2727 2728 case DIOCRDELADDRS: { 2729 struct pfioc_table *io = (struct pfioc_table *)addr; 2730 2731 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2732 error = ENODEV; 2733 break; 2734 } 2735 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer, 2736 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2737 PFR_FLAG_USERIOCTL); 2738 break; 2739 } 2740 2741 case DIOCRSETADDRS: { 2742 struct pfioc_table *io = (struct pfioc_table *)addr; 2743 2744 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2745 error = ENODEV; 2746 break; 2747 } 2748 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer, 2749 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2750 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2751 PFR_FLAG_USERIOCTL, 0); 2752 break; 2753 } 2754 2755 case DIOCRGETADDRS: { 2756 struct pfioc_table *io = (struct pfioc_table *)addr; 2757 2758 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2759 error = ENODEV; 2760 break; 2761 } 2762 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer, 2763 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2764 break; 2765 } 2766 2767 case DIOCRGETASTATS: { 2768 struct pfioc_table *io = (struct pfioc_table *)addr; 2769 2770 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2771 error = ENODEV; 2772 break; 2773 } 2774 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer, 2775 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2776 break; 2777 } 2778 2779 case DIOCRCLRASTATS: { 2780 struct pfioc_table *io = (struct pfioc_table *)addr; 2781 2782 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2783 error = ENODEV; 2784 break; 2785 } 2786 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer, 2787 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2788 PFR_FLAG_USERIOCTL); 2789 break; 2790 } 2791 2792 case DIOCRTSTADDRS: { 2793 struct pfioc_table *io = (struct pfioc_table *)addr; 2794 2795 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2796 error = ENODEV; 2797 break; 2798 } 2799 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer, 2800 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2801 PFR_FLAG_USERIOCTL); 2802 break; 2803 } 2804 2805 case DIOCRINADEFINE: { 2806 struct pfioc_table *io = (struct pfioc_table *)addr; 2807 2808 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2809 error = ENODEV; 2810 break; 2811 } 2812 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer, 2813 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2814 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2815 break; 2816 } 2817 2818 case DIOCOSFPADD: { 2819 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2820 error = pf_osfp_add(io); 2821 break; 2822 } 2823 2824 case DIOCOSFPGET: { 2825 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2826 error = pf_osfp_get(io); 2827 break; 2828 } 2829 2830 case DIOCXBEGIN: { 2831 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2832 struct pfioc_trans_e *ioe; 2833 struct pfr_table *table; 2834 int i; 2835 2836 if (io->esize != sizeof(*ioe)) { 2837 error = ENODEV; 2838 goto fail; 2839 } 2840 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2841 M_TEMP, M_WAITOK); 2842 table = (struct pfr_table *)malloc(sizeof(*table), 2843 M_TEMP, M_WAITOK); 2844 for (i = 0; i < io->size; i++) { 2845 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2846 free(table, M_TEMP); 2847 free(ioe, M_TEMP); 2848 error = EFAULT; 2849 goto fail; 2850 } 2851 switch (ioe->rs_num) { 2852 #ifdef ALTQ 2853 case PF_RULESET_ALTQ: 2854 if (ioe->anchor[0]) { 2855 free(table, M_TEMP); 2856 free(ioe, M_TEMP); 2857 error = EINVAL; 2858 goto fail; 2859 } 2860 if ((error = pf_begin_altq(&ioe->ticket))) { 2861 free(table, M_TEMP); 2862 free(ioe, M_TEMP); 2863 goto fail; 2864 } 2865 break; 2866 #endif /* ALTQ */ 2867 case PF_RULESET_TABLE: 2868 bzero(table, sizeof(*table)); 2869 strlcpy(table->pfrt_anchor, ioe->anchor, 2870 sizeof(table->pfrt_anchor)); 2871 if ((error = pfr_ina_begin(table, 2872 &ioe->ticket, NULL, 0))) { 2873 free(table, M_TEMP); 2874 free(ioe, M_TEMP); 2875 goto fail; 2876 } 2877 break; 2878 default: 2879 if ((error = pf_begin_rules(&ioe->ticket, 2880 ioe->rs_num, ioe->anchor))) { 2881 free(table, M_TEMP); 2882 free(ioe, M_TEMP); 2883 goto fail; 2884 } 2885 break; 2886 } 2887 if (copyout(ioe, io->array+i, sizeof(io->array[i]))) { 2888 free(table, M_TEMP); 2889 free(ioe, M_TEMP); 2890 error = EFAULT; 2891 goto fail; 2892 } 2893 } 2894 free(table, M_TEMP); 2895 free(ioe, M_TEMP); 2896 break; 2897 } 2898 2899 case DIOCXROLLBACK: { 2900 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2901 struct pfioc_trans_e *ioe; 2902 struct pfr_table *table; 2903 int i; 2904 2905 if (io->esize != sizeof(*ioe)) { 2906 error = ENODEV; 2907 goto fail; 2908 } 2909 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2910 M_TEMP, M_WAITOK); 2911 table = (struct pfr_table *)malloc(sizeof(*table), 2912 M_TEMP, M_WAITOK); 2913 for (i = 0; i < io->size; i++) { 2914 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2915 free(table, M_TEMP); 2916 free(ioe, M_TEMP); 2917 error = EFAULT; 2918 goto fail; 2919 } 2920 switch (ioe->rs_num) { 2921 #ifdef ALTQ 2922 case PF_RULESET_ALTQ: 2923 if (ioe->anchor[0]) { 2924 free(table, M_TEMP); 2925 free(ioe, M_TEMP); 2926 error = EINVAL; 2927 goto fail; 2928 } 2929 if ((error = pf_rollback_altq(ioe->ticket))) { 2930 free(table, M_TEMP); 2931 free(ioe, M_TEMP); 2932 goto fail; /* really bad */ 2933 } 2934 break; 2935 #endif /* ALTQ */ 2936 case PF_RULESET_TABLE: 2937 bzero(table, sizeof(*table)); 2938 strlcpy(table->pfrt_anchor, ioe->anchor, 2939 sizeof(table->pfrt_anchor)); 2940 if ((error = pfr_ina_rollback(table, 2941 ioe->ticket, NULL, 0))) { 2942 free(table, M_TEMP); 2943 free(ioe, M_TEMP); 2944 goto fail; /* really bad */ 2945 } 2946 break; 2947 default: 2948 if ((error = pf_rollback_rules(ioe->ticket, 2949 ioe->rs_num, ioe->anchor))) { 2950 free(table, M_TEMP); 2951 free(ioe, M_TEMP); 2952 goto fail; /* really bad */ 2953 } 2954 break; 2955 } 2956 } 2957 free(table, M_TEMP); 2958 free(ioe, M_TEMP); 2959 break; 2960 } 2961 2962 case DIOCXCOMMIT: { 2963 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2964 struct pfioc_trans_e *ioe; 2965 struct pfr_table *table; 2966 struct pf_ruleset *rs; 2967 int i; 2968 2969 if (io->esize != sizeof(*ioe)) { 2970 error = ENODEV; 2971 goto fail; 2972 } 2973 ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe), 2974 M_TEMP, M_WAITOK); 2975 table = (struct pfr_table *)malloc(sizeof(*table), 2976 M_TEMP, M_WAITOK); 2977 /* first makes sure everything will succeed */ 2978 for (i = 0; i < io->size; i++) { 2979 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 2980 free(table, M_TEMP); 2981 free(ioe, M_TEMP); 2982 error = EFAULT; 2983 goto fail; 2984 } 2985 switch (ioe->rs_num) { 2986 #ifdef ALTQ 2987 case PF_RULESET_ALTQ: 2988 if (ioe->anchor[0]) { 2989 free(table, M_TEMP); 2990 free(ioe, M_TEMP); 2991 error = EINVAL; 2992 goto fail; 2993 } 2994 if (!altqs_inactive_open || ioe->ticket != 2995 ticket_altqs_inactive) { 2996 free(table, M_TEMP); 2997 free(ioe, M_TEMP); 2998 error = EBUSY; 2999 goto fail; 3000 } 3001 break; 3002 #endif /* ALTQ */ 3003 case PF_RULESET_TABLE: 3004 rs = pf_find_ruleset(ioe->anchor); 3005 if (rs == NULL || !rs->topen || ioe->ticket != 3006 rs->tticket) { 3007 free(table, M_TEMP); 3008 free(ioe, M_TEMP); 3009 error = EBUSY; 3010 goto fail; 3011 } 3012 break; 3013 default: 3014 if (ioe->rs_num < 0 || ioe->rs_num >= 3015 PF_RULESET_MAX) { 3016 free(table, M_TEMP); 3017 free(ioe, M_TEMP); 3018 error = EINVAL; 3019 goto fail; 3020 } 3021 rs = pf_find_ruleset(ioe->anchor); 3022 if (rs == NULL || 3023 !rs->rules[ioe->rs_num].inactive.open || 3024 rs->rules[ioe->rs_num].inactive.ticket != 3025 ioe->ticket) { 3026 free(table, M_TEMP); 3027 free(ioe, M_TEMP); 3028 error = EBUSY; 3029 goto fail; 3030 } 3031 break; 3032 } 3033 } 3034 /* now do the commit - no errors should happen here */ 3035 for (i = 0; i < io->size; i++) { 3036 if (copyin(io->array+i, ioe, sizeof(*ioe))) { 3037 free(table, M_TEMP); 3038 free(ioe, M_TEMP); 3039 error = EFAULT; 3040 goto fail; 3041 } 3042 switch (ioe->rs_num) { 3043 #ifdef ALTQ 3044 case PF_RULESET_ALTQ: 3045 if ((error = pf_commit_altq(ioe->ticket))) { 3046 free(table, M_TEMP); 3047 free(ioe, M_TEMP); 3048 goto fail; /* really bad */ 3049 } 3050 break; 3051 #endif /* ALTQ */ 3052 case PF_RULESET_TABLE: 3053 bzero(table, sizeof(*table)); 3054 strlcpy(table->pfrt_anchor, ioe->anchor, 3055 sizeof(table->pfrt_anchor)); 3056 if ((error = pfr_ina_commit(table, ioe->ticket, 3057 NULL, NULL, 0))) { 3058 free(table, M_TEMP); 3059 free(ioe, M_TEMP); 3060 goto fail; /* really bad */ 3061 } 3062 break; 3063 default: 3064 if ((error = pf_commit_rules(ioe->ticket, 3065 ioe->rs_num, ioe->anchor))) { 3066 free(table, M_TEMP); 3067 free(ioe, M_TEMP); 3068 goto fail; /* really bad */ 3069 } 3070 break; 3071 } 3072 } 3073 free(table, M_TEMP); 3074 free(ioe, M_TEMP); 3075 break; 3076 } 3077 3078 case DIOCGETSRCNODES: { 3079 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 3080 struct pf_src_node *n, *p, *pstore; 3081 u_int32_t nr = 0; 3082 int space = psn->psn_len; 3083 3084 if (space == 0) { 3085 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) 3086 nr++; 3087 psn->psn_len = sizeof(struct pf_src_node) * nr; 3088 break; 3089 } 3090 3091 pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK); 3092 3093 p = psn->psn_src_nodes; 3094 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 3095 int secs = time_second, diff; 3096 3097 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 3098 break; 3099 3100 bcopy(n, pstore, sizeof(*pstore)); 3101 if (n->rule.ptr != NULL) 3102 pstore->rule.nr = n->rule.ptr->nr; 3103 pstore->creation = secs - pstore->creation; 3104 if (pstore->expire > secs) 3105 pstore->expire -= secs; 3106 else 3107 pstore->expire = 0; 3108 3109 /* adjust the connection rate estimate */ 3110 diff = secs - n->conn_rate.last; 3111 if (diff >= n->conn_rate.seconds) 3112 pstore->conn_rate.count = 0; 3113 else 3114 pstore->conn_rate.count -= 3115 n->conn_rate.count * diff / 3116 n->conn_rate.seconds; 3117 3118 error = copyout(pstore, p, sizeof(*p)); 3119 if (error) { 3120 free(pstore, M_TEMP); 3121 goto fail; 3122 } 3123 p++; 3124 nr++; 3125 } 3126 psn->psn_len = sizeof(struct pf_src_node) * nr; 3127 3128 free(pstore, M_TEMP); 3129 break; 3130 } 3131 3132 case DIOCCLRSRCNODES: { 3133 struct pf_src_node *n; 3134 struct pf_state *state; 3135 3136 RB_FOREACH(state, pf_state_tree_id, &tree_id) { 3137 state->src_node = NULL; 3138 state->nat_src_node = NULL; 3139 } 3140 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) { 3141 n->expire = 1; 3142 n->states = 0; 3143 } 3144 pf_purge_expired_src_nodes(1); 3145 pf_status.src_nodes = 0; 3146 break; 3147 } 3148 3149 case DIOCKILLSRCNODES: { 3150 struct pf_src_node *sn; 3151 struct pf_state *ps; 3152 struct pfioc_src_node_kill *psnk = \ 3153 (struct pfioc_src_node_kill *) addr; 3154 int killed = 0; 3155 3156 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) { 3157 if (PF_MATCHA(psnk->psnk_src.neg, \ 3158 &psnk->psnk_src.addr.v.a.addr, \ 3159 &psnk->psnk_src.addr.v.a.mask, \ 3160 &sn->addr, sn->af) && 3161 PF_MATCHA(psnk->psnk_dst.neg, \ 3162 &psnk->psnk_dst.addr.v.a.addr, \ 3163 &psnk->psnk_dst.addr.v.a.mask, \ 3164 &sn->raddr, sn->af)) { 3165 /* Handle state to src_node linkage */ 3166 if (sn->states != 0) { 3167 RB_FOREACH(ps, pf_state_tree_id, 3168 &tree_id) { 3169 if (ps->src_node == sn) 3170 ps->src_node = NULL; 3171 if (ps->nat_src_node == sn) 3172 ps->nat_src_node = NULL; 3173 } 3174 sn->states = 0; 3175 } 3176 sn->expire = 1; 3177 killed++; 3178 } 3179 } 3180 3181 if (killed > 0) 3182 pf_purge_expired_src_nodes(1); 3183 3184 psnk->psnk_af = killed; 3185 break; 3186 } 3187 3188 case DIOCSETHOSTID: { 3189 u_int32_t *hid = (u_int32_t *)addr; 3190 3191 if (*hid == 0) 3192 pf_status.hostid = cprng_fast32(); 3193 else 3194 pf_status.hostid = *hid; 3195 break; 3196 } 3197 3198 case DIOCOSFPFLUSH: 3199 pf_osfp_flush(); 3200 break; 3201 3202 case DIOCIGETIFACES: { 3203 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3204 3205 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 3206 error = ENODEV; 3207 break; 3208 } 3209 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer, 3210 &io->pfiio_size); 3211 break; 3212 } 3213 3214 case DIOCSETIFFLAG: { 3215 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3216 3217 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 3218 break; 3219 } 3220 3221 case DIOCCLRIFFLAG: { 3222 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3223 3224 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 3225 break; 3226 } 3227 3228 case DIOCSETLCK: { 3229 pf_state_lock = *(uint32_t*)addr; 3230 break; 3231 } 3232 3233 default: 3234 error = ENODEV; 3235 break; 3236 } 3237 fail: 3238 splx(s); 3239 if (flags & FWRITE) 3240 rw_exit_write(&pf_consistency_lock); 3241 else 3242 rw_exit_read(&pf_consistency_lock); 3243 return (error); 3244 } 3245 3246 #ifdef __NetBSD__ 3247 #ifdef INET 3248 static int 3249 pfil4_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3250 { 3251 int error; 3252 3253 /* 3254 * ensure that mbufs are writable beforehand 3255 * as it's assumed by pf code. 3256 * ip hdr (60 bytes) + tcp hdr (60 bytes) should be enough. 3257 * XXX inefficient 3258 */ 3259 error = m_makewritable(mp, 0, 60 + 60, M_DONTWAIT); 3260 if (error) { 3261 m_freem(*mp); 3262 *mp = NULL; 3263 return error; 3264 } 3265 3266 /* 3267 * If the packet is out-bound, we can't delay checksums 3268 * here. For in-bound, the checksum has already been 3269 * validated. 3270 */ 3271 if (dir == PFIL_OUT) { 3272 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv4|M_CSUM_UDPv4)) { 3273 in_delayed_cksum(*mp); 3274 (*mp)->m_pkthdr.csum_flags &= 3275 ~(M_CSUM_TCPv4|M_CSUM_UDPv4); 3276 } 3277 } 3278 3279 if (pf_test(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3280 != PF_PASS) { 3281 m_freem(*mp); 3282 *mp = NULL; 3283 return EHOSTUNREACH; 3284 } 3285 3286 /* 3287 * we're not compatible with fast-forward. 3288 */ 3289 3290 if (dir == PFIL_IN && *mp) { 3291 (*mp)->m_flags &= ~M_CANFASTFWD; 3292 } 3293 3294 return (0); 3295 } 3296 #endif /* INET */ 3297 3298 #ifdef INET6 3299 static int 3300 pfil6_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir) 3301 { 3302 int error; 3303 3304 /* 3305 * ensure that mbufs are writable beforehand 3306 * as it's assumed by pf code. 3307 * XXX inefficient 3308 */ 3309 error = m_makewritable(mp, 0, M_COPYALL, M_DONTWAIT); 3310 if (error) { 3311 m_freem(*mp); 3312 *mp = NULL; 3313 return error; 3314 } 3315 3316 /* 3317 * If the packet is out-bound, we can't delay checksums 3318 * here. For in-bound, the checksum has already been 3319 * validated. 3320 */ 3321 if (dir == PFIL_OUT) { 3322 if ((*mp)->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) { 3323 in6_delayed_cksum(*mp); 3324 (*mp)->m_pkthdr.csum_flags &= 3325 ~(M_CSUM_TCPv6|M_CSUM_UDPv6); 3326 } 3327 } 3328 3329 if (pf_test6(dir == PFIL_OUT ? PF_OUT : PF_IN, ifp, mp, NULL) 3330 != PF_PASS) { 3331 m_freem(*mp); 3332 *mp = NULL; 3333 return EHOSTUNREACH; 3334 } else 3335 return (0); 3336 } 3337 #endif /* INET6 */ 3338 3339 static int 3340 pf_pfil_attach(void) 3341 { 3342 pfil_head_t *ph_inet; 3343 #ifdef INET6 3344 pfil_head_t *ph_inet6; 3345 #endif /* INET6 */ 3346 int error; 3347 3348 if (pf_pfil_attached) 3349 return (EBUSY); 3350 3351 ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 3352 if (ph_inet) 3353 error = pfil_add_hook((void *)pfil4_wrapper, NULL, 3354 PFIL_IN|PFIL_OUT, ph_inet); 3355 else 3356 error = ENOENT; 3357 if (error) 3358 return (error); 3359 3360 #ifdef INET6 3361 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 3362 if (ph_inet6) 3363 error = pfil_add_hook((void *)pfil6_wrapper, NULL, 3364 PFIL_IN|PFIL_OUT, ph_inet6); 3365 else 3366 error = ENOENT; 3367 if (error) 3368 goto bad; 3369 #endif /* INET6 */ 3370 3371 pf_pfil_attached = 1; 3372 3373 return (0); 3374 3375 #ifdef INET6 3376 bad: 3377 pfil_remove_hook(pfil4_wrapper, NULL, PFIL_IN|PFIL_OUT, ph_inet); 3378 #endif /* INET6 */ 3379 3380 return (error); 3381 } 3382 3383 static int 3384 pf_pfil_detach(void) 3385 { 3386 pfil_head_t *ph_inet; 3387 #ifdef INET6 3388 pfil_head_t *ph_inet6; 3389 #endif /* INET6 */ 3390 3391 if (pf_pfil_attached == 0) 3392 return (EBUSY); 3393 3394 ph_inet = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET); 3395 if (ph_inet) 3396 pfil_remove_hook((void *)pfil4_wrapper, NULL, 3397 PFIL_IN|PFIL_OUT, ph_inet); 3398 #ifdef INET6 3399 ph_inet6 = pfil_head_get(PFIL_TYPE_AF, (void *)AF_INET6); 3400 if (ph_inet6) 3401 pfil_remove_hook((void *)pfil6_wrapper, NULL, 3402 PFIL_IN|PFIL_OUT, ph_inet6); 3403 #endif /* INET6 */ 3404 pf_pfil_attached = 0; 3405 3406 return (0); 3407 } 3408 #endif /* __NetBSD__ */ 3409 3410 #if defined(__NetBSD__) 3411 MODULE(MODULE_CLASS_DRIVER, pf, "bpf"); 3412 3413 static int 3414 pf_modcmd(modcmd_t cmd, void *opaque) 3415 { 3416 #ifdef _MODULE 3417 extern void pflogattach(int); 3418 extern void pflogdetach(void); 3419 3420 devmajor_t cmajor = NODEVMAJOR, bmajor = NODEVMAJOR; 3421 int err; 3422 3423 switch (cmd) { 3424 case MODULE_CMD_INIT: 3425 err = devsw_attach("pf", NULL, &bmajor, &pf_cdevsw, &cmajor); 3426 if (err) 3427 return err; 3428 pfattach(1); 3429 pflogattach(1); 3430 return 0; 3431 case MODULE_CMD_FINI: 3432 if (pf_status.running) { 3433 return EBUSY; 3434 } else { 3435 pfdetach(); 3436 pflogdetach(); 3437 return devsw_detach(NULL, &pf_cdevsw); 3438 } 3439 default: 3440 return ENOTTY; 3441 } 3442 #else 3443 if (cmd == MODULE_CMD_INIT) 3444 return 0; 3445 return ENOTTY; 3446 #endif 3447 } 3448 #endif 3449
Indexes created Thu Oct 02 14:10:14 GMT 2025