1 | /* |
2 | * Copyright (c) 2007-2016 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: pf_if.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */ |
30 | /* $OpenBSD: pf_if.c,v 1.46 2006/12/13 09:01:59 itojun Exp $ */ |
31 | |
32 | /* |
33 | * Copyright 2005 Henning Brauer <henning@openbsd.org> |
34 | * Copyright 2005 Ryan McBride <mcbride@openbsd.org> |
35 | * Copyright (c) 2001 Daniel Hartmeier |
36 | * Copyright (c) 2003 Cedric Berger |
37 | * All rights reserved. |
38 | * |
39 | * Redistribution and use in source and binary forms, with or without |
40 | * modification, are permitted provided that the following conditions |
41 | * are met: |
42 | * |
43 | * - Redistributions of source code must retain the above copyright |
44 | * notice, this list of conditions and the following disclaimer. |
45 | * - Redistributions in binary form must reproduce the above |
46 | * copyright notice, this list of conditions and the following |
47 | * disclaimer in the documentation and/or other materials provided |
48 | * with the distribution. |
49 | * |
50 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
51 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
52 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
53 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
54 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
55 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
56 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
57 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
58 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
59 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
60 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
61 | * POSSIBILITY OF SUCH DAMAGE. |
62 | */ |
63 | |
64 | #include <sys/param.h> |
65 | #include <sys/systm.h> |
66 | #include <sys/mbuf.h> |
67 | #include <sys/filio.h> |
68 | #include <sys/socket.h> |
69 | #include <sys/socketvar.h> |
70 | #include <sys/kernel.h> |
71 | #include <sys/time.h> |
72 | #include <sys/malloc.h> |
73 | |
74 | #include <net/if.h> |
75 | #include <net/if_types.h> |
76 | #include <net/if_var.h> |
77 | |
78 | #include <netinet/in.h> |
79 | #include <netinet/in_var.h> |
80 | #include <netinet/in_systm.h> |
81 | #include <netinet/ip.h> |
82 | #include <netinet/ip_var.h> |
83 | |
84 | #if INET6 |
85 | #include <netinet/ip6.h> |
86 | #endif /* INET6 */ |
87 | |
88 | #include <net/pfvar.h> |
89 | |
90 | struct pfi_kif *pfi_all = NULL; |
91 | |
92 | static struct pool pfi_addr_pl; |
93 | static struct pfi_ifhead pfi_ifs; |
94 | static u_int32_t pfi_update = 1; |
95 | static struct pfr_addr *pfi_buffer; |
96 | static int pfi_buffer_cnt; |
97 | static int pfi_buffer_max; |
98 | |
99 | __private_extern__ void pfi_kifaddr_update(void *); |
100 | |
101 | static void pfi_kif_update(struct pfi_kif *); |
102 | static void pfi_dynaddr_update(struct pfi_dynaddr *dyn); |
103 | static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, int, int); |
104 | static void pfi_instance_add(struct ifnet *, int, int); |
105 | static void pfi_address_add(struct sockaddr *, int, int); |
106 | static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); |
107 | static int pfi_skip_if(const char *, struct pfi_kif *); |
108 | static int pfi_unmask(void *); |
109 | |
110 | RB_PROTOTYPE_SC(static, pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); |
111 | RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); |
112 | |
113 | #define PFI_BUFFER_MAX 0x10000 |
114 | #define PFI_MTYPE M_IFADDR |
115 | |
116 | #define IFG_ALL "ALL" |
117 | |
118 | void |
119 | pfi_initialize(void) |
120 | { |
121 | if (pfi_all != NULL) /* already initialized */ |
122 | return; |
123 | |
124 | pool_init(&pfi_addr_pl, sizeof (struct pfi_dynaddr), 0, 0, 0, |
125 | "pfiaddrpl" , NULL); |
126 | pfi_buffer_max = 64; |
127 | pfi_buffer = _MALLOC(pfi_buffer_max * sizeof (*pfi_buffer), |
128 | PFI_MTYPE, M_WAITOK); |
129 | |
130 | if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL) |
131 | panic("pfi_kif_get for pfi_all failed" ); |
132 | } |
133 | |
134 | #if 0 |
135 | void |
136 | pfi_destroy(void) |
137 | { |
138 | pool_destroy(&pfi_addr_pl); |
139 | _FREE(pfi_buffer, PFI_MTYPE); |
140 | } |
141 | #endif |
142 | |
143 | struct pfi_kif * |
144 | pfi_kif_get(const char *kif_name) |
145 | { |
146 | struct pfi_kif *kif; |
147 | struct pfi_kif_cmp s; |
148 | |
149 | bzero(&s, sizeof (s)); |
150 | strlcpy(s.pfik_name, kif_name, sizeof (s.pfik_name)); |
151 | if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, |
152 | (struct pfi_kif *)(void *)&s)) != NULL) |
153 | return (kif); |
154 | |
155 | /* create new one */ |
156 | if ((kif = _MALLOC(sizeof (*kif), PFI_MTYPE, M_WAITOK|M_ZERO)) == NULL) |
157 | return (NULL); |
158 | |
159 | strlcpy(kif->pfik_name, kif_name, sizeof (kif->pfik_name)); |
160 | kif->pfik_tzero = pf_calendar_time_second(); |
161 | TAILQ_INIT(&kif->pfik_dynaddrs); |
162 | |
163 | RB_INSERT(pfi_ifhead, &pfi_ifs, kif); |
164 | return (kif); |
165 | } |
166 | |
167 | void |
168 | pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what) |
169 | { |
170 | switch (what) { |
171 | case PFI_KIF_REF_RULE: |
172 | kif->pfik_rules++; |
173 | break; |
174 | case PFI_KIF_REF_STATE: |
175 | kif->pfik_states++; |
176 | break; |
177 | default: |
178 | panic("pfi_kif_ref with unknown type" ); |
179 | } |
180 | } |
181 | |
182 | void |
183 | pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what) |
184 | { |
185 | if (kif == NULL) |
186 | return; |
187 | |
188 | switch (what) { |
189 | case PFI_KIF_REF_NONE: |
190 | break; |
191 | case PFI_KIF_REF_RULE: |
192 | if (kif->pfik_rules <= 0) { |
193 | printf("pfi_kif_unref: rules refcount <= 0\n" ); |
194 | return; |
195 | } |
196 | kif->pfik_rules--; |
197 | break; |
198 | case PFI_KIF_REF_STATE: |
199 | if (kif->pfik_states <= 0) { |
200 | printf("pfi_kif_unref: state refcount <= 0\n" ); |
201 | return; |
202 | } |
203 | kif->pfik_states--; |
204 | break; |
205 | default: |
206 | panic("pfi_kif_unref with unknown type" ); |
207 | } |
208 | |
209 | if (kif->pfik_ifp != NULL || kif == pfi_all) |
210 | return; |
211 | |
212 | if (kif->pfik_rules || kif->pfik_states) |
213 | return; |
214 | |
215 | RB_REMOVE(pfi_ifhead, &pfi_ifs, kif); |
216 | _FREE(kif, PFI_MTYPE); |
217 | } |
218 | |
219 | int |
220 | pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif) |
221 | { |
222 | |
223 | if (rule_kif == NULL || rule_kif == packet_kif) |
224 | return (1); |
225 | |
226 | return (0); |
227 | } |
228 | |
229 | void |
230 | pfi_attach_ifnet(struct ifnet *ifp) |
231 | { |
232 | struct pfi_kif *kif; |
233 | |
234 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
235 | |
236 | pfi_update++; |
237 | if ((kif = pfi_kif_get(if_name(ifp))) == NULL) |
238 | panic("pfi_kif_get failed" ); |
239 | |
240 | ifnet_lock_exclusive(ifp); |
241 | kif->pfik_ifp = ifp; |
242 | ifp->if_pf_kif = kif; |
243 | ifnet_lock_done(ifp); |
244 | |
245 | pfi_kif_update(kif); |
246 | } |
247 | |
248 | /* |
249 | * Caller holds ifnet lock as writer (exclusive); |
250 | */ |
251 | void |
252 | pfi_detach_ifnet(struct ifnet *ifp) |
253 | { |
254 | struct pfi_kif *kif; |
255 | |
256 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
257 | |
258 | if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL) |
259 | return; |
260 | |
261 | pfi_update++; |
262 | pfi_kif_update(kif); |
263 | |
264 | ifnet_lock_exclusive(ifp); |
265 | kif->pfik_ifp = NULL; |
266 | ifp->if_pf_kif = NULL; |
267 | ifnet_lock_done(ifp); |
268 | |
269 | pfi_kif_unref(kif, PFI_KIF_REF_NONE); |
270 | } |
271 | |
272 | int |
273 | pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) |
274 | { |
275 | switch (af) { |
276 | #if INET |
277 | case AF_INET: |
278 | switch (dyn->pfid_acnt4) { |
279 | case 0: |
280 | return (0); |
281 | case 1: |
282 | return (PF_MATCHA(0, &dyn->pfid_addr4, |
283 | &dyn->pfid_mask4, a, AF_INET)); |
284 | default: |
285 | return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); |
286 | } |
287 | #endif /* INET */ |
288 | #if INET6 |
289 | case AF_INET6: |
290 | switch (dyn->pfid_acnt6) { |
291 | case 0: |
292 | return (0); |
293 | case 1: |
294 | return (PF_MATCHA(0, &dyn->pfid_addr6, |
295 | &dyn->pfid_mask6, a, AF_INET6)); |
296 | default: |
297 | return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); |
298 | } |
299 | #endif /* INET6 */ |
300 | default: |
301 | return (0); |
302 | } |
303 | } |
304 | |
305 | int |
306 | pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) |
307 | { |
308 | struct pfi_dynaddr *dyn; |
309 | char tblname[PF_TABLE_NAME_SIZE]; |
310 | struct pf_ruleset *ruleset = NULL; |
311 | int rv = 0; |
312 | |
313 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
314 | |
315 | if (aw->type != PF_ADDR_DYNIFTL) |
316 | return (0); |
317 | if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK)) == NULL) |
318 | return (1); |
319 | bzero(dyn, sizeof (*dyn)); |
320 | |
321 | if (strcmp(aw->v.ifname, "self" ) == 0) |
322 | dyn->pfid_kif = pfi_kif_get(IFG_ALL); |
323 | else |
324 | dyn->pfid_kif = pfi_kif_get(aw->v.ifname); |
325 | if (dyn->pfid_kif == NULL) { |
326 | rv = 1; |
327 | goto _bad; |
328 | } |
329 | pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE); |
330 | |
331 | dyn->pfid_net = pfi_unmask(&aw->v.a.mask); |
332 | if (af == AF_INET && dyn->pfid_net == 32) |
333 | dyn->pfid_net = 128; |
334 | strlcpy(tblname, aw->v.ifname, sizeof (tblname)); |
335 | if (aw->iflags & PFI_AFLAG_NETWORK) |
336 | strlcat(tblname, ":network" , sizeof (tblname)); |
337 | if (aw->iflags & PFI_AFLAG_BROADCAST) |
338 | strlcat(tblname, ":broadcast" , sizeof (tblname)); |
339 | if (aw->iflags & PFI_AFLAG_PEER) |
340 | strlcat(tblname, ":peer" , sizeof (tblname)); |
341 | if (aw->iflags & PFI_AFLAG_NOALIAS) |
342 | strlcat(tblname, ":0" , sizeof (tblname)); |
343 | if (dyn->pfid_net != 128) |
344 | snprintf(tblname + strlen(tblname), |
345 | sizeof (tblname) - strlen(tblname), "/%d" , dyn->pfid_net); |
346 | if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) { |
347 | rv = 1; |
348 | goto _bad; |
349 | } |
350 | |
351 | if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) { |
352 | rv = 1; |
353 | goto _bad; |
354 | } |
355 | |
356 | dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; |
357 | dyn->pfid_iflags = aw->iflags; |
358 | dyn->pfid_af = af; |
359 | |
360 | TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); |
361 | aw->p.dyn = dyn; |
362 | pfi_kif_update(dyn->pfid_kif); |
363 | return (0); |
364 | |
365 | _bad: |
366 | if (dyn->pfid_kt != NULL) |
367 | pfr_detach_table(dyn->pfid_kt); |
368 | if (ruleset != NULL) |
369 | pf_remove_if_empty_ruleset(ruleset); |
370 | if (dyn->pfid_kif != NULL) |
371 | pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE); |
372 | pool_put(&pfi_addr_pl, dyn); |
373 | return (rv); |
374 | } |
375 | |
376 | void |
377 | pfi_kif_update(struct pfi_kif *kif) |
378 | { |
379 | struct pfi_dynaddr *p; |
380 | |
381 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
382 | |
383 | /* update all dynaddr */ |
384 | TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) |
385 | pfi_dynaddr_update(p); |
386 | } |
387 | |
388 | void |
389 | pfi_dynaddr_update(struct pfi_dynaddr *dyn) |
390 | { |
391 | struct pfi_kif *kif; |
392 | struct pfr_ktable *kt; |
393 | |
394 | if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) |
395 | panic("pfi_dynaddr_update" ); |
396 | |
397 | kif = dyn->pfid_kif; |
398 | kt = dyn->pfid_kt; |
399 | |
400 | if (kt->pfrkt_larg != pfi_update) { |
401 | /* this table needs to be brought up-to-date */ |
402 | pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); |
403 | kt->pfrkt_larg = pfi_update; |
404 | } |
405 | pfr_dynaddr_update(kt, dyn); |
406 | } |
407 | |
408 | void |
409 | pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) |
410 | { |
411 | int e, size2 = 0; |
412 | |
413 | pfi_buffer_cnt = 0; |
414 | |
415 | if (kif->pfik_ifp != NULL) |
416 | pfi_instance_add(kif->pfik_ifp, net, flags); |
417 | |
418 | if ((e = pfr_set_addrs(&kt->pfrkt_t, CAST_USER_ADDR_T(pfi_buffer), |
419 | pfi_buffer_cnt, &size2, NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) |
420 | printf("pfi_table_update: cannot set %d new addresses " |
421 | "into table %s: %d\n" , pfi_buffer_cnt, kt->pfrkt_name, e); |
422 | } |
423 | |
424 | void |
425 | pfi_instance_add(struct ifnet *ifp, int net, int flags) |
426 | { |
427 | struct ifaddr *ia; |
428 | int got4 = 0, got6 = 0; |
429 | int net2, af; |
430 | |
431 | if (ifp == NULL) |
432 | return; |
433 | ifnet_lock_shared(ifp); |
434 | TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) { |
435 | IFA_LOCK(ia); |
436 | if (ia->ifa_addr == NULL) { |
437 | IFA_UNLOCK(ia); |
438 | continue; |
439 | } |
440 | af = ia->ifa_addr->sa_family; |
441 | if (af != AF_INET && af != AF_INET6) { |
442 | IFA_UNLOCK(ia); |
443 | continue; |
444 | } |
445 | if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) { |
446 | IFA_UNLOCK(ia); |
447 | continue; |
448 | } |
449 | if ((flags & PFI_AFLAG_BROADCAST) && |
450 | !(ifp->if_flags & IFF_BROADCAST)) { |
451 | IFA_UNLOCK(ia); |
452 | continue; |
453 | } |
454 | if ((flags & PFI_AFLAG_PEER) && |
455 | !(ifp->if_flags & IFF_POINTOPOINT)) { |
456 | IFA_UNLOCK(ia); |
457 | continue; |
458 | } |
459 | if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && |
460 | IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) |
461 | (void *)ia->ifa_addr)->sin6_addr)) { |
462 | IFA_UNLOCK(ia); |
463 | continue; |
464 | } |
465 | if (flags & PFI_AFLAG_NOALIAS) { |
466 | if (af == AF_INET && got4) { |
467 | IFA_UNLOCK(ia); |
468 | continue; |
469 | } |
470 | if (af == AF_INET6 && got6) { |
471 | IFA_UNLOCK(ia); |
472 | continue; |
473 | } |
474 | } |
475 | if (af == AF_INET) |
476 | got4 = 1; |
477 | else if (af == AF_INET6) |
478 | got6 = 1; |
479 | net2 = net; |
480 | if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { |
481 | if (af == AF_INET) |
482 | net2 = pfi_unmask(&((struct sockaddr_in *) |
483 | (void *)ia->ifa_netmask)->sin_addr); |
484 | else if (af == AF_INET6) |
485 | net2 = pfi_unmask(&((struct sockaddr_in6 *) |
486 | (void *)ia->ifa_netmask)->sin6_addr); |
487 | } |
488 | if (af == AF_INET && net2 > 32) |
489 | net2 = 32; |
490 | if (flags & PFI_AFLAG_BROADCAST) |
491 | pfi_address_add(ia->ifa_broadaddr, af, net2); |
492 | else if (flags & PFI_AFLAG_PEER) |
493 | pfi_address_add(ia->ifa_dstaddr, af, net2); |
494 | else |
495 | pfi_address_add(ia->ifa_addr, af, net2); |
496 | IFA_UNLOCK(ia); |
497 | } |
498 | ifnet_lock_done(ifp); |
499 | } |
500 | |
501 | void |
502 | pfi_address_add(struct sockaddr *sa, int af, int net) |
503 | { |
504 | struct pfr_addr *p; |
505 | int i; |
506 | |
507 | if (pfi_buffer_cnt >= pfi_buffer_max) { |
508 | int new_max = pfi_buffer_max * 2; |
509 | |
510 | if (new_max > PFI_BUFFER_MAX) { |
511 | printf("pfi_address_add: address buffer full (%d/%d)\n" , |
512 | pfi_buffer_cnt, PFI_BUFFER_MAX); |
513 | return; |
514 | } |
515 | p = _MALLOC(new_max * sizeof (*pfi_buffer), PFI_MTYPE, |
516 | M_WAITOK); |
517 | if (p == NULL) { |
518 | printf("pfi_address_add: no memory to grow buffer " |
519 | "(%d/%d)\n" , pfi_buffer_cnt, PFI_BUFFER_MAX); |
520 | return; |
521 | } |
522 | memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof (*pfi_buffer)); |
523 | /* no need to zero buffer */ |
524 | _FREE(pfi_buffer, PFI_MTYPE); |
525 | pfi_buffer = p; |
526 | pfi_buffer_max = new_max; |
527 | } |
528 | if (af == AF_INET && net > 32) |
529 | net = 128; |
530 | p = pfi_buffer + pfi_buffer_cnt++; |
531 | bzero(p, sizeof (*p)); |
532 | p->pfra_af = af; |
533 | p->pfra_net = net; |
534 | if (af == AF_INET) |
535 | p->pfra_ip4addr = ((struct sockaddr_in *)(void *)sa)->sin_addr; |
536 | else if (af == AF_INET6) { |
537 | p->pfra_ip6addr = |
538 | ((struct sockaddr_in6 *)(void *)sa)->sin6_addr; |
539 | if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) |
540 | p->pfra_ip6addr.s6_addr16[1] = 0; |
541 | } |
542 | /* mask network address bits */ |
543 | if (net < 128) |
544 | ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); |
545 | for (i = (p->pfra_net+7)/8; i < (int)sizeof (p->pfra_u); i++) |
546 | ((caddr_t)p)[i] = 0; |
547 | } |
548 | |
549 | void |
550 | pfi_dynaddr_remove(struct pf_addr_wrap *aw) |
551 | { |
552 | if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || |
553 | aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) |
554 | return; |
555 | |
556 | TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry); |
557 | pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE); |
558 | aw->p.dyn->pfid_kif = NULL; |
559 | pfr_detach_table(aw->p.dyn->pfid_kt); |
560 | aw->p.dyn->pfid_kt = NULL; |
561 | pool_put(&pfi_addr_pl, aw->p.dyn); |
562 | aw->p.dyn = NULL; |
563 | } |
564 | |
565 | void |
566 | pfi_dynaddr_copyout(struct pf_addr_wrap *aw) |
567 | { |
568 | if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || |
569 | aw->p.dyn->pfid_kif == NULL) |
570 | return; |
571 | aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; |
572 | } |
573 | |
574 | void |
575 | pfi_kifaddr_update(void *v) |
576 | { |
577 | struct pfi_kif *kif = (struct pfi_kif *)v; |
578 | |
579 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
580 | |
581 | pfi_update++; |
582 | pfi_kif_update(kif); |
583 | } |
584 | |
585 | int |
586 | pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) |
587 | { |
588 | return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); |
589 | } |
590 | |
591 | void |
592 | pfi_update_status(const char *name, struct pf_status *pfs) |
593 | { |
594 | struct pfi_kif *p; |
595 | struct pfi_kif_cmp key; |
596 | int i, j, k; |
597 | |
598 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
599 | |
600 | strlcpy(key.pfik_name, name, sizeof (key.pfik_name)); |
601 | p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)(void *)&key); |
602 | if (p == NULL) |
603 | return; |
604 | |
605 | if (pfs != NULL) { |
606 | bzero(pfs->pcounters, sizeof (pfs->pcounters)); |
607 | bzero(pfs->bcounters, sizeof (pfs->bcounters)); |
608 | for (i = 0; i < 2; i++) |
609 | for (j = 0; j < 2; j++) |
610 | for (k = 0; k < 2; k++) { |
611 | pfs->pcounters[i][j][k] += |
612 | p->pfik_packets[i][j][k]; |
613 | pfs->bcounters[i][j] += |
614 | p->pfik_bytes[i][j][k]; |
615 | } |
616 | } else { |
617 | /* just clear statistics */ |
618 | bzero(p->pfik_packets, sizeof (p->pfik_packets)); |
619 | bzero(p->pfik_bytes, sizeof (p->pfik_bytes)); |
620 | p->pfik_tzero = pf_calendar_time_second(); |
621 | } |
622 | } |
623 | |
624 | int |
625 | pfi_get_ifaces(const char *name, user_addr_t buf, int *size) |
626 | { |
627 | struct pfi_kif *p, *nextp; |
628 | int n = 0; |
629 | |
630 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
631 | |
632 | for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) { |
633 | nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); |
634 | if (pfi_skip_if(name, p)) |
635 | continue; |
636 | if (*size > n++) { |
637 | struct pfi_uif u; |
638 | |
639 | if (!p->pfik_tzero) |
640 | p->pfik_tzero = pf_calendar_time_second(); |
641 | pfi_kif_ref(p, PFI_KIF_REF_RULE); |
642 | |
643 | /* return the user space version of pfi_kif */ |
644 | bzero(&u, sizeof (u)); |
645 | bcopy(p->pfik_name, &u.pfik_name, sizeof (u.pfik_name)); |
646 | bcopy(p->pfik_packets, &u.pfik_packets, |
647 | sizeof (u.pfik_packets)); |
648 | bcopy(p->pfik_bytes, &u.pfik_bytes, |
649 | sizeof (u.pfik_bytes)); |
650 | u.pfik_tzero = p->pfik_tzero; |
651 | u.pfik_flags = p->pfik_flags; |
652 | u.pfik_states = p->pfik_states; |
653 | u.pfik_rules = p->pfik_rules; |
654 | |
655 | if (copyout(&u, buf, sizeof (u))) { |
656 | pfi_kif_unref(p, PFI_KIF_REF_RULE); |
657 | return (EFAULT); |
658 | } |
659 | buf += sizeof (u); |
660 | nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); |
661 | pfi_kif_unref(p, PFI_KIF_REF_RULE); |
662 | } |
663 | } |
664 | *size = n; |
665 | return (0); |
666 | } |
667 | |
668 | int |
669 | pfi_skip_if(const char *filter, struct pfi_kif *p) |
670 | { |
671 | int n; |
672 | |
673 | if (filter == NULL || !*filter) |
674 | return (0); |
675 | if (strcmp(p->pfik_name, filter) == 0) |
676 | return (0); /* exact match */ |
677 | n = strlen(filter); |
678 | if (n < 1 || n >= IFNAMSIZ) |
679 | return (1); /* sanity check */ |
680 | if (filter[n-1] >= '0' && filter[n-1] <= '9') |
681 | return (1); /* only do exact match in that case */ |
682 | if (strncmp(p->pfik_name, filter, n)) |
683 | return (1); /* prefix doesn't match */ |
684 | return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); |
685 | } |
686 | |
687 | int |
688 | pfi_set_flags(const char *name, int flags) |
689 | { |
690 | struct pfi_kif *p; |
691 | |
692 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
693 | |
694 | RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { |
695 | if (pfi_skip_if(name, p)) |
696 | continue; |
697 | p->pfik_flags |= flags; |
698 | } |
699 | return (0); |
700 | } |
701 | |
702 | int |
703 | pfi_clear_flags(const char *name, int flags) |
704 | { |
705 | struct pfi_kif *p; |
706 | |
707 | LCK_MTX_ASSERT(pf_lock, LCK_MTX_ASSERT_OWNED); |
708 | |
709 | RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { |
710 | if (pfi_skip_if(name, p)) |
711 | continue; |
712 | p->pfik_flags &= ~flags; |
713 | } |
714 | return (0); |
715 | } |
716 | |
717 | /* from pf_print_state.c */ |
718 | int |
719 | pfi_unmask(void *addr) |
720 | { |
721 | struct pf_addr *m = addr; |
722 | int i = 31, j = 0, b = 0; |
723 | u_int32_t tmp; |
724 | |
725 | while (j < 4 && m->addr32[j] == 0xffffffff) { |
726 | b += 32; |
727 | j++; |
728 | } |
729 | if (j < 4) { |
730 | tmp = ntohl(m->addr32[j]); |
731 | for (i = 31; tmp & (1 << i); --i) |
732 | b++; |
733 | } |
734 | return (b); |
735 | } |
736 | |