1 | /* |
2 | * Copyright (c) 2007-2021 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $apfw: pf_if.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */ |
30 | /* $OpenBSD: pf_if.c,v 1.46 2006/12/13 09:01:59 itojun Exp $ */ |
31 | |
32 | /* |
33 | * Copyright 2005 Henning Brauer <henning@openbsd.org> |
34 | * Copyright 2005 Ryan McBride <mcbride@openbsd.org> |
35 | * Copyright (c) 2001 Daniel Hartmeier |
36 | * Copyright (c) 2003 Cedric Berger |
37 | * All rights reserved. |
38 | * |
39 | * Redistribution and use in source and binary forms, with or without |
40 | * modification, are permitted provided that the following conditions |
41 | * are met: |
42 | * |
43 | * - Redistributions of source code must retain the above copyright |
44 | * notice, this list of conditions and the following disclaimer. |
45 | * - Redistributions in binary form must reproduce the above |
46 | * copyright notice, this list of conditions and the following |
47 | * disclaimer in the documentation and/or other materials provided |
48 | * with the distribution. |
49 | * |
50 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
51 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
52 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
53 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE |
54 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, |
55 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
56 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
57 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER |
58 | * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
59 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN |
60 | * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE |
61 | * POSSIBILITY OF SUCH DAMAGE. |
62 | */ |
63 | |
64 | #include <sys/param.h> |
65 | #include <sys/systm.h> |
66 | #include <sys/mbuf.h> |
67 | #include <sys/filio.h> |
68 | #include <sys/socket.h> |
69 | #include <sys/socketvar.h> |
70 | #include <sys/kernel.h> |
71 | #include <sys/time.h> |
72 | #include <sys/malloc.h> |
73 | |
74 | #include <net/if.h> |
75 | #include <net/if_types.h> |
76 | #include <net/if_var.h> |
77 | |
78 | #include <netinet/in.h> |
79 | #include <netinet/in_var.h> |
80 | #include <netinet/in_systm.h> |
81 | #include <netinet/ip.h> |
82 | #include <netinet/ip_var.h> |
83 | |
84 | #include <netinet/ip6.h> |
85 | |
86 | #include <net/pfvar.h> |
87 | |
88 | struct pfi_kif *pfi_all = NULL; |
89 | |
90 | static struct pool pfi_addr_pl; |
91 | static struct pfi_ifhead pfi_ifs; |
92 | static u_int32_t pfi_update = 1; |
93 | static struct pfr_addr *pfi_buffer; |
94 | static int pfi_buffer_cnt; |
95 | static int pfi_buffer_max; |
96 | |
97 | __private_extern__ void pfi_kifaddr_update(void *); |
98 | |
99 | static void pfi_kif_update(struct pfi_kif *); |
100 | static void pfi_dynaddr_update(struct pfi_dynaddr *dyn); |
101 | static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, uint8_t, int); |
102 | static void pfi_instance_add(struct ifnet *, uint8_t, int); |
103 | static void pfi_address_add(struct sockaddr *, uint8_t, uint8_t); |
104 | static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); |
105 | static int pfi_skip_if(const char *, struct pfi_kif *); |
106 | static uint8_t pfi_unmask(void *); |
107 | |
108 | RB_PROTOTYPE_SC(static, pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); |
109 | RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); |
110 | |
111 | #define PFI_BUFFER_MAX 0x10000 |
112 | |
113 | #define IFG_ALL "ALL" |
114 | |
115 | void |
116 | pfi_initialize(void) |
117 | { |
118 | if (pfi_all != NULL) { /* already initialized */ |
119 | return; |
120 | } |
121 | |
122 | pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0, |
123 | "pfiaddrpl" , NULL); |
124 | pfi_buffer_max = 64; |
125 | pfi_buffer = (struct pfr_addr *)kalloc_data(pfi_buffer_max * sizeof(*pfi_buffer), |
126 | Z_WAITOK); |
127 | |
128 | if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL) { |
129 | panic("pfi_kif_get for pfi_all failed" ); |
130 | } |
131 | } |
132 | |
133 | #if 0 |
134 | void |
135 | pfi_destroy(void) |
136 | { |
137 | pool_destroy(&pfi_addr_pl); |
138 | kfree_data(pfi_buffer, pfi_buffer_max * sizeof(*pfi_buffer)); |
139 | } |
140 | #endif |
141 | |
142 | struct pfi_kif * |
143 | pfi_kif_get(const char *kif_name) |
144 | { |
145 | struct pfi_kif *kif; |
146 | struct pfi_kif s; |
147 | |
148 | bzero(s: &s.pfik_name, n: sizeof(s.pfik_name)); |
149 | strlcpy(dst: s.pfik_name, src: kif_name, n: sizeof(s.pfik_name)); |
150 | kif = RB_FIND(pfi_ifhead, &pfi_ifs, &s); |
151 | if (kif != NULL) { |
152 | return kif; |
153 | } |
154 | |
155 | /* create new one */ |
156 | if ((kif = kalloc_type(struct pfi_kif, Z_WAITOK | Z_ZERO)) == NULL) { |
157 | return NULL; |
158 | } |
159 | |
160 | strlcpy(dst: kif->pfik_name, src: kif_name, n: sizeof(kif->pfik_name)); |
161 | kif->pfik_tzero = pf_calendar_time_second(); |
162 | TAILQ_INIT(&kif->pfik_dynaddrs); |
163 | |
164 | RB_INSERT(pfi_ifhead, &pfi_ifs, kif); |
165 | return kif; |
166 | } |
167 | |
168 | void |
169 | pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what) |
170 | { |
171 | switch (what) { |
172 | case PFI_KIF_REF_RULE: |
173 | kif->pfik_rules++; |
174 | break; |
175 | case PFI_KIF_REF_STATE: |
176 | kif->pfik_states++; |
177 | break; |
178 | default: |
179 | panic("pfi_kif_ref with unknown type" ); |
180 | } |
181 | } |
182 | |
183 | void |
184 | pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what) |
185 | { |
186 | if (kif == NULL) { |
187 | return; |
188 | } |
189 | |
190 | switch (what) { |
191 | case PFI_KIF_REF_NONE: |
192 | break; |
193 | case PFI_KIF_REF_RULE: |
194 | if (kif->pfik_rules <= 0) { |
195 | printf("pfi_kif_unref: rules refcount <= 0\n" ); |
196 | return; |
197 | } |
198 | kif->pfik_rules--; |
199 | break; |
200 | case PFI_KIF_REF_STATE: |
201 | if (kif->pfik_states <= 0) { |
202 | printf("pfi_kif_unref: state refcount <= 0\n" ); |
203 | return; |
204 | } |
205 | kif->pfik_states--; |
206 | break; |
207 | default: |
208 | panic("pfi_kif_unref with unknown type" ); |
209 | } |
210 | |
211 | if (kif->pfik_ifp != NULL || kif == pfi_all) { |
212 | return; |
213 | } |
214 | |
215 | if (kif->pfik_rules || kif->pfik_states) { |
216 | return; |
217 | } |
218 | |
219 | RB_REMOVE(pfi_ifhead, &pfi_ifs, kif); |
220 | kfree_type(struct pfi_kif, kif); |
221 | } |
222 | |
223 | int |
224 | pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif) |
225 | { |
226 | if (rule_kif == NULL || rule_kif == packet_kif) { |
227 | return 1; |
228 | } |
229 | |
230 | return 0; |
231 | } |
232 | |
233 | void |
234 | pfi_attach_ifnet(struct ifnet *ifp) |
235 | { |
236 | struct pfi_kif *kif; |
237 | |
238 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
239 | |
240 | pfi_update++; |
241 | if ((kif = pfi_kif_get(if_name(ifp))) == NULL) { |
242 | panic("pfi_kif_get failed" ); |
243 | } |
244 | |
245 | ifnet_lock_exclusive(ifp); |
246 | kif->pfik_ifp = ifp; |
247 | ifp->if_pf_kif = kif; |
248 | ifnet_lock_done(ifp); |
249 | |
250 | pfi_kif_update(kif); |
251 | } |
252 | |
253 | /* |
254 | * Caller holds ifnet lock as writer (exclusive); |
255 | */ |
256 | void |
257 | pfi_detach_ifnet(struct ifnet *ifp) |
258 | { |
259 | struct pfi_kif *kif; |
260 | |
261 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
262 | |
263 | if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL) { |
264 | return; |
265 | } |
266 | |
267 | pfi_update++; |
268 | pfi_kif_update(kif); |
269 | |
270 | ifnet_lock_exclusive(ifp); |
271 | kif->pfik_ifp = NULL; |
272 | ifp->if_pf_kif = NULL; |
273 | ifnet_lock_done(ifp); |
274 | |
275 | pfi_kif_unref(kif, what: PFI_KIF_REF_NONE); |
276 | } |
277 | |
278 | int |
279 | pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) |
280 | { |
281 | switch (af) { |
282 | #if INET |
283 | case AF_INET: |
284 | switch (dyn->pfid_acnt4) { |
285 | case 0: |
286 | return 0; |
287 | case 1: |
288 | return PF_MATCHA(0, &dyn->pfid_addr4, |
289 | &dyn->pfid_mask4, a, AF_INET); |
290 | default: |
291 | return pfr_match_addr(dyn->pfid_kt, a, AF_INET); |
292 | } |
293 | #endif /* INET */ |
294 | case AF_INET6: |
295 | switch (dyn->pfid_acnt6) { |
296 | case 0: |
297 | return 0; |
298 | case 1: |
299 | return PF_MATCHA(0, &dyn->pfid_addr6, |
300 | &dyn->pfid_mask6, a, AF_INET6); |
301 | default: |
302 | return pfr_match_addr(dyn->pfid_kt, a, AF_INET6); |
303 | } |
304 | default: |
305 | return 0; |
306 | } |
307 | } |
308 | |
309 | int |
310 | pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) |
311 | { |
312 | struct pfi_dynaddr *dyn; |
313 | char tblname[PF_TABLE_NAME_SIZE]; |
314 | struct pf_ruleset *ruleset = NULL; |
315 | int rv = 0; |
316 | |
317 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
318 | |
319 | if (aw->type != PF_ADDR_DYNIFTL) { |
320 | return 0; |
321 | } |
322 | if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK)) == NULL) { |
323 | return 1; |
324 | } |
325 | bzero(s: dyn, n: sizeof(*dyn)); |
326 | |
327 | if (strcmp(s1: aw->v.ifname, s2: "self" ) == 0) { |
328 | dyn->pfid_kif = pfi_kif_get(IFG_ALL); |
329 | } else { |
330 | dyn->pfid_kif = pfi_kif_get(kif_name: aw->v.ifname); |
331 | } |
332 | if (dyn->pfid_kif == NULL) { |
333 | rv = 1; |
334 | goto _bad; |
335 | } |
336 | pfi_kif_ref(kif: dyn->pfid_kif, what: PFI_KIF_REF_RULE); |
337 | |
338 | dyn->pfid_net = pfi_unmask(&aw->v.a.mask); |
339 | if (af == AF_INET && dyn->pfid_net == 32) { |
340 | dyn->pfid_net = 128; |
341 | } |
342 | strlcpy(dst: tblname, src: aw->v.ifname, n: sizeof(tblname)); |
343 | if (aw->iflags & PFI_AFLAG_NETWORK) { |
344 | strlcat(dst: tblname, src: ":network" , n: sizeof(tblname)); |
345 | } |
346 | if (aw->iflags & PFI_AFLAG_BROADCAST) { |
347 | strlcat(dst: tblname, src: ":broadcast" , n: sizeof(tblname)); |
348 | } |
349 | if (aw->iflags & PFI_AFLAG_PEER) { |
350 | strlcat(dst: tblname, src: ":peer" , n: sizeof(tblname)); |
351 | } |
352 | if (aw->iflags & PFI_AFLAG_NOALIAS) { |
353 | strlcat(dst: tblname, src: ":0" , n: sizeof(tblname)); |
354 | } |
355 | if (dyn->pfid_net != 128) { |
356 | snprintf(tblname + strlen(s: tblname), |
357 | count: sizeof(tblname) - strlen(s: tblname), "/%d" , dyn->pfid_net); |
358 | } |
359 | if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) { |
360 | rv = 1; |
361 | goto _bad; |
362 | } |
363 | |
364 | if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) { |
365 | rv = 1; |
366 | goto _bad; |
367 | } |
368 | |
369 | dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; |
370 | dyn->pfid_iflags = aw->iflags; |
371 | dyn->pfid_af = af; |
372 | |
373 | TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); |
374 | aw->p.dyn = dyn; |
375 | pfi_kif_update(dyn->pfid_kif); |
376 | return 0; |
377 | |
378 | _bad: |
379 | if (dyn->pfid_kt != NULL) { |
380 | pfr_detach_table(dyn->pfid_kt); |
381 | } |
382 | if (ruleset != NULL) { |
383 | pf_release_ruleset(r: ruleset); |
384 | } |
385 | if (dyn->pfid_kif != NULL) { |
386 | pfi_kif_unref(kif: dyn->pfid_kif, what: PFI_KIF_REF_RULE); |
387 | } |
388 | pool_put(&pfi_addr_pl, dyn); |
389 | return rv; |
390 | } |
391 | |
392 | void |
393 | pfi_kif_update(struct pfi_kif *kif) |
394 | { |
395 | struct pfi_dynaddr *p; |
396 | |
397 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
398 | |
399 | /* update all dynaddr */ |
400 | TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) |
401 | pfi_dynaddr_update(dyn: p); |
402 | } |
403 | |
404 | void |
405 | pfi_dynaddr_update(struct pfi_dynaddr *dyn) |
406 | { |
407 | struct pfi_kif *kif; |
408 | struct pfr_ktable *kt; |
409 | |
410 | if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) { |
411 | panic("pfi_dynaddr_update" ); |
412 | } |
413 | |
414 | kif = dyn->pfid_kif; |
415 | kt = dyn->pfid_kt; |
416 | |
417 | if (kt->pfrkt_larg != pfi_update) { |
418 | /* this table needs to be brought up-to-date */ |
419 | pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); |
420 | kt->pfrkt_larg = pfi_update; |
421 | } |
422 | pfr_dynaddr_update(kt, dyn); |
423 | } |
424 | |
425 | void |
426 | pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, uint8_t net, int flags) |
427 | { |
428 | int e, size2 = 0; |
429 | |
430 | pfi_buffer_cnt = 0; |
431 | |
432 | if (kif->pfik_ifp != NULL) { |
433 | pfi_instance_add(kif->pfik_ifp, net, flags); |
434 | } |
435 | |
436 | if ((e = pfr_set_addrs(&kt->pfrkt_t, CAST_USER_ADDR_T(pfi_buffer), |
437 | pfi_buffer_cnt, &size2, NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) { |
438 | printf("pfi_table_update: cannot set %d new addresses " |
439 | "into table %s: %d\n" , pfi_buffer_cnt, kt->pfrkt_name, e); |
440 | } |
441 | } |
442 | |
443 | void |
444 | pfi_instance_add(struct ifnet *ifp, uint8_t net, int flags) |
445 | { |
446 | struct ifaddr *ia; |
447 | int got4 = 0, got6 = 0; |
448 | uint8_t net2, af; |
449 | |
450 | if (ifp == NULL) { |
451 | return; |
452 | } |
453 | ifnet_lock_shared(ifp); |
454 | TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) { |
455 | IFA_LOCK(ia); |
456 | if (ia->ifa_addr == NULL) { |
457 | IFA_UNLOCK(ia); |
458 | continue; |
459 | } |
460 | af = ia->ifa_addr->sa_family; |
461 | if (af != AF_INET && af != AF_INET6) { |
462 | IFA_UNLOCK(ia); |
463 | continue; |
464 | } |
465 | if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) { |
466 | IFA_UNLOCK(ia); |
467 | continue; |
468 | } |
469 | if ((flags & PFI_AFLAG_BROADCAST) && |
470 | !(ifp->if_flags & IFF_BROADCAST)) { |
471 | IFA_UNLOCK(ia); |
472 | continue; |
473 | } |
474 | if ((flags & PFI_AFLAG_PEER) && |
475 | !(ifp->if_flags & IFF_POINTOPOINT)) { |
476 | IFA_UNLOCK(ia); |
477 | continue; |
478 | } |
479 | if ((af == AF_INET6) && |
480 | IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) |
481 | (void *)ia->ifa_addr)->sin6_addr)) { |
482 | IFA_UNLOCK(ia); |
483 | continue; |
484 | } |
485 | if ((af == AF_INET6) && |
486 | (((struct in6_ifaddr *)ia)->ia6_flags & |
487 | (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY | IN6_IFF_DETACHED | |
488 | IN6_IFF_CLAT46 | IN6_IFF_TEMPORARY | IN6_IFF_DEPRECATED))) { |
489 | IFA_UNLOCK(ia); |
490 | continue; |
491 | } |
492 | if (flags & PFI_AFLAG_NOALIAS) { |
493 | if (af == AF_INET && got4) { |
494 | IFA_UNLOCK(ia); |
495 | continue; |
496 | } |
497 | if (af == AF_INET6 && got6) { |
498 | IFA_UNLOCK(ia); |
499 | continue; |
500 | } |
501 | } |
502 | if (af == AF_INET) { |
503 | got4 = 1; |
504 | } else if (af == AF_INET6) { |
505 | got6 = 1; |
506 | } |
507 | net2 = net; |
508 | if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { |
509 | if (af == AF_INET) { |
510 | net2 = pfi_unmask(&((struct sockaddr_in *) |
511 | (void *)ia->ifa_netmask)->sin_addr); |
512 | } else if (af == AF_INET6) { |
513 | net2 = pfi_unmask(&((struct sockaddr_in6 *) |
514 | (void *)ia->ifa_netmask)->sin6_addr); |
515 | } |
516 | } |
517 | if (af == AF_INET && net2 > 32) { |
518 | net2 = 32; |
519 | } |
520 | if (flags & PFI_AFLAG_BROADCAST) { |
521 | pfi_address_add(ia->ifa_broadaddr, af, net2); |
522 | } else if (flags & PFI_AFLAG_PEER) { |
523 | pfi_address_add(ia->ifa_dstaddr, af, net2); |
524 | } else { |
525 | pfi_address_add(ia->ifa_addr, af, net2); |
526 | } |
527 | IFA_UNLOCK(ia); |
528 | } |
529 | ifnet_lock_done(ifp); |
530 | } |
531 | |
532 | void |
533 | pfi_address_add(struct sockaddr *sa, uint8_t af, uint8_t net) |
534 | { |
535 | struct pfr_addr *p; |
536 | int i; |
537 | |
538 | if (pfi_buffer_cnt >= pfi_buffer_max) { |
539 | int new_max = pfi_buffer_max * 2; |
540 | |
541 | if (new_max > PFI_BUFFER_MAX) { |
542 | printf("pfi_address_add: address buffer full (%d/%d)\n" , |
543 | pfi_buffer_cnt, PFI_BUFFER_MAX); |
544 | return; |
545 | } |
546 | p = (struct pfr_addr *)kalloc_data(new_max * sizeof(*pfi_buffer), |
547 | Z_WAITOK); |
548 | if (p == NULL) { |
549 | printf("pfi_address_add: no memory to grow buffer " |
550 | "(%d/%d)\n" , pfi_buffer_cnt, PFI_BUFFER_MAX); |
551 | return; |
552 | } |
553 | memcpy(dst: p, src: pfi_buffer, n: pfi_buffer_max * sizeof(*pfi_buffer)); |
554 | /* no need to zero buffer */ |
555 | kfree_data(pfi_buffer, pfi_buffer_max * sizeof(*pfi_buffer)); |
556 | pfi_buffer = p; |
557 | pfi_buffer_max = new_max; |
558 | } |
559 | if (af == AF_INET && net > 32) { |
560 | net = 128; |
561 | } |
562 | p = pfi_buffer + pfi_buffer_cnt++; |
563 | bzero(s: p, n: sizeof(*p)); |
564 | p->pfra_af = af; |
565 | p->pfra_net = net; |
566 | if (af == AF_INET) { |
567 | p->pfra_ip4addr = ((struct sockaddr_in *)(void *)sa)->sin_addr; |
568 | } else if (af == AF_INET6) { |
569 | p->pfra_ip6addr = |
570 | ((struct sockaddr_in6 *)(void *)sa)->sin6_addr; |
571 | if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) { |
572 | p->pfra_ip6addr.s6_addr16[1] = 0; |
573 | } |
574 | } |
575 | /* mask network address bits */ |
576 | if (net < 128) { |
577 | ((caddr_t)p)[p->pfra_net / 8] &= ~(0xFF >> (p->pfra_net % 8)); |
578 | } |
579 | for (i = (p->pfra_net + 7) / 8; i < (int)sizeof(p->pfra_u); i++) { |
580 | ((caddr_t)p)[i] = 0; |
581 | } |
582 | } |
583 | |
584 | void |
585 | pfi_dynaddr_remove(struct pf_addr_wrap *aw) |
586 | { |
587 | if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || |
588 | aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) { |
589 | return; |
590 | } |
591 | |
592 | TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry); |
593 | pfi_kif_unref(kif: aw->p.dyn->pfid_kif, what: PFI_KIF_REF_RULE); |
594 | aw->p.dyn->pfid_kif = NULL; |
595 | pfr_detach_table(aw->p.dyn->pfid_kt); |
596 | aw->p.dyn->pfid_kt = NULL; |
597 | pool_put(&pfi_addr_pl, aw->p.dyn); |
598 | aw->p.dyn = NULL; |
599 | } |
600 | |
601 | void |
602 | pfi_dynaddr_copyout(struct pf_addr_wrap *aw) |
603 | { |
604 | if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || |
605 | aw->p.dyn->pfid_kif == NULL) { |
606 | return; |
607 | } |
608 | aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; |
609 | } |
610 | |
611 | void |
612 | pfi_kifaddr_update(void *v) |
613 | { |
614 | struct pfi_kif *kif = (struct pfi_kif *)v; |
615 | |
616 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
617 | |
618 | pfi_update++; |
619 | pfi_kif_update(kif); |
620 | } |
621 | |
622 | int |
623 | pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) |
624 | { |
625 | return strncmp(s1: p->pfik_name, s2: q->pfik_name, IFNAMSIZ - 1); |
626 | } |
627 | |
628 | void |
629 | pfi_update_status(const char *name, struct pf_status *pfs) |
630 | { |
631 | struct pfi_kif *p; |
632 | struct pfi_kif key; |
633 | int i, j, k; |
634 | |
635 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
636 | |
637 | bzero(s: &key.pfik_name, n: sizeof(key.pfik_name)); |
638 | strlcpy(dst: key.pfik_name, src: name, n: sizeof(key.pfik_name)); |
639 | p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); |
640 | if (p == NULL) { |
641 | return; |
642 | } |
643 | |
644 | if (pfs != NULL) { |
645 | bzero(s: pfs->pcounters, n: sizeof(pfs->pcounters)); |
646 | bzero(s: pfs->bcounters, n: sizeof(pfs->bcounters)); |
647 | for (i = 0; i < 2; i++) { |
648 | for (j = 0; j < 2; j++) { |
649 | for (k = 0; k < 2; k++) { |
650 | pfs->pcounters[i][j][k] += |
651 | p->pfik_packets[i][j][k]; |
652 | pfs->bcounters[i][j] += |
653 | p->pfik_bytes[i][j][k]; |
654 | } |
655 | } |
656 | } |
657 | } else { |
658 | /* just clear statistics */ |
659 | bzero(s: p->pfik_packets, n: sizeof(p->pfik_packets)); |
660 | bzero(s: p->pfik_bytes, n: sizeof(p->pfik_bytes)); |
661 | p->pfik_tzero = pf_calendar_time_second(); |
662 | } |
663 | } |
664 | |
665 | int |
666 | pfi_get_ifaces(const char *name, user_addr_t buf, int *size) |
667 | { |
668 | struct pfi_kif *p, *nextp; |
669 | int n = 0; |
670 | |
671 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
672 | |
673 | for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) { |
674 | nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); |
675 | if (pfi_skip_if(name, p)) { |
676 | continue; |
677 | } |
678 | if (*size > n++) { |
679 | struct pfi_uif u; |
680 | |
681 | if (!p->pfik_tzero) { |
682 | p->pfik_tzero = pf_calendar_time_second(); |
683 | } |
684 | pfi_kif_ref(kif: p, what: PFI_KIF_REF_RULE); |
685 | |
686 | /* return the user space version of pfi_kif */ |
687 | bzero(s: &u, n: sizeof(u)); |
688 | bcopy(src: p->pfik_name, dst: &u.pfik_name, n: sizeof(u.pfik_name)); |
689 | bcopy(src: p->pfik_packets, dst: &u.pfik_packets, |
690 | n: sizeof(u.pfik_packets)); |
691 | bcopy(src: p->pfik_bytes, dst: &u.pfik_bytes, |
692 | n: sizeof(u.pfik_bytes)); |
693 | u.pfik_tzero = p->pfik_tzero; |
694 | u.pfik_flags = p->pfik_flags; |
695 | u.pfik_states = p->pfik_states; |
696 | u.pfik_rules = p->pfik_rules; |
697 | |
698 | if (copyout(&u, buf, sizeof(u))) { |
699 | pfi_kif_unref(kif: p, what: PFI_KIF_REF_RULE); |
700 | return EFAULT; |
701 | } |
702 | buf += sizeof(u); |
703 | nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); |
704 | pfi_kif_unref(kif: p, what: PFI_KIF_REF_RULE); |
705 | } |
706 | } |
707 | *size = n; |
708 | return 0; |
709 | } |
710 | |
711 | int |
712 | pfi_skip_if(const char *filter, struct pfi_kif *p) |
713 | { |
714 | size_t n; |
715 | |
716 | if (filter == NULL || !*filter) { |
717 | return 0; |
718 | } |
719 | if (strcmp(s1: p->pfik_name, s2: filter) == 0) { |
720 | return 0; /* exact match */ |
721 | } |
722 | n = strlen(s: filter); |
723 | if (n < 1 || n >= IFNAMSIZ) { |
724 | return 1; /* sanity check */ |
725 | } |
726 | if (filter[n - 1] >= '0' && filter[n - 1] <= '9') { |
727 | return 1; /* only do exact match in that case */ |
728 | } |
729 | if (strncmp(s1: p->pfik_name, s2: filter, n)) { |
730 | return 1; /* prefix doesn't match */ |
731 | } |
732 | return p->pfik_name[n] < '0' || p->pfik_name[n] > '9'; |
733 | } |
734 | |
735 | int |
736 | pfi_set_flags(const char *name, int flags) |
737 | { |
738 | struct pfi_kif *p; |
739 | |
740 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
741 | |
742 | RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { |
743 | if (pfi_skip_if(filter: name, p)) { |
744 | continue; |
745 | } |
746 | p->pfik_flags |= flags; |
747 | } |
748 | return 0; |
749 | } |
750 | |
751 | int |
752 | pfi_clear_flags(const char *name, int flags) |
753 | { |
754 | struct pfi_kif *p; |
755 | |
756 | LCK_MTX_ASSERT(&pf_lock, LCK_MTX_ASSERT_OWNED); |
757 | |
758 | RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { |
759 | if (pfi_skip_if(filter: name, p)) { |
760 | continue; |
761 | } |
762 | p->pfik_flags &= ~flags; |
763 | } |
764 | return 0; |
765 | } |
766 | |
767 | /* from pf_print_state.c */ |
768 | uint8_t |
769 | pfi_unmask(void *addr) |
770 | { |
771 | struct pf_addr *m = addr; |
772 | int i = 31, j = 0, b = 0; |
773 | u_int32_t tmp; |
774 | |
775 | while (j < 4 && m->addr32[j] == 0xffffffff) { |
776 | b += 32; |
777 | j++; |
778 | } |
779 | if (j < 4) { |
780 | tmp = ntohl(m->addr32[j]); |
781 | for (i = 31; tmp & (1 << i); --i) { |
782 | b++; |
783 | } |
784 | } |
785 | VERIFY(b >= 0 && b <= UINT8_MAX); |
786 | return (uint8_t)b; |
787 | } |
788 | |