1/*- 2 * Copyright (c) 2001 Daniel Hartmeier 3 * Copyright (c) 2002,2003 Henning Brauer 4 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 * 31 * Effort sponsored in part by the Defense Advanced Research Projects 32 * Agency (DARPA) and Air Force Research Laboratory, Air Force 33 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 34 * 35 * $OpenBSD: pf_ioctl.c,v 1.213 2009/02/15 21:46:12 mbalmer Exp $ 36 */ 37 38#include <sys/cdefs.h> 39__FBSDID("$FreeBSD$"); 40 41#include "opt_inet.h" 42#include "opt_inet6.h" 43#include "opt_bpf.h" 44#include "opt_pf.h" 45 46#include <sys/param.h> 47#include <sys/bus.h> 48#include <sys/conf.h> 49#include <sys/endian.h> 50#include <sys/fcntl.h> 51#include <sys/filio.h> 52#include <sys/interrupt.h> 53#include <sys/jail.h> 54#include <sys/kernel.h> 55#include <sys/kthread.h> 56#include <sys/mbuf.h> 57#include <sys/module.h> 58#include <sys/proc.h> 59#include <sys/smp.h> 60#include <sys/socket.h> 61#include <sys/sysctl.h> 62#include <sys/md5.h> 63#include <sys/ucred.h> 64 65#include <net/if.h> 66#include <net/route.h> 67#include <net/pfil.h> 68#include <net/pfvar.h> 69#include <net/if_pfsync.h> 70#include <net/if_pflog.h> 71 72#include <netinet/in.h> 73#include <netinet/ip.h> 74#include <netinet/ip_var.h> 75#include <netinet/ip_icmp.h> 76 77#ifdef INET6 78#include <netinet/ip6.h> 79#endif /* INET6 */ 80 81#ifdef ALTQ 82#include <altq/altq.h> 83#endif 84 85static int pfattach(void); 86static struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 87 u_int8_t, u_int8_t, u_int8_t); 88 89static void pf_mv_pool(struct pf_palist *, struct pf_palist *); 90static void pf_empty_pool(struct pf_palist *); 91static int pfioctl(struct cdev *, u_long, caddr_t, int, 92 struct thread *); 93#ifdef ALTQ 94static int pf_begin_altq(u_int32_t *); 95static int pf_rollback_altq(u_int32_t); 96static int pf_commit_altq(u_int32_t); 97static int pf_enable_altq(struct pf_altq *); 98static int pf_disable_altq(struct pf_altq *); 99static u_int32_t pf_qname2qid(char *); 100static void pf_qid_unref(u_int32_t); 101#endif /* ALTQ */ 102static int pf_begin_rules(u_int32_t *, int, const char *); 103static int pf_rollback_rules(u_int32_t, int, char *); 104static int pf_setup_pfsync_matching(struct pf_ruleset *); 105static void pf_hash_rule(MD5_CTX *, struct pf_rule *); 106static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 107static int pf_commit_rules(u_int32_t, int, char *); 108static int pf_addr_setup(struct pf_ruleset *, 109 struct pf_addr_wrap *, sa_family_t); 110static void pf_addr_copyout(struct pf_addr_wrap *); 111 112VNET_DEFINE(struct pf_rule, pf_default_rule); 113 114#ifdef ALTQ 115static VNET_DEFINE(int, pf_altq_running); 116#define V_pf_altq_running VNET(pf_altq_running) 117#endif 118 119#define TAGID_MAX 50000 120struct pf_tagname { 121 TAILQ_ENTRY(pf_tagname) entries; 122 char name[PF_TAG_NAME_SIZE]; 123 uint16_t tag; 124 int ref; 125}; 126 127TAILQ_HEAD(pf_tags, pf_tagname); 128#define V_pf_tags VNET(pf_tags) 129VNET_DEFINE(struct pf_tags, pf_tags); 130#define V_pf_qids VNET(pf_qids) 131VNET_DEFINE(struct pf_tags, pf_qids); 132static MALLOC_DEFINE(M_PFTAG, "pf_tag", "pf(4) tag names"); 133static MALLOC_DEFINE(M_PFALTQ, "pf_altq", "pf(4) altq configuration db"); 134static MALLOC_DEFINE(M_PFRULE, "pf_rule", "pf(4) rules"); 135 136#if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 137#error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 138#endif 139 140static u_int16_t tagname2tag(struct pf_tags *, char *); 141static u_int16_t pf_tagname2tag(char *); 142static void tag_unref(struct pf_tags *, u_int16_t); 143 144#define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x 145 146struct cdev *pf_dev; 147 148/* 149 * XXX - These are new and need to be checked when moveing to a new version 150 */ 151static void pf_clear_states(void); 152static int pf_clear_tables(void); 153static void pf_clear_srcnodes(struct pf_src_node *); 154static void pf_tbladdr_copyout(struct pf_addr_wrap *); 155 156/* 157 * Wrapper functions for pfil(9) hooks 158 */ 159#ifdef INET 160static int pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, 161 int dir, struct inpcb *inp); 162static int pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, 163 int dir, struct inpcb *inp); 164#endif 165#ifdef INET6 166static int pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, 167 int dir, struct inpcb *inp); 168static int pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, 169 int dir, struct inpcb *inp); 170#endif 171 172static int hook_pf(void); 173static int dehook_pf(void); 174static int shutdown_pf(void); 175static int pf_load(void); 176static int pf_unload(void); 177 178static struct cdevsw pf_cdevsw = { 179 .d_ioctl = pfioctl, 180 .d_name = PF_NAME, 181 .d_version = D_VERSION, 182}; 183 184static volatile VNET_DEFINE(int, pf_pfil_hooked); 185#define V_pf_pfil_hooked VNET(pf_pfil_hooked) 186VNET_DEFINE(int, pf_end_threads); 187 188struct rwlock pf_rules_lock; 189 190/* pfsync */ 191pfsync_state_import_t *pfsync_state_import_ptr = NULL; 192pfsync_insert_state_t *pfsync_insert_state_ptr = NULL; 193pfsync_update_state_t *pfsync_update_state_ptr = NULL; 194pfsync_delete_state_t *pfsync_delete_state_ptr = NULL; 195pfsync_clear_states_t *pfsync_clear_states_ptr = NULL; 196pfsync_defer_t *pfsync_defer_ptr = NULL; 197/* pflog */ 198pflog_packet_t *pflog_packet_ptr = NULL; 199 200static int 201pfattach(void) 202{ 203 u_int32_t *my_timeout = V_pf_default_rule.timeout; 204 int error; 205 206 pf_initialize(); 207 pfr_initialize(); 208 pfi_initialize(); 209 pf_normalize_init(); 210 211 V_pf_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT; 212 V_pf_limits[PF_LIMIT_SRC_NODES].limit = PFSNODE_HIWAT; 213 214 RB_INIT(&V_pf_anchors); 215 pf_init_ruleset(&pf_main_ruleset); 216 217 /* default rule should never be garbage collected */ 218 V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next; 219#ifdef PF_DEFAULT_TO_DROP 220 V_pf_default_rule.action = PF_DROP; 221#else 222 V_pf_default_rule.action = PF_PASS; 223#endif 224 V_pf_default_rule.nr = -1; 225 V_pf_default_rule.rtableid = -1; 226 227 /* initialize default timeouts */ 228 my_timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 229 my_timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 230 my_timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 231 my_timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 232 my_timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 233 my_timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 234 my_timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 235 my_timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 236 my_timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 237 my_timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 238 my_timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 239 my_timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 240 my_timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 241 my_timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 242 my_timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 243 my_timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 244 my_timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 245 my_timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 246 my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 247 my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 248 249 bzero(&V_pf_status, sizeof(V_pf_status)); 250 V_pf_status.debug = PF_DEBUG_URGENT; 251 252 V_pf_pfil_hooked = 0; 253 254 /* XXX do our best to avoid a conflict */ 255 V_pf_status.hostid = arc4random(); 256 257 if ((error = kproc_create(pf_purge_thread, curvnet, NULL, 0, 0, 258 "pf purge")) != 0) 259 /* XXXGL: leaked all above. */ 260 return (error); 261 if ((error = swi_add(NULL, "pf send", pf_intr, curvnet, SWI_NET, 262 INTR_MPSAFE, &V_pf_swi_cookie)) != 0) 263 /* XXXGL: leaked all above. */ 264 return (error); 265 266 return (0); 267} 268 269static struct pf_pool * 270pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 271 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 272 u_int8_t check_ticket) 273{ 274 struct pf_ruleset *ruleset; 275 struct pf_rule *rule; 276 int rs_num; 277 278 ruleset = pf_find_ruleset(anchor); 279 if (ruleset == NULL) 280 return (NULL); 281 rs_num = pf_get_ruleset_number(rule_action); 282 if (rs_num >= PF_RULESET_MAX) 283 return (NULL); 284 if (active) { 285 if (check_ticket && ticket != 286 ruleset->rules[rs_num].active.ticket) 287 return (NULL); 288 if (r_last) 289 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 290 pf_rulequeue); 291 else 292 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 293 } else { 294 if (check_ticket && ticket != 295 ruleset->rules[rs_num].inactive.ticket) 296 return (NULL); 297 if (r_last) 298 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 299 pf_rulequeue); 300 else 301 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 302 } 303 if (!r_last) { 304 while ((rule != NULL) && (rule->nr != rule_number)) 305 rule = TAILQ_NEXT(rule, entries); 306 } 307 if (rule == NULL) 308 return (NULL); 309 310 return (&rule->rpool); 311} 312 313static void 314pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 315{ 316 struct pf_pooladdr *mv_pool_pa; 317 318 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 319 TAILQ_REMOVE(poola, mv_pool_pa, entries); 320 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 321 } 322} 323 324static void 325pf_empty_pool(struct pf_palist *poola) 326{ 327 struct pf_pooladdr *pa; 328 329 while ((pa = TAILQ_FIRST(poola)) != NULL) { 330 switch (pa->addr.type) { 331 case PF_ADDR_DYNIFTL: 332 pfi_dynaddr_remove(pa->addr.p.dyn); 333 break; 334 case PF_ADDR_TABLE: 335 pfr_detach_table(pa->addr.p.tbl); 336 break; 337 } 338 if (pa->kif) 339 pfi_kif_unref(pa->kif); 340 TAILQ_REMOVE(poola, pa, entries); 341 free(pa, M_PFRULE); 342 } 343} 344 345static void 346pf_unlink_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 347{ 348 349 PF_RULES_WASSERT(); 350 351 TAILQ_REMOVE(rulequeue, rule, entries); 352 353 PF_UNLNKDRULES_LOCK(); 354 rule->rule_flag |= PFRULE_REFS; 355 TAILQ_INSERT_TAIL(&V_pf_unlinked_rules, rule, entries); 356 PF_UNLNKDRULES_UNLOCK(); 357} 358 359void 360pf_free_rule(struct pf_rule *rule) 361{ 362 363 PF_RULES_WASSERT(); 364 365 if (rule->tag) 366 tag_unref(&V_pf_tags, rule->tag); 367 if (rule->match_tag) 368 tag_unref(&V_pf_tags, rule->match_tag); 369#ifdef ALTQ 370 if (rule->pqid != rule->qid) 371 pf_qid_unref(rule->pqid); 372 pf_qid_unref(rule->qid); 373#endif 374 switch (rule->src.addr.type) { 375 case PF_ADDR_DYNIFTL: 376 pfi_dynaddr_remove(rule->src.addr.p.dyn); 377 break; 378 case PF_ADDR_TABLE: 379 pfr_detach_table(rule->src.addr.p.tbl); 380 break; 381 } 382 switch (rule->dst.addr.type) { 383 case PF_ADDR_DYNIFTL: 384 pfi_dynaddr_remove(rule->dst.addr.p.dyn); 385 break; 386 case PF_ADDR_TABLE: 387 pfr_detach_table(rule->dst.addr.p.tbl); 388 break; 389 } 390 if (rule->overload_tbl) 391 pfr_detach_table(rule->overload_tbl); 392 if (rule->kif) 393 pfi_kif_unref(rule->kif); 394 pf_anchor_remove(rule); 395 pf_empty_pool(&rule->rpool.list); 396 free(rule, M_PFRULE); 397} 398 399static u_int16_t 400tagname2tag(struct pf_tags *head, char *tagname) 401{ 402 struct pf_tagname *tag, *p = NULL; 403 u_int16_t new_tagid = 1; 404 405 PF_RULES_WASSERT(); 406 407 TAILQ_FOREACH(tag, head, entries) 408 if (strcmp(tagname, tag->name) == 0) { 409 tag->ref++; 410 return (tag->tag); 411 } 412 413 /* 414 * to avoid fragmentation, we do a linear search from the beginning 415 * and take the first free slot we find. if there is none or the list 416 * is empty, append a new entry at the end. 417 */ 418 419 /* new entry */ 420 if (!TAILQ_EMPTY(head)) 421 for (p = TAILQ_FIRST(head); p != NULL && 422 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 423 new_tagid = p->tag + 1; 424 425 if (new_tagid > TAGID_MAX) 426 return (0); 427 428 /* allocate and fill new struct pf_tagname */ 429 tag = malloc(sizeof(*tag), M_PFTAG, M_NOWAIT|M_ZERO); 430 if (tag == NULL) 431 return (0); 432 strlcpy(tag->name, tagname, sizeof(tag->name)); 433 tag->tag = new_tagid; 434 tag->ref++; 435 436 if (p != NULL) /* insert new entry before p */ 437 TAILQ_INSERT_BEFORE(p, tag, entries); 438 else /* either list empty or no free slot in between */ 439 TAILQ_INSERT_TAIL(head, tag, entries); 440 441 return (tag->tag); 442} 443 444static void 445tag_unref(struct pf_tags *head, u_int16_t tag) 446{ 447 struct pf_tagname *p, *next; 448 449 PF_RULES_WASSERT(); 450 451 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 452 next = TAILQ_NEXT(p, entries); 453 if (tag == p->tag) { 454 if (--p->ref == 0) { 455 TAILQ_REMOVE(head, p, entries); 456 free(p, M_PFTAG); 457 } 458 break; 459 } 460 } 461} 462 463static u_int16_t 464pf_tagname2tag(char *tagname) 465{ 466 return (tagname2tag(&V_pf_tags, tagname)); 467} 468 469#ifdef ALTQ 470static u_int32_t 471pf_qname2qid(char *qname) 472{ 473 return ((u_int32_t)tagname2tag(&V_pf_qids, qname)); 474} 475 476static void 477pf_qid_unref(u_int32_t qid) 478{ 479 tag_unref(&V_pf_qids, (u_int16_t)qid); 480} 481 482static int 483pf_begin_altq(u_int32_t *ticket) 484{ 485 struct pf_altq *altq; 486 int error = 0; 487 488 PF_RULES_WASSERT(); 489 490 /* Purge the old altq list */ 491 while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) { 492 TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries); 493 if (altq->qname[0] == 0 && 494 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 495 /* detach and destroy the discipline */ 496 error = altq_remove(altq); 497 } else 498 pf_qid_unref(altq->qid); 499 free(altq, M_PFALTQ); 500 } 501 if (error) 502 return (error); 503 *ticket = ++V_ticket_altqs_inactive; 504 V_altqs_inactive_open = 1; 505 return (0); 506} 507 508static int 509pf_rollback_altq(u_int32_t ticket) 510{ 511 struct pf_altq *altq; 512 int error = 0; 513 514 PF_RULES_WASSERT(); 515 516 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 517 return (0); 518 /* Purge the old altq list */ 519 while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) { 520 TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries); 521 if (altq->qname[0] == 0 && 522 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 523 /* detach and destroy the discipline */ 524 error = altq_remove(altq); 525 } else 526 pf_qid_unref(altq->qid); 527 free(altq, M_PFALTQ); 528 } 529 V_altqs_inactive_open = 0; 530 return (error); 531} 532 533static int 534pf_commit_altq(u_int32_t ticket) 535{ 536 struct pf_altqqueue *old_altqs; 537 struct pf_altq *altq; 538 int err, error = 0; 539 540 PF_RULES_WASSERT(); 541 542 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 543 return (EBUSY); 544 545 /* swap altqs, keep the old. */ 546 old_altqs = V_pf_altqs_active; 547 V_pf_altqs_active = V_pf_altqs_inactive; 548 V_pf_altqs_inactive = old_altqs; 549 V_ticket_altqs_active = V_ticket_altqs_inactive; 550 551 /* Attach new disciplines */ 552 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 553 if (altq->qname[0] == 0 && 554 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 555 /* attach the discipline */ 556 error = altq_pfattach(altq); 557 if (error == 0 && V_pf_altq_running) 558 error = pf_enable_altq(altq); 559 if (error != 0) 560 return (error); 561 } 562 } 563 564 /* Purge the old altq list */ 565 while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) { 566 TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries); 567 if (altq->qname[0] == 0 && 568 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 569 /* detach and destroy the discipline */ 570 if (V_pf_altq_running) 571 error = pf_disable_altq(altq); 572 err = altq_pfdetach(altq); 573 if (err != 0 && error == 0) 574 error = err; 575 err = altq_remove(altq); 576 if (err != 0 && error == 0) 577 error = err; 578 } else 579 pf_qid_unref(altq->qid); 580 free(altq, M_PFALTQ); 581 } 582 583 V_altqs_inactive_open = 0; 584 return (error); 585} 586 587static int 588pf_enable_altq(struct pf_altq *altq) 589{ 590 struct ifnet *ifp; 591 struct tb_profile tb; 592 int error = 0; 593 594 if ((ifp = ifunit(altq->ifname)) == NULL) 595 return (EINVAL); 596 597 if (ifp->if_snd.altq_type != ALTQT_NONE) 598 error = altq_enable(&ifp->if_snd); 599 600 /* set tokenbucket regulator */ 601 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 602 tb.rate = altq->ifbandwidth; 603 tb.depth = altq->tbrsize; 604 error = tbr_set(&ifp->if_snd, &tb); 605 } 606 607 return (error); 608} 609 610static int 611pf_disable_altq(struct pf_altq *altq) 612{ 613 struct ifnet *ifp; 614 struct tb_profile tb; 615 int error; 616 617 if ((ifp = ifunit(altq->ifname)) == NULL) 618 return (EINVAL); 619 620 /* 621 * when the discipline is no longer referenced, it was overridden 622 * by a new one. if so, just return. 623 */ 624 if (altq->altq_disc != ifp->if_snd.altq_disc) 625 return (0); 626 627 error = altq_disable(&ifp->if_snd); 628 629 if (error == 0) { 630 /* clear tokenbucket regulator */ 631 tb.rate = 0; 632 error = tbr_set(&ifp->if_snd, &tb); 633 } 634 635 return (error); 636} 637 638void 639pf_altq_ifnet_event(struct ifnet *ifp, int remove) 640{ 641 struct ifnet *ifp1; 642 struct pf_altq *a1, *a2, *a3; 643 u_int32_t ticket; 644 int error = 0; 645 646 /* Interrupt userland queue modifications */ 647 if (V_altqs_inactive_open) 648 pf_rollback_altq(V_ticket_altqs_inactive); 649 650 /* Start new altq ruleset */ 651 if (pf_begin_altq(&ticket)) 652 return; 653 654 /* Copy the current active set */ 655 TAILQ_FOREACH(a1, V_pf_altqs_active, entries) { 656 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT); 657 if (a2 == NULL) { 658 error = ENOMEM; 659 break; 660 } 661 bcopy(a1, a2, sizeof(struct pf_altq)); 662 663 if (a2->qname[0] != 0) { 664 if ((a2->qid = pf_qname2qid(a2->qname)) == 0) { 665 error = EBUSY; 666 free(a2, M_PFALTQ); 667 break; 668 } 669 a2->altq_disc = NULL; 670 TAILQ_FOREACH(a3, V_pf_altqs_inactive, entries) { 671 if (strncmp(a3->ifname, a2->ifname, 672 IFNAMSIZ) == 0 && a3->qname[0] == 0) { 673 a2->altq_disc = a3->altq_disc; 674 break; 675 } 676 } 677 } 678 /* Deactivate the interface in question */ 679 a2->local_flags &= ~PFALTQ_FLAG_IF_REMOVED; 680 if ((ifp1 = ifunit(a2->ifname)) == NULL || 681 (remove && ifp1 == ifp)) { 682 a2->local_flags |= PFALTQ_FLAG_IF_REMOVED; 683 } else { 684 error = altq_add(a2); 685 686 if (ticket != V_ticket_altqs_inactive) 687 error = EBUSY; 688 689 if (error) { 690 free(a2, M_PFALTQ); 691 break; 692 } 693 } 694 695 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, a2, entries); 696 } 697 698 if (error != 0) 699 pf_rollback_altq(ticket); 700 else 701 pf_commit_altq(ticket); 702} 703#endif /* ALTQ */ 704 705static int 706pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 707{ 708 struct pf_ruleset *rs; 709 struct pf_rule *rule; 710 711 PF_RULES_WASSERT(); 712 713 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 714 return (EINVAL); 715 rs = pf_find_or_create_ruleset(anchor); 716 if (rs == NULL) 717 return (EINVAL); 718 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 719 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 720 rs->rules[rs_num].inactive.rcount--; 721 } 722 *ticket = ++rs->rules[rs_num].inactive.ticket; 723 rs->rules[rs_num].inactive.open = 1; 724 return (0); 725} 726 727static int 728pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 729{ 730 struct pf_ruleset *rs; 731 struct pf_rule *rule; 732 733 PF_RULES_WASSERT(); 734 735 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 736 return (EINVAL); 737 rs = pf_find_ruleset(anchor); 738 if (rs == NULL || !rs->rules[rs_num].inactive.open || 739 rs->rules[rs_num].inactive.ticket != ticket) 740 return (0); 741 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 742 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 743 rs->rules[rs_num].inactive.rcount--; 744 } 745 rs->rules[rs_num].inactive.open = 0; 746 return (0); 747} 748 749#define PF_MD5_UPD(st, elm) \ 750 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 751 752#define PF_MD5_UPD_STR(st, elm) \ 753 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 754 755#define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 756 (stor) = htonl((st)->elm); \ 757 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 758} while (0) 759 760#define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 761 (stor) = htons((st)->elm); \ 762 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 763} while (0) 764 765static void 766pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 767{ 768 PF_MD5_UPD(pfr, addr.type); 769 switch (pfr->addr.type) { 770 case PF_ADDR_DYNIFTL: 771 PF_MD5_UPD(pfr, addr.v.ifname); 772 PF_MD5_UPD(pfr, addr.iflags); 773 break; 774 case PF_ADDR_TABLE: 775 PF_MD5_UPD(pfr, addr.v.tblname); 776 break; 777 case PF_ADDR_ADDRMASK: 778 /* XXX ignore af? */ 779 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 780 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 781 break; 782 } 783 784 PF_MD5_UPD(pfr, port[0]); 785 PF_MD5_UPD(pfr, port[1]); 786 PF_MD5_UPD(pfr, neg); 787 PF_MD5_UPD(pfr, port_op); 788} 789 790static void 791pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule) 792{ 793 u_int16_t x; 794 u_int32_t y; 795 796 pf_hash_rule_addr(ctx, &rule->src); 797 pf_hash_rule_addr(ctx, &rule->dst); 798 PF_MD5_UPD_STR(rule, label); 799 PF_MD5_UPD_STR(rule, ifname); 800 PF_MD5_UPD_STR(rule, match_tagname); 801 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 802 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 803 PF_MD5_UPD_HTONL(rule, prob, y); 804 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 805 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 806 PF_MD5_UPD(rule, uid.op); 807 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 808 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 809 PF_MD5_UPD(rule, gid.op); 810 PF_MD5_UPD_HTONL(rule, rule_flag, y); 811 PF_MD5_UPD(rule, action); 812 PF_MD5_UPD(rule, direction); 813 PF_MD5_UPD(rule, af); 814 PF_MD5_UPD(rule, quick); 815 PF_MD5_UPD(rule, ifnot); 816 PF_MD5_UPD(rule, match_tag_not); 817 PF_MD5_UPD(rule, natpass); 818 PF_MD5_UPD(rule, keep_state); 819 PF_MD5_UPD(rule, proto); 820 PF_MD5_UPD(rule, type); 821 PF_MD5_UPD(rule, code); 822 PF_MD5_UPD(rule, flags); 823 PF_MD5_UPD(rule, flagset); 824 PF_MD5_UPD(rule, allow_opts); 825 PF_MD5_UPD(rule, rt); 826 PF_MD5_UPD(rule, tos); 827} 828 829static int 830pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 831{ 832 struct pf_ruleset *rs; 833 struct pf_rule *rule, **old_array; 834 struct pf_rulequeue *old_rules; 835 int error; 836 u_int32_t old_rcount; 837 838 PF_RULES_WASSERT(); 839 840 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 841 return (EINVAL); 842 rs = pf_find_ruleset(anchor); 843 if (rs == NULL || !rs->rules[rs_num].inactive.open || 844 ticket != rs->rules[rs_num].inactive.ticket) 845 return (EBUSY); 846 847 /* Calculate checksum for the main ruleset */ 848 if (rs == &pf_main_ruleset) { 849 error = pf_setup_pfsync_matching(rs); 850 if (error != 0) 851 return (error); 852 } 853 854 /* Swap rules, keep the old. */ 855 old_rules = rs->rules[rs_num].active.ptr; 856 old_rcount = rs->rules[rs_num].active.rcount; 857 old_array = rs->rules[rs_num].active.ptr_array; 858 859 rs->rules[rs_num].active.ptr = 860 rs->rules[rs_num].inactive.ptr; 861 rs->rules[rs_num].active.ptr_array = 862 rs->rules[rs_num].inactive.ptr_array; 863 rs->rules[rs_num].active.rcount = 864 rs->rules[rs_num].inactive.rcount; 865 rs->rules[rs_num].inactive.ptr = old_rules; 866 rs->rules[rs_num].inactive.ptr_array = old_array; 867 rs->rules[rs_num].inactive.rcount = old_rcount; 868 869 rs->rules[rs_num].active.ticket = 870 rs->rules[rs_num].inactive.ticket; 871 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 872 873 874 /* Purge the old rule list. */ 875 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 876 pf_unlink_rule(old_rules, rule); 877 if (rs->rules[rs_num].inactive.ptr_array) 878 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 879 rs->rules[rs_num].inactive.ptr_array = NULL; 880 rs->rules[rs_num].inactive.rcount = 0; 881 rs->rules[rs_num].inactive.open = 0; 882 pf_remove_if_empty_ruleset(rs); 883 884 return (0); 885} 886 887static int 888pf_setup_pfsync_matching(struct pf_ruleset *rs) 889{ 890 MD5_CTX ctx; 891 struct pf_rule *rule; 892 int rs_cnt; 893 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 894 895 MD5Init(&ctx); 896 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 897 /* XXX PF_RULESET_SCRUB as well? */ 898 if (rs_cnt == PF_RULESET_SCRUB) 899 continue; 900 901 if (rs->rules[rs_cnt].inactive.ptr_array) 902 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 903 rs->rules[rs_cnt].inactive.ptr_array = NULL; 904 905 if (rs->rules[rs_cnt].inactive.rcount) { 906 rs->rules[rs_cnt].inactive.ptr_array = 907 malloc(sizeof(caddr_t) * 908 rs->rules[rs_cnt].inactive.rcount, 909 M_TEMP, M_NOWAIT); 910 911 if (!rs->rules[rs_cnt].inactive.ptr_array) 912 return (ENOMEM); 913 } 914 915 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 916 entries) { 917 pf_hash_rule(&ctx, rule); 918 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 919 } 920 } 921 922 MD5Final(digest, &ctx); 923 memcpy(V_pf_status.pf_chksum, digest, sizeof(V_pf_status.pf_chksum)); 924 return (0); 925} 926 927static int 928pf_addr_setup(struct pf_ruleset *ruleset, struct pf_addr_wrap *addr, 929 sa_family_t af) 930{ 931 int error = 0; 932 933 switch (addr->type) { 934 case PF_ADDR_TABLE: 935 addr->p.tbl = pfr_attach_table(ruleset, addr->v.tblname); 936 if (addr->p.tbl == NULL) 937 error = ENOMEM; 938 break; 939 case PF_ADDR_DYNIFTL: 940 error = pfi_dynaddr_setup(addr, af); 941 break; 942 } 943 944 return (error); 945} 946 947static void 948pf_addr_copyout(struct pf_addr_wrap *addr) 949{ 950 951 switch (addr->type) { 952 case PF_ADDR_DYNIFTL: 953 pfi_dynaddr_copyout(addr); 954 break; 955 case PF_ADDR_TABLE: 956 pf_tbladdr_copyout(addr); 957 break; 958 } 959} 960 961static int 962pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) 963{ 964 int error = 0; 965 966 /* XXX keep in sync with switch() below */ 967 if (securelevel_gt(td->td_ucred, 2)) 968 switch (cmd) { 969 case DIOCGETRULES: 970 case DIOCGETRULE: 971 case DIOCGETADDRS: 972 case DIOCGETADDR: 973 case DIOCGETSTATE: 974 case DIOCSETSTATUSIF: 975 case DIOCGETSTATUS: 976 case DIOCCLRSTATUS: 977 case DIOCNATLOOK: 978 case DIOCSETDEBUG: 979 case DIOCGETSTATES: 980 case DIOCGETTIMEOUT: 981 case DIOCCLRRULECTRS: 982 case DIOCGETLIMIT: 983 case DIOCGETALTQS: 984 case DIOCGETALTQ: 985 case DIOCGETQSTATS: 986 case DIOCGETRULESETS: 987 case DIOCGETRULESET: 988 case DIOCRGETTABLES: 989 case DIOCRGETTSTATS: 990 case DIOCRCLRTSTATS: 991 case DIOCRCLRADDRS: 992 case DIOCRADDADDRS: 993 case DIOCRDELADDRS: 994 case DIOCRSETADDRS: 995 case DIOCRGETADDRS: 996 case DIOCRGETASTATS: 997 case DIOCRCLRASTATS: 998 case DIOCRTSTADDRS: 999 case DIOCOSFPGET: 1000 case DIOCGETSRCNODES: 1001 case DIOCCLRSRCNODES: 1002 case DIOCIGETIFACES: 1003 case DIOCGIFSPEED: 1004 case DIOCSETIFFLAG: 1005 case DIOCCLRIFFLAG: 1006 break; 1007 case DIOCRCLRTABLES: 1008 case DIOCRADDTABLES: 1009 case DIOCRDELTABLES: 1010 case DIOCRSETTFLAGS: 1011 if (((struct pfioc_table *)addr)->pfrio_flags & 1012 PFR_FLAG_DUMMY) 1013 break; /* dummy operation ok */ 1014 return (EPERM); 1015 default: 1016 return (EPERM); 1017 } 1018 1019 if (!(flags & FWRITE)) 1020 switch (cmd) { 1021 case DIOCGETRULES: 1022 case DIOCGETADDRS: 1023 case DIOCGETADDR: 1024 case DIOCGETSTATE: 1025 case DIOCGETSTATUS: 1026 case DIOCGETSTATES: 1027 case DIOCGETTIMEOUT: 1028 case DIOCGETLIMIT: 1029 case DIOCGETALTQS: 1030 case DIOCGETALTQ: 1031 case DIOCGETQSTATS: 1032 case DIOCGETRULESETS: 1033 case DIOCGETRULESET: 1034 case DIOCNATLOOK: 1035 case DIOCRGETTABLES: 1036 case DIOCRGETTSTATS: 1037 case DIOCRGETADDRS: 1038 case DIOCRGETASTATS: 1039 case DIOCRTSTADDRS: 1040 case DIOCOSFPGET: 1041 case DIOCGETSRCNODES: 1042 case DIOCIGETIFACES: 1043 case DIOCGIFSPEED: 1044 break; 1045 case DIOCRCLRTABLES: 1046 case DIOCRADDTABLES: 1047 case DIOCRDELTABLES: 1048 case DIOCRCLRTSTATS: 1049 case DIOCRCLRADDRS: 1050 case DIOCRADDADDRS: 1051 case DIOCRDELADDRS: 1052 case DIOCRSETADDRS: 1053 case DIOCRSETTFLAGS: 1054 if (((struct pfioc_table *)addr)->pfrio_flags & 1055 PFR_FLAG_DUMMY) { 1056 flags |= FWRITE; /* need write lock for dummy */ 1057 break; /* dummy operation ok */ 1058 } 1059 return (EACCES); 1060 case DIOCGETRULE: 1061 if (((struct pfioc_rule *)addr)->action == 1062 PF_GET_CLR_CNTR) 1063 return (EACCES); 1064 break; 1065 default: 1066 return (EACCES); 1067 } 1068 1069 CURVNET_SET(TD_TO_VNET(td)); 1070 1071 switch (cmd) { 1072 case DIOCSTART: 1073 PF_RULES_WLOCK(); 1074 if (V_pf_status.running) 1075 error = EEXIST; 1076 else { 1077 int cpu; 1078 1079 PF_RULES_WUNLOCK(); 1080 error = hook_pf(); 1081 if (error) { 1082 DPFPRINTF(PF_DEBUG_MISC, 1083 ("pf: pfil registration failed\n")); 1084 break; 1085 } 1086 PF_RULES_WLOCK(); 1087 V_pf_status.running = 1; 1088 V_pf_status.since = time_second; 1089 1090 CPU_FOREACH(cpu) 1091 V_pf_stateid[cpu] = time_second; 1092 1093 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1094 } 1095 PF_RULES_WUNLOCK(); 1096 break; 1097 1098 case DIOCSTOP: 1099 PF_RULES_WLOCK(); 1100 if (!V_pf_status.running) 1101 error = ENOENT; 1102 else { 1103 V_pf_status.running = 0; 1104 PF_RULES_WUNLOCK(); 1105 error = dehook_pf(); 1106 if (error) { 1107 V_pf_status.running = 1; 1108 DPFPRINTF(PF_DEBUG_MISC, 1109 ("pf: pfil unregistration failed\n")); 1110 } 1111 PF_RULES_WLOCK(); 1112 V_pf_status.since = time_second; 1113 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1114 } 1115 PF_RULES_WUNLOCK(); 1116 break; 1117 1118 case DIOCADDRULE: { 1119 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1120 struct pf_ruleset *ruleset; 1121 struct pf_rule *rule, *tail; 1122 struct pf_pooladdr *pa; 1123 struct pfi_kif *kif = NULL; 1124 int rs_num; 1125 1126 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1127 error = EINVAL; 1128 break; 1129 } 1130#ifndef INET 1131 if (pr->rule.af == AF_INET) { 1132 error = EAFNOSUPPORT; 1133 break; 1134 } 1135#endif /* INET */ 1136#ifndef INET6 1137 if (pr->rule.af == AF_INET6) { 1138 error = EAFNOSUPPORT; 1139 break; 1140 } 1141#endif /* INET6 */ 1142 1143 rule = malloc(sizeof(*rule), M_PFRULE, M_WAITOK); 1144 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1145 if (rule->ifname[0]) 1146 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 1147 rule->cuid = td->td_ucred->cr_ruid; 1148 rule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 1149 TAILQ_INIT(&rule->rpool.list); 1150 1151#define ERROUT(x) { error = (x); goto DIOCADDRULE_error; } 1152 1153 PF_RULES_WLOCK(); 1154 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1155 ruleset = pf_find_ruleset(pr->anchor); 1156 if (ruleset == NULL) 1157 ERROUT(EINVAL); 1158 rs_num = pf_get_ruleset_number(pr->rule.action); 1159 if (rs_num >= PF_RULESET_MAX) 1160 ERROUT(EINVAL); 1161 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1162 DPFPRINTF(PF_DEBUG_MISC, 1163 ("ticket: %d != [%d]%d\n", pr->ticket, rs_num, 1164 ruleset->rules[rs_num].inactive.ticket)); 1165 ERROUT(EBUSY); 1166 } 1167 if (pr->pool_ticket != V_ticket_pabuf) { 1168 DPFPRINTF(PF_DEBUG_MISC, 1169 ("pool_ticket: %d != %d\n", pr->pool_ticket, 1170 V_ticket_pabuf)); 1171 ERROUT(EBUSY); 1172 } 1173 1174 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1175 pf_rulequeue); 1176 if (tail) 1177 rule->nr = tail->nr + 1; 1178 else 1179 rule->nr = 0; 1180 if (rule->ifname[0]) { 1181 rule->kif = pfi_kif_attach(kif, rule->ifname); 1182 pfi_kif_ref(rule->kif); 1183 } else 1184 rule->kif = NULL; 1185 1186 if (rule->rtableid > 0 && rule->rtableid >= rt_numfibs) 1187 error = EBUSY; 1188 1189#ifdef ALTQ 1190 /* set queue IDs */ 1191 if (rule->qname[0] != 0) { 1192 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1193 error = EBUSY; 1194 else if (rule->pqname[0] != 0) { 1195 if ((rule->pqid = 1196 pf_qname2qid(rule->pqname)) == 0) 1197 error = EBUSY; 1198 } else 1199 rule->pqid = rule->qid; 1200 } 1201#endif 1202 if (rule->tagname[0]) 1203 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1204 error = EBUSY; 1205 if (rule->match_tagname[0]) 1206 if ((rule->match_tag = 1207 pf_tagname2tag(rule->match_tagname)) == 0) 1208 error = EBUSY; 1209 if (rule->rt && !rule->direction) 1210 error = EINVAL; 1211 if (!rule->log) 1212 rule->logif = 0; 1213 if (rule->logif >= PFLOGIFS_MAX) 1214 error = EINVAL; 1215 if (pf_addr_setup(ruleset, &rule->src.addr, rule->af)) 1216 error = ENOMEM; 1217 if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af)) 1218 error = ENOMEM; 1219 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1220 error = EINVAL; 1221 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 1222 if (pa->addr.type == PF_ADDR_TABLE) { 1223 pa->addr.p.tbl = pfr_attach_table(ruleset, 1224 pa->addr.v.tblname); 1225 if (pa->addr.p.tbl == NULL) 1226 error = ENOMEM; 1227 } 1228 1229 if (rule->overload_tblname[0]) { 1230 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1231 rule->overload_tblname)) == NULL) 1232 error = EINVAL; 1233 else 1234 rule->overload_tbl->pfrkt_flags |= 1235 PFR_TFLAG_ACTIVE; 1236 } 1237 1238 pf_mv_pool(&V_pf_pabuf, &rule->rpool.list); 1239 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1240 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1241 (rule->rt > PF_FASTROUTE)) && 1242 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1243 error = EINVAL; 1244 1245 if (error) { 1246 pf_free_rule(rule); 1247 PF_RULES_WUNLOCK(); 1248 break; 1249 } 1250 1251 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1252 rule->evaluations = rule->packets[0] = rule->packets[1] = 1253 rule->bytes[0] = rule->bytes[1] = 0; 1254 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1255 rule, entries); 1256 ruleset->rules[rs_num].inactive.rcount++; 1257 PF_RULES_WUNLOCK(); 1258 break; 1259 1260#undef ERROUT 1261DIOCADDRULE_error: 1262 PF_RULES_WUNLOCK(); 1263 free(rule, M_PFRULE); 1264 if (kif) 1265 free(kif, PFI_MTYPE); 1266 break; 1267 } 1268 1269 case DIOCGETRULES: { 1270 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1271 struct pf_ruleset *ruleset; 1272 struct pf_rule *tail; 1273 int rs_num; 1274 1275 PF_RULES_WLOCK(); 1276 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1277 ruleset = pf_find_ruleset(pr->anchor); 1278 if (ruleset == NULL) { 1279 PF_RULES_WUNLOCK(); 1280 error = EINVAL; 1281 break; 1282 } 1283 rs_num = pf_get_ruleset_number(pr->rule.action); 1284 if (rs_num >= PF_RULESET_MAX) { 1285 PF_RULES_WUNLOCK(); 1286 error = EINVAL; 1287 break; 1288 } 1289 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1290 pf_rulequeue); 1291 if (tail) 1292 pr->nr = tail->nr + 1; 1293 else 1294 pr->nr = 0; 1295 pr->ticket = ruleset->rules[rs_num].active.ticket; 1296 PF_RULES_WUNLOCK(); 1297 break; 1298 } 1299 1300 case DIOCGETRULE: { 1301 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1302 struct pf_ruleset *ruleset; 1303 struct pf_rule *rule; 1304 int rs_num, i; 1305 1306 PF_RULES_WLOCK(); 1307 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1308 ruleset = pf_find_ruleset(pr->anchor); 1309 if (ruleset == NULL) { 1310 PF_RULES_WUNLOCK(); 1311 error = EINVAL; 1312 break; 1313 } 1314 rs_num = pf_get_ruleset_number(pr->rule.action); 1315 if (rs_num >= PF_RULESET_MAX) { 1316 PF_RULES_WUNLOCK(); 1317 error = EINVAL; 1318 break; 1319 } 1320 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1321 PF_RULES_WUNLOCK(); 1322 error = EBUSY; 1323 break; 1324 } 1325 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1326 while ((rule != NULL) && (rule->nr != pr->nr)) 1327 rule = TAILQ_NEXT(rule, entries); 1328 if (rule == NULL) { 1329 PF_RULES_WUNLOCK(); 1330 error = EBUSY; 1331 break; 1332 } 1333 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1334 if (pf_anchor_copyout(ruleset, rule, pr)) { 1335 PF_RULES_WUNLOCK(); 1336 error = EBUSY; 1337 break; 1338 } 1339 pf_addr_copyout(&pr->rule.src.addr); 1340 pf_addr_copyout(&pr->rule.dst.addr); 1341 for (i = 0; i < PF_SKIP_COUNT; ++i) 1342 if (rule->skip[i].ptr == NULL) 1343 pr->rule.skip[i].nr = -1; 1344 else 1345 pr->rule.skip[i].nr = 1346 rule->skip[i].ptr->nr; 1347 1348 if (pr->action == PF_GET_CLR_CNTR) { 1349 rule->evaluations = 0; 1350 rule->packets[0] = rule->packets[1] = 0; 1351 rule->bytes[0] = rule->bytes[1] = 0; 1352 rule->states_tot = 0; 1353 } 1354 PF_RULES_WUNLOCK(); 1355 break; 1356 } 1357 1358 case DIOCCHANGERULE: { 1359 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1360 struct pf_ruleset *ruleset; 1361 struct pf_rule *oldrule = NULL, *newrule = NULL; 1362 struct pfi_kif *kif = NULL; 1363 struct pf_pooladdr *pa; 1364 u_int32_t nr = 0; 1365 int rs_num; 1366 1367 if (pcr->action < PF_CHANGE_ADD_HEAD || 1368 pcr->action > PF_CHANGE_GET_TICKET) { 1369 error = EINVAL; 1370 break; 1371 } 1372 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1373 error = EINVAL; 1374 break; 1375 } 1376 1377 if (pcr->action != PF_CHANGE_REMOVE) { 1378#ifndef INET 1379 if (pcr->rule.af == AF_INET) { 1380 error = EAFNOSUPPORT; 1381 break; 1382 } 1383#endif /* INET */ 1384#ifndef INET6 1385 if (pcr->rule.af == AF_INET6) { 1386 error = EAFNOSUPPORT; 1387 break; 1388 } 1389#endif /* INET6 */ 1390 newrule = malloc(sizeof(*newrule), M_PFRULE, M_WAITOK); 1391 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1392 newrule->cuid = td->td_ucred->cr_ruid; 1393 newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 1394 TAILQ_INIT(&newrule->rpool.list); 1395 /* Initialize refcounting. */ 1396 newrule->states_cur = 0; 1397 newrule->entries.tqe_prev = NULL; 1398 1399 if (newrule->ifname[0]) 1400 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 1401 } 1402 1403#define ERROUT(x) { error = (x); goto DIOCCHANGERULE_error; } 1404 1405 PF_RULES_WLOCK(); 1406 if (!(pcr->action == PF_CHANGE_REMOVE || 1407 pcr->action == PF_CHANGE_GET_TICKET) && 1408 pcr->pool_ticket != V_ticket_pabuf) 1409 ERROUT(EBUSY); 1410 1411 ruleset = pf_find_ruleset(pcr->anchor); 1412 if (ruleset == NULL) 1413 ERROUT(EINVAL); 1414 1415 rs_num = pf_get_ruleset_number(pcr->rule.action); 1416 if (rs_num >= PF_RULESET_MAX) 1417 ERROUT(EINVAL); 1418 1419 if (pcr->action == PF_CHANGE_GET_TICKET) { 1420 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1421 ERROUT(0); 1422 } else if (pcr->ticket != 1423 ruleset->rules[rs_num].active.ticket) 1424 ERROUT(EINVAL); 1425 1426 if (pcr->action != PF_CHANGE_REMOVE) { 1427 if (newrule->ifname[0]) { 1428 newrule->kif = pfi_kif_attach(kif, 1429 newrule->ifname); 1430 pfi_kif_ref(newrule->kif); 1431 } else 1432 newrule->kif = NULL; 1433 1434 if (newrule->rtableid > 0 && 1435 newrule->rtableid >= rt_numfibs) 1436 error = EBUSY; 1437 1438#ifdef ALTQ 1439 /* set queue IDs */ 1440 if (newrule->qname[0] != 0) { 1441 if ((newrule->qid = 1442 pf_qname2qid(newrule->qname)) == 0) 1443 error = EBUSY; 1444 else if (newrule->pqname[0] != 0) { 1445 if ((newrule->pqid = 1446 pf_qname2qid(newrule->pqname)) == 0) 1447 error = EBUSY; 1448 } else 1449 newrule->pqid = newrule->qid; 1450 } 1451#endif /* ALTQ */ 1452 if (newrule->tagname[0]) 1453 if ((newrule->tag = 1454 pf_tagname2tag(newrule->tagname)) == 0) 1455 error = EBUSY; 1456 if (newrule->match_tagname[0]) 1457 if ((newrule->match_tag = pf_tagname2tag( 1458 newrule->match_tagname)) == 0) 1459 error = EBUSY; 1460 if (newrule->rt && !newrule->direction) 1461 error = EINVAL; 1462 if (!newrule->log) 1463 newrule->logif = 0; 1464 if (newrule->logif >= PFLOGIFS_MAX) 1465 error = EINVAL; 1466 if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af)) 1467 error = ENOMEM; 1468 if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af)) 1469 error = ENOMEM; 1470 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1471 error = EINVAL; 1472 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 1473 if (pa->addr.type == PF_ADDR_TABLE) { 1474 pa->addr.p.tbl = 1475 pfr_attach_table(ruleset, 1476 pa->addr.v.tblname); 1477 if (pa->addr.p.tbl == NULL) 1478 error = ENOMEM; 1479 } 1480 1481 if (newrule->overload_tblname[0]) { 1482 if ((newrule->overload_tbl = pfr_attach_table( 1483 ruleset, newrule->overload_tblname)) == 1484 NULL) 1485 error = EINVAL; 1486 else 1487 newrule->overload_tbl->pfrkt_flags |= 1488 PFR_TFLAG_ACTIVE; 1489 } 1490 1491 pf_mv_pool(&V_pf_pabuf, &newrule->rpool.list); 1492 if (((((newrule->action == PF_NAT) || 1493 (newrule->action == PF_RDR) || 1494 (newrule->action == PF_BINAT) || 1495 (newrule->rt > PF_FASTROUTE)) && 1496 !newrule->anchor)) && 1497 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1498 error = EINVAL; 1499 1500 if (error) { 1501 pf_free_rule(newrule); 1502 PF_RULES_WUNLOCK(); 1503 break; 1504 } 1505 1506 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1507 newrule->evaluations = 0; 1508 newrule->packets[0] = newrule->packets[1] = 0; 1509 newrule->bytes[0] = newrule->bytes[1] = 0; 1510 } 1511 pf_empty_pool(&V_pf_pabuf); 1512 1513 if (pcr->action == PF_CHANGE_ADD_HEAD) 1514 oldrule = TAILQ_FIRST( 1515 ruleset->rules[rs_num].active.ptr); 1516 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1517 oldrule = TAILQ_LAST( 1518 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1519 else { 1520 oldrule = TAILQ_FIRST( 1521 ruleset->rules[rs_num].active.ptr); 1522 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1523 oldrule = TAILQ_NEXT(oldrule, entries); 1524 if (oldrule == NULL) { 1525 if (newrule != NULL) 1526 pf_free_rule(newrule); 1527 PF_RULES_WUNLOCK(); 1528 error = EINVAL; 1529 break; 1530 } 1531 } 1532 1533 if (pcr->action == PF_CHANGE_REMOVE) { 1534 pf_unlink_rule(ruleset->rules[rs_num].active.ptr, 1535 oldrule); 1536 ruleset->rules[rs_num].active.rcount--; 1537 } else { 1538 if (oldrule == NULL) 1539 TAILQ_INSERT_TAIL( 1540 ruleset->rules[rs_num].active.ptr, 1541 newrule, entries); 1542 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1543 pcr->action == PF_CHANGE_ADD_BEFORE) 1544 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1545 else 1546 TAILQ_INSERT_AFTER( 1547 ruleset->rules[rs_num].active.ptr, 1548 oldrule, newrule, entries); 1549 ruleset->rules[rs_num].active.rcount++; 1550 } 1551 1552 nr = 0; 1553 TAILQ_FOREACH(oldrule, 1554 ruleset->rules[rs_num].active.ptr, entries) 1555 oldrule->nr = nr++; 1556 1557 ruleset->rules[rs_num].active.ticket++; 1558 1559 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1560 pf_remove_if_empty_ruleset(ruleset); 1561 1562 PF_RULES_WUNLOCK(); 1563 break; 1564 1565#undef ERROUT 1566DIOCCHANGERULE_error: 1567 PF_RULES_WUNLOCK(); 1568 if (newrule != NULL) 1569 free(newrule, M_PFRULE); 1570 if (kif != NULL) 1571 free(kif, PFI_MTYPE); 1572 break; 1573 } 1574 1575 case DIOCCLRSTATES: { 1576 struct pf_state *s; 1577 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1578 u_int i, killed = 0; 1579 1580 for (i = 0; i <= V_pf_hashmask; i++) { 1581 struct pf_idhash *ih = &V_pf_idhash[i]; 1582 1583relock_DIOCCLRSTATES: 1584 PF_HASHROW_LOCK(ih); 1585 LIST_FOREACH(s, &ih->states, entry) 1586 if (!psk->psk_ifname[0] || 1587 !strcmp(psk->psk_ifname, 1588 s->kif->pfik_name)) { 1589 /* 1590 * Don't send out individual 1591 * delete messages. 1592 */ 1593 s->state_flags |= PFSTATE_NOSYNC; 1594 pf_unlink_state(s, PF_ENTER_LOCKED); 1595 killed++; 1596 goto relock_DIOCCLRSTATES; 1597 } 1598 PF_HASHROW_UNLOCK(ih); 1599 } 1600 psk->psk_killed = killed; 1601 if (pfsync_clear_states_ptr != NULL) 1602 pfsync_clear_states_ptr(V_pf_status.hostid, psk->psk_ifname); 1603 break; 1604 } 1605 1606 case DIOCKILLSTATES: { 1607 struct pf_state *s; 1608 struct pf_state_key *sk; 1609 struct pf_addr *srcaddr, *dstaddr; 1610 u_int16_t srcport, dstport; 1611 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1612 u_int i, killed = 0; 1613 1614 if (psk->psk_pfcmp.id) { 1615 if (psk->psk_pfcmp.creatorid == 0) 1616 psk->psk_pfcmp.creatorid = V_pf_status.hostid; 1617 if ((s = pf_find_state_byid(psk->psk_pfcmp.id, 1618 psk->psk_pfcmp.creatorid))) { 1619 pf_unlink_state(s, PF_ENTER_LOCKED); 1620 psk->psk_killed = 1; 1621 } 1622 break; 1623 } 1624 1625 for (i = 0; i <= V_pf_hashmask; i++) { 1626 struct pf_idhash *ih = &V_pf_idhash[i]; 1627 1628relock_DIOCKILLSTATES: 1629 PF_HASHROW_LOCK(ih); 1630 LIST_FOREACH(s, &ih->states, entry) { 1631 sk = s->key[PF_SK_WIRE]; 1632 if (s->direction == PF_OUT) { 1633 srcaddr = &sk->addr[1]; 1634 dstaddr = &sk->addr[0]; 1635 srcport = sk->port[0]; 1636 dstport = sk->port[0]; 1637 } else { 1638 srcaddr = &sk->addr[0]; 1639 dstaddr = &sk->addr[1]; 1640 srcport = sk->port[0]; 1641 dstport = sk->port[0]; 1642 } 1643 1644 if ((!psk->psk_af || sk->af == psk->psk_af) 1645 && (!psk->psk_proto || psk->psk_proto == 1646 sk->proto) && 1647 PF_MATCHA(psk->psk_src.neg, 1648 &psk->psk_src.addr.v.a.addr, 1649 &psk->psk_src.addr.v.a.mask, 1650 srcaddr, sk->af) && 1651 PF_MATCHA(psk->psk_dst.neg, 1652 &psk->psk_dst.addr.v.a.addr, 1653 &psk->psk_dst.addr.v.a.mask, 1654 dstaddr, sk->af) && 1655 (psk->psk_src.port_op == 0 || 1656 pf_match_port(psk->psk_src.port_op, 1657 psk->psk_src.port[0], psk->psk_src.port[1], 1658 srcport)) && 1659 (psk->psk_dst.port_op == 0 || 1660 pf_match_port(psk->psk_dst.port_op, 1661 psk->psk_dst.port[0], psk->psk_dst.port[1], 1662 dstport)) && 1663 (!psk->psk_label[0] || 1664 (s->rule.ptr->label[0] && 1665 !strcmp(psk->psk_label, 1666 s->rule.ptr->label))) && 1667 (!psk->psk_ifname[0] || 1668 !strcmp(psk->psk_ifname, 1669 s->kif->pfik_name))) { 1670 pf_unlink_state(s, PF_ENTER_LOCKED); 1671 killed++; 1672 goto relock_DIOCKILLSTATES; 1673 } 1674 } 1675 PF_HASHROW_UNLOCK(ih); 1676 } 1677 psk->psk_killed = killed; 1678 break; 1679 } 1680 1681 case DIOCADDSTATE: { 1682 struct pfioc_state *ps = (struct pfioc_state *)addr; 1683 struct pfsync_state *sp = &ps->state; 1684 1685 if (sp->timeout >= PFTM_MAX && 1686 sp->timeout != PFTM_UNTIL_PACKET) { 1687 error = EINVAL; 1688 break; 1689 } 1690 if (pfsync_state_import_ptr != NULL) { 1691 PF_RULES_RLOCK(); 1692 error = pfsync_state_import_ptr(sp, PFSYNC_SI_IOCTL); 1693 PF_RULES_RUNLOCK(); 1694 } else 1695 error = EOPNOTSUPP; 1696 break; 1697 } 1698 1699 case DIOCGETSTATE: { 1700 struct pfioc_state *ps = (struct pfioc_state *)addr; 1701 struct pf_state *s; 1702 1703 s = pf_find_state_byid(ps->state.id, ps->state.creatorid); 1704 if (s == NULL) { 1705 error = ENOENT; 1706 break; 1707 } 1708 1709 pfsync_state_export(&ps->state, s); 1710 PF_STATE_UNLOCK(s); 1711 break; 1712 } 1713 1714 case DIOCGETSTATES: { 1715 struct pfioc_states *ps = (struct pfioc_states *)addr; 1716 struct pf_state *s; 1717 struct pfsync_state *pstore, *p; 1718 int i, nr; 1719 1720 if (ps->ps_len == 0) { 1721 nr = uma_zone_get_cur(V_pf_state_z); 1722 ps->ps_len = sizeof(struct pfsync_state) * nr; 1723 break; 1724 } 1725 1726 p = pstore = malloc(ps->ps_len, M_TEMP, M_WAITOK); 1727 nr = 0; 1728 1729 for (i = 0; i <= V_pf_hashmask; i++) { 1730 struct pf_idhash *ih = &V_pf_idhash[i]; 1731 1732 PF_HASHROW_LOCK(ih); 1733 LIST_FOREACH(s, &ih->states, entry) { 1734 1735 if (s->timeout == PFTM_UNLINKED) 1736 continue; 1737 1738 if ((nr+1) * sizeof(*p) > ps->ps_len) { 1739 PF_HASHROW_UNLOCK(ih); 1740 goto DIOCGETSTATES_full; 1741 } 1742 pfsync_state_export(p, s); 1743 p++; 1744 nr++; 1745 } 1746 PF_HASHROW_UNLOCK(ih); 1747 } 1748DIOCGETSTATES_full: 1749 error = copyout(pstore, ps->ps_states, 1750 sizeof(struct pfsync_state) * nr); 1751 if (error) { 1752 free(pstore, M_TEMP); 1753 break; 1754 } 1755 ps->ps_len = sizeof(struct pfsync_state) * nr; 1756 free(pstore, M_TEMP); 1757 1758 break; 1759 } 1760 1761 case DIOCGETSTATUS: { 1762 struct pf_status *s = (struct pf_status *)addr; 1763 PF_RULES_RLOCK(); 1764 bcopy(&V_pf_status, s, sizeof(struct pf_status)); 1765 pfi_update_status(s->ifname, s); 1766 PF_RULES_RUNLOCK(); 1767 break; 1768 } 1769 1770 case DIOCSETSTATUSIF: { 1771 struct pfioc_if *pi = (struct pfioc_if *)addr; 1772 1773 if (pi->ifname[0] == 0) { 1774 bzero(V_pf_status.ifname, IFNAMSIZ); 1775 break; 1776 } 1777 PF_RULES_WLOCK(); 1778 strlcpy(V_pf_status.ifname, pi->ifname, IFNAMSIZ); 1779 PF_RULES_WUNLOCK(); 1780 break; 1781 } 1782 1783 case DIOCCLRSTATUS: { 1784 PF_RULES_WLOCK(); 1785 bzero(V_pf_status.counters, sizeof(V_pf_status.counters)); 1786 bzero(V_pf_status.fcounters, sizeof(V_pf_status.fcounters)); 1787 bzero(V_pf_status.scounters, sizeof(V_pf_status.scounters)); 1788 V_pf_status.since = time_second; 1789 if (*V_pf_status.ifname) 1790 pfi_update_status(V_pf_status.ifname, NULL); 1791 PF_RULES_WUNLOCK(); 1792 break; 1793 } 1794 1795 case DIOCNATLOOK: { 1796 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1797 struct pf_state_key *sk; 1798 struct pf_state *state; 1799 struct pf_state_key_cmp key; 1800 int m = 0, direction = pnl->direction; 1801 int sidx, didx; 1802 1803 /* NATLOOK src and dst are reversed, so reverse sidx/didx */ 1804 sidx = (direction == PF_IN) ? 1 : 0; 1805 didx = (direction == PF_IN) ? 0 : 1; 1806 1807 if (!pnl->proto || 1808 PF_AZERO(&pnl->saddr, pnl->af) || 1809 PF_AZERO(&pnl->daddr, pnl->af) || 1810 ((pnl->proto == IPPROTO_TCP || 1811 pnl->proto == IPPROTO_UDP) && 1812 (!pnl->dport || !pnl->sport))) 1813 error = EINVAL; 1814 else { 1815 bzero(&key, sizeof(key)); 1816 key.af = pnl->af; 1817 key.proto = pnl->proto; 1818 PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af); 1819 key.port[sidx] = pnl->sport; 1820 PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af); 1821 key.port[didx] = pnl->dport; 1822 1823 state = pf_find_state_all(&key, direction, &m); 1824 1825 if (m > 1) 1826 error = E2BIG; /* more than one state */ 1827 else if (state != NULL) { 1828 /* XXXGL: not locked read */ 1829 sk = state->key[sidx]; 1830 PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af); 1831 pnl->rsport = sk->port[sidx]; 1832 PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af); 1833 pnl->rdport = sk->port[didx]; 1834 } else 1835 error = ENOENT; 1836 } 1837 break; 1838 } 1839 1840 case DIOCSETTIMEOUT: { 1841 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1842 int old; 1843 1844 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1845 pt->seconds < 0) { 1846 error = EINVAL; 1847 break; 1848 } 1849 PF_RULES_WLOCK(); 1850 old = V_pf_default_rule.timeout[pt->timeout]; 1851 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 1852 pt->seconds = 1; 1853 V_pf_default_rule.timeout[pt->timeout] = pt->seconds; 1854 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 1855 wakeup(pf_purge_thread); 1856 pt->seconds = old; 1857 PF_RULES_WUNLOCK(); 1858 break; 1859 } 1860 1861 case DIOCGETTIMEOUT: { 1862 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1863 1864 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1865 error = EINVAL; 1866 break; 1867 } 1868 PF_RULES_RLOCK(); 1869 pt->seconds = V_pf_default_rule.timeout[pt->timeout]; 1870 PF_RULES_RUNLOCK(); 1871 break; 1872 } 1873 1874 case DIOCGETLIMIT: { 1875 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1876 1877 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1878 error = EINVAL; 1879 break; 1880 } 1881 PF_RULES_RLOCK(); 1882 pl->limit = V_pf_limits[pl->index].limit; 1883 PF_RULES_RUNLOCK(); 1884 break; 1885 } 1886 1887 case DIOCSETLIMIT: { 1888 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1889 int old_limit; 1890 1891 PF_RULES_WLOCK(); 1892 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1893 V_pf_limits[pl->index].zone == NULL) { 1894 PF_RULES_WUNLOCK(); 1895 error = EINVAL; 1896 break; 1897 } 1898 uma_zone_set_max(V_pf_limits[pl->index].zone, pl->limit); 1899 old_limit = V_pf_limits[pl->index].limit; 1900 V_pf_limits[pl->index].limit = pl->limit; 1901 pl->limit = old_limit; 1902 PF_RULES_WUNLOCK(); 1903 break; 1904 } 1905 1906 case DIOCSETDEBUG: { 1907 u_int32_t *level = (u_int32_t *)addr; 1908 1909 PF_RULES_WLOCK(); 1910 V_pf_status.debug = *level; 1911 PF_RULES_WUNLOCK(); 1912 break; 1913 } 1914 1915 case DIOCCLRRULECTRS: { 1916 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 1917 struct pf_ruleset *ruleset = &pf_main_ruleset; 1918 struct pf_rule *rule; 1919 1920 PF_RULES_WLOCK(); 1921 TAILQ_FOREACH(rule, 1922 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 1923 rule->evaluations = 0; 1924 rule->packets[0] = rule->packets[1] = 0; 1925 rule->bytes[0] = rule->bytes[1] = 0; 1926 } 1927 PF_RULES_WUNLOCK(); 1928 break; 1929 } 1930 1931 case DIOCGIFSPEED: { 1932 struct pf_ifspeed *psp = (struct pf_ifspeed *)addr; 1933 struct pf_ifspeed ps; 1934 struct ifnet *ifp; 1935 1936 if (psp->ifname[0] != 0) { 1937 /* Can we completely trust user-land? */ 1938 strlcpy(ps.ifname, psp->ifname, IFNAMSIZ); 1939 ifp = ifunit(ps.ifname); 1940 if (ifp != NULL) 1941 psp->baudrate = ifp->if_baudrate; 1942 else 1943 error = EINVAL; 1944 } else 1945 error = EINVAL; 1946 break; 1947 } 1948 1949#ifdef ALTQ 1950 case DIOCSTARTALTQ: { 1951 struct pf_altq *altq; 1952 1953 PF_RULES_WLOCK(); 1954 /* enable all altq interfaces on active list */ 1955 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 1956 if (altq->qname[0] == 0 && (altq->local_flags & 1957 PFALTQ_FLAG_IF_REMOVED) == 0) { 1958 error = pf_enable_altq(altq); 1959 if (error != 0) 1960 break; 1961 } 1962 } 1963 if (error == 0) 1964 V_pf_altq_running = 1; 1965 PF_RULES_WUNLOCK(); 1966 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 1967 break; 1968 } 1969 1970 case DIOCSTOPALTQ: { 1971 struct pf_altq *altq; 1972 1973 PF_RULES_WLOCK(); 1974 /* disable all altq interfaces on active list */ 1975 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 1976 if (altq->qname[0] == 0 && (altq->local_flags & 1977 PFALTQ_FLAG_IF_REMOVED) == 0) { 1978 error = pf_disable_altq(altq); 1979 if (error != 0) 1980 break; 1981 } 1982 } 1983 if (error == 0) 1984 V_pf_altq_running = 0; 1985 PF_RULES_WUNLOCK(); 1986 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 1987 break; 1988 } 1989 1990 case DIOCADDALTQ: { 1991 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 1992 struct pf_altq *altq, *a; 1993 struct ifnet *ifp; 1994 1995 altq = malloc(sizeof(*altq), M_PFALTQ, M_WAITOK); 1996 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 1997 altq->local_flags = 0; 1998 1999 PF_RULES_WLOCK(); 2000 if (pa->ticket != V_ticket_altqs_inactive) { 2001 PF_RULES_WUNLOCK(); 2002 free(altq, M_PFALTQ); 2003 error = EBUSY; 2004 break; 2005 } 2006 2007 /* 2008 * if this is for a queue, find the discipline and 2009 * copy the necessary fields 2010 */ 2011 if (altq->qname[0] != 0) { 2012 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 2013 PF_RULES_WUNLOCK(); 2014 error = EBUSY; 2015 free(altq, M_PFALTQ); 2016 break; 2017 } 2018 altq->altq_disc = NULL; 2019 TAILQ_FOREACH(a, V_pf_altqs_inactive, entries) { 2020 if (strncmp(a->ifname, altq->ifname, 2021 IFNAMSIZ) == 0 && a->qname[0] == 0) { 2022 altq->altq_disc = a->altq_disc; 2023 break; 2024 } 2025 } 2026 } 2027 2028 if ((ifp = ifunit(altq->ifname)) == NULL) 2029 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED; 2030 else 2031 error = altq_add(altq); 2032 2033 if (error) { 2034 PF_RULES_WUNLOCK(); 2035 free(altq, M_PFALTQ); 2036 break; 2037 } 2038 2039 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, altq, entries); 2040 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2041 PF_RULES_WUNLOCK(); 2042 break; 2043 } 2044 2045 case DIOCGETALTQS: { 2046 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2047 struct pf_altq *altq; 2048 2049 PF_RULES_RLOCK(); 2050 pa->nr = 0; 2051 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) 2052 pa->nr++; 2053 pa->ticket = V_ticket_altqs_active; 2054 PF_RULES_RUNLOCK(); 2055 break; 2056 } 2057 2058 case DIOCGETALTQ: { 2059 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2060 struct pf_altq *altq; 2061 u_int32_t nr; 2062 2063 PF_RULES_RLOCK(); 2064 if (pa->ticket != V_ticket_altqs_active) { 2065 PF_RULES_RUNLOCK(); 2066 error = EBUSY; 2067 break; 2068 } 2069 nr = 0; 2070 altq = TAILQ_FIRST(V_pf_altqs_active); 2071 while ((altq != NULL) && (nr < pa->nr)) { 2072 altq = TAILQ_NEXT(altq, entries); 2073 nr++; 2074 } 2075 if (altq == NULL) { 2076 PF_RULES_RUNLOCK(); 2077 error = EBUSY; 2078 break; 2079 } 2080 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2081 PF_RULES_RUNLOCK(); 2082 break; 2083 } 2084 2085 case DIOCCHANGEALTQ: 2086 /* CHANGEALTQ not supported yet! */ 2087 error = ENODEV; 2088 break; 2089 2090 case DIOCGETQSTATS: { 2091 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 2092 struct pf_altq *altq; 2093 u_int32_t nr; 2094 int nbytes; 2095 2096 PF_RULES_RLOCK(); 2097 if (pq->ticket != V_ticket_altqs_active) { 2098 PF_RULES_RUNLOCK(); 2099 error = EBUSY; 2100 break; 2101 } 2102 nbytes = pq->nbytes; 2103 nr = 0; 2104 altq = TAILQ_FIRST(V_pf_altqs_active); 2105 while ((altq != NULL) && (nr < pq->nr)) { 2106 altq = TAILQ_NEXT(altq, entries); 2107 nr++; 2108 } 2109 if (altq == NULL) { 2110 PF_RULES_RUNLOCK(); 2111 error = EBUSY; 2112 break; 2113 } 2114 2115 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) != 0) { 2116 PF_RULES_RUNLOCK(); 2117 error = ENXIO; 2118 break; 2119 } 2120 PF_RULES_RUNLOCK(); 2121 error = altq_getqstats(altq, pq->buf, &nbytes); 2122 if (error == 0) { 2123 pq->scheduler = altq->scheduler; 2124 pq->nbytes = nbytes; 2125 } 2126 break; 2127 } 2128#endif /* ALTQ */ 2129 2130 case DIOCBEGINADDRS: { 2131 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2132 2133 PF_RULES_WLOCK(); 2134 pf_empty_pool(&V_pf_pabuf); 2135 pp->ticket = ++V_ticket_pabuf; 2136 PF_RULES_WUNLOCK(); 2137 break; 2138 } 2139 2140 case DIOCADDADDR: { 2141 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2142 struct pf_pooladdr *pa; 2143 struct pfi_kif *kif = NULL; 2144 2145#ifndef INET 2146 if (pp->af == AF_INET) { 2147 error = EAFNOSUPPORT; 2148 break; 2149 } 2150#endif /* INET */ 2151#ifndef INET6 2152 if (pp->af == AF_INET6) { 2153 error = EAFNOSUPPORT; 2154 break; 2155 } 2156#endif /* INET6 */ 2157 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2158 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2159 pp->addr.addr.type != PF_ADDR_TABLE) { 2160 error = EINVAL; 2161 break; 2162 } 2163 pa = malloc(sizeof(*pa), M_PFRULE, M_WAITOK); 2164 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2165 if (pa->ifname[0]) 2166 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 2167 PF_RULES_WLOCK(); 2168 if (pp->ticket != V_ticket_pabuf) { 2169 PF_RULES_WUNLOCK(); 2170 if (pa->ifname[0]) 2171 free(kif, PFI_MTYPE); 2172 free(pa, M_PFRULE); 2173 error = EBUSY; 2174 break; 2175 } 2176 if (pa->ifname[0]) { 2177 pa->kif = pfi_kif_attach(kif, pa->ifname); 2178 pfi_kif_ref(pa->kif); 2179 } else 2180 pa->kif = NULL; 2181 if (pa->addr.type == PF_ADDR_DYNIFTL && ((error = 2182 pfi_dynaddr_setup(&pa->addr, pp->af)) != 0)) { 2183 if (pa->ifname[0]) 2184 pfi_kif_unref(pa->kif); 2185 PF_RULES_WUNLOCK(); 2186 free(pa, M_PFRULE); 2187 break; 2188 } 2189 TAILQ_INSERT_TAIL(&V_pf_pabuf, pa, entries); 2190 PF_RULES_WUNLOCK(); 2191 break; 2192 } 2193 2194 case DIOCGETADDRS: { 2195 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2196 struct pf_pool *pool; 2197 struct pf_pooladdr *pa; 2198 2199 PF_RULES_RLOCK(); 2200 pp->nr = 0; 2201 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2202 pp->r_num, 0, 1, 0); 2203 if (pool == NULL) { 2204 PF_RULES_RUNLOCK(); 2205 error = EBUSY; 2206 break; 2207 } 2208 TAILQ_FOREACH(pa, &pool->list, entries) 2209 pp->nr++; 2210 PF_RULES_RUNLOCK(); 2211 break; 2212 } 2213 2214 case DIOCGETADDR: { 2215 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2216 struct pf_pool *pool; 2217 struct pf_pooladdr *pa; 2218 u_int32_t nr = 0; 2219 2220 PF_RULES_RLOCK(); 2221 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2222 pp->r_num, 0, 1, 1); 2223 if (pool == NULL) { 2224 PF_RULES_RUNLOCK(); 2225 error = EBUSY; 2226 break; 2227 } 2228 pa = TAILQ_FIRST(&pool->list); 2229 while ((pa != NULL) && (nr < pp->nr)) { 2230 pa = TAILQ_NEXT(pa, entries); 2231 nr++; 2232 } 2233 if (pa == NULL) { 2234 PF_RULES_RUNLOCK(); 2235 error = EBUSY; 2236 break; 2237 } 2238 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2239 pf_addr_copyout(&pp->addr.addr); 2240 PF_RULES_RUNLOCK(); 2241 break; 2242 } 2243 2244 case DIOCCHANGEADDR: { 2245 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2246 struct pf_pool *pool; 2247 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2248 struct pf_ruleset *ruleset; 2249 struct pfi_kif *kif = NULL; 2250 2251 if (pca->action < PF_CHANGE_ADD_HEAD || 2252 pca->action > PF_CHANGE_REMOVE) { 2253 error = EINVAL; 2254 break; 2255 } 2256 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2257 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2258 pca->addr.addr.type != PF_ADDR_TABLE) { 2259 error = EINVAL; 2260 break; 2261 } 2262 2263 if (pca->action != PF_CHANGE_REMOVE) { 2264#ifndef INET 2265 if (pca->af == AF_INET) { 2266 error = EAFNOSUPPORT; 2267 break; 2268 } 2269#endif /* INET */ 2270#ifndef INET6 2271 if (pca->af == AF_INET6) { 2272 error = EAFNOSUPPORT; 2273 break; 2274 } 2275#endif /* INET6 */ 2276 newpa = malloc(sizeof(*newpa), M_PFRULE, M_WAITOK); 2277 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2278 if (newpa->ifname[0]) 2279 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 2280 } 2281 2282#define ERROUT(x) { error = (x); goto DIOCCHANGEADDR_error; } 2283 PF_RULES_WLOCK(); 2284 ruleset = pf_find_ruleset(pca->anchor); 2285 if (ruleset == NULL) 2286 ERROUT(EBUSY); 2287 2288 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2289 pca->r_num, pca->r_last, 1, 1); 2290 if (pool == NULL) 2291 ERROUT(EBUSY); 2292 2293 if (pca->action != PF_CHANGE_REMOVE) { 2294 if (newpa->ifname[0]) { 2295 newpa->kif = pfi_kif_attach(kif, newpa->ifname); 2296 pfi_kif_ref(newpa->kif); 2297 } else 2298 newpa->kif = NULL; 2299 2300 switch (newpa->addr.type) { 2301 case PF_ADDR_DYNIFTL: 2302 error = pfi_dynaddr_setup(&newpa->addr, 2303 pca->af); 2304 break; 2305 case PF_ADDR_TABLE: 2306 newpa->addr.p.tbl = pfr_attach_table(ruleset, 2307 newpa->addr.v.tblname); 2308 if (newpa->addr.p.tbl == NULL) 2309 error = ENOMEM; 2310 break; 2311 } 2312 if (error) { 2313 if (newpa->kif) 2314 pfi_kif_unref(newpa->kif); 2315 PF_RULES_WUNLOCK(); 2316 free(newpa, M_PFRULE); 2317 break; 2318 } 2319 } 2320 2321 if (pca->action == PF_CHANGE_ADD_HEAD) 2322 oldpa = TAILQ_FIRST(&pool->list); 2323 else if (pca->action == PF_CHANGE_ADD_TAIL) 2324 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2325 else { 2326 int i = 0; 2327 2328 oldpa = TAILQ_FIRST(&pool->list); 2329 while ((oldpa != NULL) && (i < pca->nr)) { 2330 oldpa = TAILQ_NEXT(oldpa, entries); 2331 i++; 2332 } 2333 if (oldpa == NULL) { 2334 PF_RULES_WUNLOCK(); 2335 error = EINVAL; 2336 break; 2337 } 2338 } 2339 2340 if (pca->action == PF_CHANGE_REMOVE) { 2341 TAILQ_REMOVE(&pool->list, oldpa, entries); 2342 switch (oldpa->addr.type) { 2343 case PF_ADDR_DYNIFTL: 2344 pfi_dynaddr_remove(oldpa->addr.p.dyn); 2345 break; 2346 case PF_ADDR_TABLE: 2347 pfr_detach_table(oldpa->addr.p.tbl); 2348 break; 2349 } 2350 if (oldpa->kif) 2351 pfi_kif_unref(oldpa->kif); 2352 free(oldpa, M_PFRULE); 2353 } else { 2354 if (oldpa == NULL) 2355 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2356 else if (pca->action == PF_CHANGE_ADD_HEAD || 2357 pca->action == PF_CHANGE_ADD_BEFORE) 2358 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2359 else 2360 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2361 newpa, entries); 2362 } 2363 2364 pool->cur = TAILQ_FIRST(&pool->list); 2365 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, 2366 pca->af); 2367 PF_RULES_WUNLOCK(); 2368 break; 2369 2370#undef ERROUT 2371DIOCCHANGEADDR_error: 2372 PF_RULES_WUNLOCK(); 2373 if (newpa != NULL) 2374 free(newpa, M_PFRULE); 2375 if (kif != NULL) 2376 free(kif, PFI_MTYPE); 2377 break; 2378 } 2379 2380 case DIOCGETRULESETS: { 2381 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2382 struct pf_ruleset *ruleset; 2383 struct pf_anchor *anchor; 2384 2385 PF_RULES_RLOCK(); 2386 pr->path[sizeof(pr->path) - 1] = 0; 2387 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2388 PF_RULES_RUNLOCK(); 2389 error = ENOENT; 2390 break; 2391 } 2392 pr->nr = 0; 2393 if (ruleset->anchor == NULL) { 2394 /* XXX kludge for pf_main_ruleset */ 2395 RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors) 2396 if (anchor->parent == NULL) 2397 pr->nr++; 2398 } else { 2399 RB_FOREACH(anchor, pf_anchor_node, 2400 &ruleset->anchor->children) 2401 pr->nr++; 2402 } 2403 PF_RULES_RUNLOCK(); 2404 break; 2405 } 2406 2407 case DIOCGETRULESET: { 2408 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2409 struct pf_ruleset *ruleset; 2410 struct pf_anchor *anchor; 2411 u_int32_t nr = 0; 2412 2413 PF_RULES_RLOCK(); 2414 pr->path[sizeof(pr->path) - 1] = 0; 2415 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2416 PF_RULES_RUNLOCK(); 2417 error = ENOENT; 2418 break; 2419 } 2420 pr->name[0] = 0; 2421 if (ruleset->anchor == NULL) { 2422 /* XXX kludge for pf_main_ruleset */ 2423 RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors) 2424 if (anchor->parent == NULL && nr++ == pr->nr) { 2425 strlcpy(pr->name, anchor->name, 2426 sizeof(pr->name)); 2427 break; 2428 } 2429 } else { 2430 RB_FOREACH(anchor, pf_anchor_node, 2431 &ruleset->anchor->children) 2432 if (nr++ == pr->nr) { 2433 strlcpy(pr->name, anchor->name, 2434 sizeof(pr->name)); 2435 break; 2436 } 2437 } 2438 if (!pr->name[0]) 2439 error = EBUSY; 2440 PF_RULES_RUNLOCK(); 2441 break; 2442 } 2443 2444 case DIOCRCLRTABLES: { 2445 struct pfioc_table *io = (struct pfioc_table *)addr; 2446 2447 if (io->pfrio_esize != 0) { 2448 error = ENODEV; 2449 break; 2450 } 2451 PF_RULES_WLOCK(); 2452 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2453 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2454 PF_RULES_WUNLOCK(); 2455 break; 2456 } 2457 2458 case DIOCRADDTABLES: { 2459 struct pfioc_table *io = (struct pfioc_table *)addr; 2460 struct pfr_table *pfrts; 2461 size_t totlen; 2462 2463 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2464 error = ENODEV; 2465 break; 2466 } 2467 totlen = io->pfrio_size * sizeof(struct pfr_table); 2468 pfrts = malloc(totlen, M_TEMP, M_WAITOK); 2469 error = copyin(io->pfrio_buffer, pfrts, totlen); 2470 if (error) { 2471 free(pfrts, M_TEMP); 2472 break; 2473 } 2474 PF_RULES_WLOCK(); 2475 error = pfr_add_tables(pfrts, io->pfrio_size, 2476 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2477 PF_RULES_WUNLOCK(); 2478 free(pfrts, M_TEMP); 2479 break; 2480 } 2481 2482 case DIOCRDELTABLES: { 2483 struct pfioc_table *io = (struct pfioc_table *)addr; 2484 struct pfr_table *pfrts; 2485 size_t totlen; 2486 2487 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2488 error = ENODEV; 2489 break; 2490 } 2491 totlen = io->pfrio_size * sizeof(struct pfr_table); 2492 pfrts = malloc(totlen, M_TEMP, M_WAITOK); 2493 error = copyin(io->pfrio_buffer, pfrts, totlen); 2494 if (error) { 2495 free(pfrts, M_TEMP); 2496 break; 2497 } 2498 PF_RULES_WLOCK(); 2499 error = pfr_del_tables(pfrts, io->pfrio_size, 2500 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2501 PF_RULES_WUNLOCK(); 2502 free(pfrts, M_TEMP); 2503 break; 2504 } 2505 2506 case DIOCRGETTABLES: { 2507 struct pfioc_table *io = (struct pfioc_table *)addr; 2508 struct pfr_table *pfrts; 2509 size_t totlen; 2510 2511 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2512 error = ENODEV; 2513 break; 2514 } 2515 totlen = io->pfrio_size * sizeof(struct pfr_table); 2516 pfrts = malloc(totlen, M_TEMP, M_WAITOK); 2517 PF_RULES_RLOCK(); 2518 error = pfr_get_tables(&io->pfrio_table, pfrts, 2519 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2520 PF_RULES_RUNLOCK(); 2521 if (error == 0) 2522 error = copyout(pfrts, io->pfrio_buffer, totlen); 2523 free(pfrts, M_TEMP); 2524 break; 2525 } 2526 2527 case DIOCRGETTSTATS: { 2528 struct pfioc_table *io = (struct pfioc_table *)addr; 2529 struct pfr_tstats *pfrtstats; 2530 size_t totlen; 2531 2532 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2533 error = ENODEV; 2534 break; 2535 } 2536 totlen = io->pfrio_size * sizeof(struct pfr_tstats); 2537 pfrtstats = malloc(totlen, M_TEMP, M_WAITOK); 2538 PF_RULES_WLOCK(); 2539 error = pfr_get_tstats(&io->pfrio_table, pfrtstats, 2540 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2541 PF_RULES_WUNLOCK(); 2542 if (error == 0) 2543 error = copyout(pfrtstats, io->pfrio_buffer, totlen); 2544 free(pfrtstats, M_TEMP); 2545 break; 2546 } 2547 2548 case DIOCRCLRTSTATS: { 2549 struct pfioc_table *io = (struct pfioc_table *)addr; 2550 struct pfr_table *pfrts; 2551 size_t totlen; 2552 2553 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2554 error = ENODEV; 2555 break; 2556 } 2557 totlen = io->pfrio_size * sizeof(struct pfr_table); 2558 pfrts = malloc(totlen, M_TEMP, M_WAITOK); 2559 error = copyin(io->pfrio_buffer, pfrts, totlen); 2560 if (error) { 2561 free(pfrts, M_TEMP); 2562 break; 2563 } 2564 PF_RULES_WLOCK(); 2565 error = pfr_clr_tstats(pfrts, io->pfrio_size, 2566 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2567 PF_RULES_WUNLOCK(); 2568 free(pfrts, M_TEMP); 2569 break; 2570 } 2571 2572 case DIOCRSETTFLAGS: { 2573 struct pfioc_table *io = (struct pfioc_table *)addr; 2574 struct pfr_table *pfrts; 2575 size_t totlen; 2576 2577 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2578 error = ENODEV; 2579 break; 2580 } 2581 totlen = io->pfrio_size * sizeof(struct pfr_table); 2582 pfrts = malloc(totlen, M_TEMP, M_WAITOK); 2583 error = copyin(io->pfrio_buffer, pfrts, totlen); 2584 if (error) { 2585 free(pfrts, M_TEMP); 2586 break; 2587 } 2588 PF_RULES_WLOCK(); 2589 error = pfr_set_tflags(pfrts, io->pfrio_size, 2590 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2591 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2592 PF_RULES_WUNLOCK(); 2593 free(pfrts, M_TEMP); 2594 break; 2595 } 2596 2597 case DIOCRCLRADDRS: { 2598 struct pfioc_table *io = (struct pfioc_table *)addr; 2599 2600 if (io->pfrio_esize != 0) { 2601 error = ENODEV; 2602 break; 2603 } 2604 PF_RULES_WLOCK(); 2605 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2606 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2607 PF_RULES_WUNLOCK(); 2608 break; 2609 } 2610 2611 case DIOCRADDADDRS: { 2612 struct pfioc_table *io = (struct pfioc_table *)addr; 2613 struct pfr_addr *pfras; 2614 size_t totlen; 2615 2616 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2617 error = ENODEV; 2618 break; 2619 } 2620 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2621 pfras = malloc(totlen, M_TEMP, M_WAITOK); 2622 error = copyin(io->pfrio_buffer, pfras, totlen); 2623 if (error) { 2624 free(pfras, M_TEMP); 2625 break; 2626 } 2627 PF_RULES_WLOCK(); 2628 error = pfr_add_addrs(&io->pfrio_table, pfras, 2629 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2630 PFR_FLAG_USERIOCTL); 2631 PF_RULES_WUNLOCK(); 2632 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2633 error = copyout(pfras, io->pfrio_buffer, totlen); 2634 free(pfras, M_TEMP); 2635 break; 2636 } 2637 2638 case DIOCRDELADDRS: { 2639 struct pfioc_table *io = (struct pfioc_table *)addr; 2640 struct pfr_addr *pfras; 2641 size_t totlen; 2642 2643 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2644 error = ENODEV; 2645 break; 2646 } 2647 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2648 pfras = malloc(totlen, M_TEMP, M_WAITOK); 2649 error = copyin(io->pfrio_buffer, pfras, totlen); 2650 if (error) { 2651 free(pfras, M_TEMP); 2652 break; 2653 } 2654 PF_RULES_WLOCK(); 2655 error = pfr_del_addrs(&io->pfrio_table, pfras, 2656 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2657 PFR_FLAG_USERIOCTL); 2658 PF_RULES_WUNLOCK(); 2659 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2660 error = copyout(pfras, io->pfrio_buffer, totlen); 2661 free(pfras, M_TEMP); 2662 break; 2663 } 2664 2665 case DIOCRSETADDRS: { 2666 struct pfioc_table *io = (struct pfioc_table *)addr; 2667 struct pfr_addr *pfras; 2668 size_t totlen; 2669 2670 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2671 error = ENODEV; 2672 break; 2673 } 2674 totlen = (io->pfrio_size + io->pfrio_size2) * 2675 sizeof(struct pfr_addr); 2676 pfras = malloc(totlen, M_TEMP, M_WAITOK); 2677 error = copyin(io->pfrio_buffer, pfras, totlen); 2678 if (error) { 2679 free(pfras, M_TEMP); 2680 break; 2681 } 2682 PF_RULES_WLOCK(); 2683 error = pfr_set_addrs(&io->pfrio_table, pfras, 2684 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2685 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2686 PFR_FLAG_USERIOCTL, 0); 2687 PF_RULES_WUNLOCK(); 2688 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2689 error = copyout(pfras, io->pfrio_buffer, totlen); 2690 free(pfras, M_TEMP); 2691 break; 2692 } 2693 2694 case DIOCRGETADDRS: { 2695 struct pfioc_table *io = (struct pfioc_table *)addr; 2696 struct pfr_addr *pfras; 2697 size_t totlen; 2698 2699 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2700 error = ENODEV; 2701 break; 2702 } 2703 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2704 pfras = malloc(totlen, M_TEMP, M_WAITOK); 2705 PF_RULES_RLOCK(); 2706 error = pfr_get_addrs(&io->pfrio_table, pfras, 2707 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2708 PF_RULES_RUNLOCK(); 2709 if (error == 0) 2710 error = copyout(pfras, io->pfrio_buffer, totlen); 2711 free(pfras, M_TEMP); 2712 break; 2713 } 2714 2715 case DIOCRGETASTATS: { 2716 struct pfioc_table *io = (struct pfioc_table *)addr; 2717 struct pfr_astats *pfrastats; 2718 size_t totlen; 2719 2720 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2721 error = ENODEV; 2722 break; 2723 } 2724 totlen = io->pfrio_size * sizeof(struct pfr_astats); 2725 pfrastats = malloc(totlen, M_TEMP, M_WAITOK); 2726 PF_RULES_RLOCK(); 2727 error = pfr_get_astats(&io->pfrio_table, pfrastats, 2728 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2729 PF_RULES_RUNLOCK(); 2730 if (error == 0) 2731 error = copyout(pfrastats, io->pfrio_buffer, totlen); 2732 free(pfrastats, M_TEMP); 2733 break; 2734 } 2735 2736 case DIOCRCLRASTATS: { 2737 struct pfioc_table *io = (struct pfioc_table *)addr; 2738 struct pfr_addr *pfras; 2739 size_t totlen; 2740 2741 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2742 error = ENODEV; 2743 break; 2744 } 2745 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2746 pfras = malloc(totlen, M_TEMP, M_WAITOK); 2747 error = copyin(io->pfrio_buffer, pfras, totlen); 2748 if (error) { 2749 free(pfras, M_TEMP); 2750 break; 2751 } 2752 PF_RULES_WLOCK(); 2753 error = pfr_clr_astats(&io->pfrio_table, pfras, 2754 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2755 PFR_FLAG_USERIOCTL); 2756 PF_RULES_WUNLOCK(); 2757 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2758 error = copyout(pfras, io->pfrio_buffer, totlen); 2759 free(pfras, M_TEMP); 2760 break; 2761 } 2762 2763 case DIOCRTSTADDRS: { 2764 struct pfioc_table *io = (struct pfioc_table *)addr; 2765 struct pfr_addr *pfras; 2766 size_t totlen; 2767 2768 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2769 error = ENODEV; 2770 break; 2771 } 2772 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2773 pfras = malloc(totlen, M_TEMP, M_WAITOK); 2774 error = copyin(io->pfrio_buffer, pfras, totlen); 2775 if (error) { 2776 free(pfras, M_TEMP); 2777 break; 2778 } 2779 PF_RULES_RLOCK(); 2780 error = pfr_tst_addrs(&io->pfrio_table, pfras, 2781 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2782 PFR_FLAG_USERIOCTL); 2783 PF_RULES_RUNLOCK(); 2784 if (error == 0) 2785 error = copyout(pfras, io->pfrio_buffer, totlen); 2786 free(pfras, M_TEMP); 2787 break; 2788 } 2789 2790 case DIOCRINADEFINE: { 2791 struct pfioc_table *io = (struct pfioc_table *)addr; 2792 struct pfr_addr *pfras; 2793 size_t totlen; 2794 2795 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2796 error = ENODEV; 2797 break; 2798 } 2799 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2800 pfras = malloc(totlen, M_TEMP, M_WAITOK); 2801 error = copyin(io->pfrio_buffer, pfras, totlen); 2802 if (error) { 2803 free(pfras, M_TEMP); 2804 break; 2805 } 2806 PF_RULES_WLOCK(); 2807 error = pfr_ina_define(&io->pfrio_table, pfras, 2808 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 2809 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2810 PF_RULES_WUNLOCK(); 2811 free(pfras, M_TEMP); 2812 break; 2813 } 2814 2815 case DIOCOSFPADD: { 2816 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2817 PF_RULES_WLOCK(); 2818 error = pf_osfp_add(io); 2819 PF_RULES_WUNLOCK(); 2820 break; 2821 } 2822 2823 case DIOCOSFPGET: { 2824 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 2825 PF_RULES_RLOCK(); 2826 error = pf_osfp_get(io); 2827 PF_RULES_RUNLOCK(); 2828 break; 2829 } 2830 2831 case DIOCXBEGIN: { 2832 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2833 struct pfioc_trans_e *ioes, *ioe; 2834 size_t totlen; 2835 int i; 2836 2837 if (io->esize != sizeof(*ioe)) { 2838 error = ENODEV; 2839 break; 2840 } 2841 totlen = sizeof(struct pfioc_trans_e) * io->size; 2842 ioes = malloc(totlen, M_TEMP, M_WAITOK); 2843 error = copyin(io->array, ioes, totlen); 2844 if (error) { 2845 free(ioes, M_TEMP); 2846 break; 2847 } 2848 PF_RULES_WLOCK(); 2849 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 2850 switch (ioe->rs_num) { 2851#ifdef ALTQ 2852 case PF_RULESET_ALTQ: 2853 if (ioe->anchor[0]) { 2854 PF_RULES_WUNLOCK(); 2855 free(ioes, M_TEMP); 2856 error = EINVAL; 2857 goto fail; 2858 } 2859 if ((error = pf_begin_altq(&ioe->ticket))) { 2860 PF_RULES_WUNLOCK(); 2861 free(ioes, M_TEMP); 2862 goto fail; 2863 } 2864 break; 2865#endif /* ALTQ */ 2866 case PF_RULESET_TABLE: 2867 { 2868 struct pfr_table table; 2869 2870 bzero(&table, sizeof(table)); 2871 strlcpy(table.pfrt_anchor, ioe->anchor, 2872 sizeof(table.pfrt_anchor)); 2873 if ((error = pfr_ina_begin(&table, 2874 &ioe->ticket, NULL, 0))) { 2875 PF_RULES_WUNLOCK(); 2876 free(ioes, M_TEMP); 2877 goto fail; 2878 } 2879 break; 2880 } 2881 default: 2882 if ((error = pf_begin_rules(&ioe->ticket, 2883 ioe->rs_num, ioe->anchor))) { 2884 PF_RULES_WUNLOCK(); 2885 free(ioes, M_TEMP); 2886 goto fail; 2887 } 2888 break; 2889 } 2890 } 2891 PF_RULES_WUNLOCK(); 2892 error = copyout(ioes, io->array, totlen); 2893 free(ioes, M_TEMP); 2894 break; 2895 } 2896 2897 case DIOCXROLLBACK: { 2898 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2899 struct pfioc_trans_e *ioe, *ioes; 2900 size_t totlen; 2901 int i; 2902 2903 if (io->esize != sizeof(*ioe)) { 2904 error = ENODEV; 2905 break; 2906 } 2907 totlen = sizeof(struct pfioc_trans_e) * io->size; 2908 ioes = malloc(totlen, M_TEMP, M_WAITOK); 2909 error = copyin(io->array, ioes, totlen); 2910 if (error) { 2911 free(ioes, M_TEMP); 2912 break; 2913 } 2914 PF_RULES_WLOCK(); 2915 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 2916 switch (ioe->rs_num) { 2917#ifdef ALTQ 2918 case PF_RULESET_ALTQ: 2919 if (ioe->anchor[0]) { 2920 PF_RULES_WUNLOCK(); 2921 free(ioes, M_TEMP); 2922 error = EINVAL; 2923 goto fail; 2924 } 2925 if ((error = pf_rollback_altq(ioe->ticket))) { 2926 PF_RULES_WUNLOCK(); 2927 free(ioes, M_TEMP); 2928 goto fail; /* really bad */ 2929 } 2930 break; 2931#endif /* ALTQ */ 2932 case PF_RULESET_TABLE: 2933 { 2934 struct pfr_table table; 2935 2936 bzero(&table, sizeof(table)); 2937 strlcpy(table.pfrt_anchor, ioe->anchor, 2938 sizeof(table.pfrt_anchor)); 2939 if ((error = pfr_ina_rollback(&table, 2940 ioe->ticket, NULL, 0))) { 2941 PF_RULES_WUNLOCK(); 2942 free(ioes, M_TEMP); 2943 goto fail; /* really bad */ 2944 } 2945 break; 2946 } 2947 default: 2948 if ((error = pf_rollback_rules(ioe->ticket, 2949 ioe->rs_num, ioe->anchor))) { 2950 PF_RULES_WUNLOCK(); 2951 free(ioes, M_TEMP); 2952 goto fail; /* really bad */ 2953 } 2954 break; 2955 } 2956 } 2957 PF_RULES_WUNLOCK(); 2958 free(ioes, M_TEMP); 2959 break; 2960 } 2961 2962 case DIOCXCOMMIT: { 2963 struct pfioc_trans *io = (struct pfioc_trans *)addr; 2964 struct pfioc_trans_e *ioe, *ioes; 2965 struct pf_ruleset *rs; 2966 size_t totlen; 2967 int i; 2968 2969 if (io->esize != sizeof(*ioe)) { 2970 error = ENODEV; 2971 break; 2972 } 2973 totlen = sizeof(struct pfioc_trans_e) * io->size; 2974 ioes = malloc(totlen, M_TEMP, M_WAITOK); 2975 error = copyin(io->array, ioes, totlen); 2976 if (error) { 2977 free(ioes, M_TEMP); 2978 break; 2979 } 2980 PF_RULES_WLOCK(); 2981 /* First makes sure everything will succeed. */ 2982 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 2983 switch (ioe->rs_num) { 2984#ifdef ALTQ 2985 case PF_RULESET_ALTQ: 2986 if (ioe->anchor[0]) { 2987 PF_RULES_WUNLOCK(); 2988 free(ioes, M_TEMP); 2989 error = EINVAL; 2990 goto fail; 2991 } 2992 if (!V_altqs_inactive_open || ioe->ticket != 2993 V_ticket_altqs_inactive) { 2994 PF_RULES_WUNLOCK(); 2995 free(ioes, M_TEMP); 2996 error = EBUSY; 2997 goto fail; 2998 } 2999 break; 3000#endif /* ALTQ */ 3001 case PF_RULESET_TABLE: 3002 rs = pf_find_ruleset(ioe->anchor); 3003 if (rs == NULL || !rs->topen || ioe->ticket != 3004 rs->tticket) { 3005 PF_RULES_WUNLOCK(); 3006 free(ioes, M_TEMP); 3007 error = EBUSY; 3008 goto fail; 3009 } 3010 break; 3011 default: 3012 if (ioe->rs_num < 0 || ioe->rs_num >= 3013 PF_RULESET_MAX) { 3014 PF_RULES_WUNLOCK(); 3015 free(ioes, M_TEMP); 3016 error = EINVAL; 3017 goto fail; 3018 } 3019 rs = pf_find_ruleset(ioe->anchor); 3020 if (rs == NULL || 3021 !rs->rules[ioe->rs_num].inactive.open || 3022 rs->rules[ioe->rs_num].inactive.ticket != 3023 ioe->ticket) { 3024 PF_RULES_WUNLOCK(); 3025 free(ioes, M_TEMP); 3026 error = EBUSY; 3027 goto fail; 3028 } 3029 break; 3030 } 3031 } 3032 /* Now do the commit - no errors should happen here. */ 3033 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 3034 switch (ioe->rs_num) { 3035#ifdef ALTQ 3036 case PF_RULESET_ALTQ: 3037 if ((error = pf_commit_altq(ioe->ticket))) { 3038 PF_RULES_WUNLOCK(); 3039 free(ioes, M_TEMP); 3040 goto fail; /* really bad */ 3041 } 3042 break; 3043#endif /* ALTQ */ 3044 case PF_RULESET_TABLE: 3045 { 3046 struct pfr_table table; 3047 3048 bzero(&table, sizeof(table)); 3049 strlcpy(table.pfrt_anchor, ioe->anchor, 3050 sizeof(table.pfrt_anchor)); 3051 if ((error = pfr_ina_commit(&table, 3052 ioe->ticket, NULL, NULL, 0))) { 3053 PF_RULES_WUNLOCK(); 3054 free(ioes, M_TEMP); 3055 goto fail; /* really bad */ 3056 } 3057 break; 3058 } 3059 default: 3060 if ((error = pf_commit_rules(ioe->ticket, 3061 ioe->rs_num, ioe->anchor))) { 3062 PF_RULES_WUNLOCK(); 3063 free(ioes, M_TEMP); 3064 goto fail; /* really bad */ 3065 } 3066 break; 3067 } 3068 } 3069 PF_RULES_WUNLOCK(); 3070 free(ioes, M_TEMP); 3071 break; 3072 } 3073 3074 case DIOCGETSRCNODES: { 3075 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 3076 struct pf_srchash *sh; 3077 struct pf_src_node *n, *p, *pstore; 3078 uint32_t i, nr = 0; 3079 3080 if (psn->psn_len == 0) { 3081 for (i = 0, sh = V_pf_srchash; i < V_pf_srchashmask; 3082 i++, sh++) { 3083 PF_HASHROW_LOCK(sh); 3084 LIST_FOREACH(n, &sh->nodes, entry) 3085 nr++; 3086 PF_HASHROW_UNLOCK(sh); 3087 } 3088 psn->psn_len = sizeof(struct pf_src_node) * nr; 3089 break; 3090 } 3091 3092 p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK); 3093 for (i = 0, sh = V_pf_srchash; i < V_pf_srchashmask; 3094 i++, sh++) { 3095 PF_HASHROW_LOCK(sh); 3096 LIST_FOREACH(n, &sh->nodes, entry) { 3097 int secs = time_uptime, diff; 3098 3099 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 3100 break; 3101 3102 bcopy(n, p, sizeof(struct pf_src_node)); 3103 if (n->rule.ptr != NULL) 3104 p->rule.nr = n->rule.ptr->nr; 3105 p->creation = secs - p->creation; 3106 if (p->expire > secs) 3107 p->expire -= secs; 3108 else 3109 p->expire = 0; 3110 3111 /* Adjust the connection rate estimate. */ 3112 diff = secs - n->conn_rate.last; 3113 if (diff >= n->conn_rate.seconds) 3114 p->conn_rate.count = 0; 3115 else 3116 p->conn_rate.count -= 3117 n->conn_rate.count * diff / 3118 n->conn_rate.seconds; 3119 p++; 3120 nr++; 3121 } 3122 PF_HASHROW_UNLOCK(sh); 3123 } 3124 error = copyout(pstore, psn->psn_src_nodes, 3125 sizeof(struct pf_src_node) * nr); 3126 if (error) { 3127 free(pstore, M_TEMP); 3128 break; 3129 } 3130 psn->psn_len = sizeof(struct pf_src_node) * nr; 3131 free(pstore, M_TEMP); 3132 break; 3133 } 3134 3135 case DIOCCLRSRCNODES: { 3136 3137 pf_clear_srcnodes(NULL); 3138 pf_purge_expired_src_nodes(); 3139 V_pf_status.src_nodes = 0; 3140 break; 3141 } 3142 3143 case DIOCKILLSRCNODES: { 3144 struct pfioc_src_node_kill *psnk = 3145 (struct pfioc_src_node_kill *)addr; 3146 struct pf_srchash *sh; 3147 struct pf_src_node *sn; 3148 u_int i, killed = 0; 3149 3150 for (i = 0, sh = V_pf_srchash; i < V_pf_srchashmask; 3151 i++, sh++) { 3152 /* 3153 * XXXGL: we don't ever acquire sources hash lock 3154 * but if we ever do, the below call to pf_clear_srcnodes() 3155 * would lead to a LOR. 3156 */ 3157 PF_HASHROW_LOCK(sh); 3158 LIST_FOREACH(sn, &sh->nodes, entry) 3159 if (PF_MATCHA(psnk->psnk_src.neg, 3160 &psnk->psnk_src.addr.v.a.addr, 3161 &psnk->psnk_src.addr.v.a.mask, 3162 &sn->addr, sn->af) && 3163 PF_MATCHA(psnk->psnk_dst.neg, 3164 &psnk->psnk_dst.addr.v.a.addr, 3165 &psnk->psnk_dst.addr.v.a.mask, 3166 &sn->raddr, sn->af)) { 3167 /* Handle state to src_node linkage */ 3168 if (sn->states != 0) 3169 pf_clear_srcnodes(sn); 3170 sn->expire = 1; 3171 killed++; 3172 } 3173 PF_HASHROW_UNLOCK(sh); 3174 } 3175 3176 if (killed > 0) 3177 pf_purge_expired_src_nodes(); 3178 3179 psnk->psnk_killed = killed; 3180 break; 3181 } 3182 3183 case DIOCSETHOSTID: { 3184 u_int32_t *hostid = (u_int32_t *)addr; 3185 3186 PF_RULES_WLOCK(); 3187 if (*hostid == 0) 3188 V_pf_status.hostid = arc4random(); 3189 else 3190 V_pf_status.hostid = *hostid; 3191 PF_RULES_WUNLOCK(); 3192 break; 3193 } 3194 3195 case DIOCOSFPFLUSH: 3196 PF_RULES_WLOCK(); 3197 pf_osfp_flush(); 3198 PF_RULES_WUNLOCK(); 3199 break; 3200 3201 case DIOCIGETIFACES: { 3202 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3203 struct pfi_kif *ifstore; 3204 size_t bufsiz; 3205 3206 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 3207 error = ENODEV; 3208 break; 3209 } 3210 3211 bufsiz = io->pfiio_size * sizeof(struct pfi_kif); 3212 ifstore = malloc(bufsiz, M_TEMP, M_WAITOK); 3213 PF_RULES_RLOCK(); 3214 pfi_get_ifaces(io->pfiio_name, ifstore, &io->pfiio_size); 3215 PF_RULES_RUNLOCK(); 3216 error = copyout(ifstore, io->pfiio_buffer, bufsiz); 3217 free(ifstore, M_TEMP); 3218 break; 3219 } 3220 3221 case DIOCSETIFFLAG: { 3222 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3223 3224 PF_RULES_WLOCK(); 3225 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 3226 PF_RULES_WUNLOCK(); 3227 break; 3228 } 3229 3230 case DIOCCLRIFFLAG: { 3231 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3232 3233 PF_RULES_WLOCK(); 3234 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 3235 PF_RULES_WUNLOCK(); 3236 break; 3237 } 3238 3239 default: 3240 error = ENODEV; 3241 break; 3242 } 3243fail: 3244 CURVNET_RESTORE(); 3245 3246 return (error); 3247} 3248 3249void 3250pfsync_state_export(struct pfsync_state *sp, struct pf_state *st) 3251{ 3252 bzero(sp, sizeof(struct pfsync_state)); 3253 3254 /* copy from state key */ 3255 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; 3256 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1]; 3257 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0]; 3258 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1]; 3259 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0]; 3260 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1]; 3261 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0]; 3262 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1]; 3263 sp->proto = st->key[PF_SK_WIRE]->proto; 3264 sp->af = st->key[PF_SK_WIRE]->af; 3265 3266 /* copy from state */ 3267 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 3268 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr)); 3269 sp->creation = htonl(time_uptime - st->creation); 3270 sp->expire = pf_state_expires(st); 3271 if (sp->expire <= time_uptime) 3272 sp->expire = htonl(0); 3273 else 3274 sp->expire = htonl(sp->expire - time_uptime); 3275 3276 sp->direction = st->direction; 3277 sp->log = st->log; 3278 sp->timeout = st->timeout; 3279 sp->state_flags = st->state_flags; 3280 if (st->src_node) 3281 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 3282 if (st->nat_src_node) 3283 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 3284 3285 sp->id = st->id; 3286 sp->creatorid = st->creatorid; 3287 pf_state_peer_hton(&st->src, &sp->src); 3288 pf_state_peer_hton(&st->dst, &sp->dst); 3289 3290 if (st->rule.ptr == NULL) 3291 sp->rule = htonl(-1); 3292 else 3293 sp->rule = htonl(st->rule.ptr->nr); 3294 if (st->anchor.ptr == NULL) 3295 sp->anchor = htonl(-1); 3296 else 3297 sp->anchor = htonl(st->anchor.ptr->nr); 3298 if (st->nat_rule.ptr == NULL) 3299 sp->nat_rule = htonl(-1); 3300 else 3301 sp->nat_rule = htonl(st->nat_rule.ptr->nr); 3302 3303 pf_state_counter_hton(st->packets[0], sp->packets[0]); 3304 pf_state_counter_hton(st->packets[1], sp->packets[1]); 3305 pf_state_counter_hton(st->bytes[0], sp->bytes[0]); 3306 pf_state_counter_hton(st->bytes[1], sp->bytes[1]); 3307 3308} 3309 3310static void 3311pf_tbladdr_copyout(struct pf_addr_wrap *aw) 3312{ 3313 struct pfr_ktable *kt; 3314 3315 KASSERT(aw->type == PF_ADDR_TABLE, ("%s: type %u", __func__, aw->type)); 3316 3317 kt = aw->p.tbl; 3318 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 3319 kt = kt->pfrkt_root; 3320 aw->p.tbl = NULL; 3321 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 3322 kt->pfrkt_cnt : -1; 3323} 3324 3325/* 3326 * XXX - Check for version missmatch!!! 3327 */ 3328static void 3329pf_clear_states(void) 3330{ 3331 struct pf_state *s; 3332 u_int i; 3333 3334 for (i = 0; i <= V_pf_hashmask; i++) { 3335 struct pf_idhash *ih = &V_pf_idhash[i]; 3336relock: 3337 PF_HASHROW_LOCK(ih); 3338 LIST_FOREACH(s, &ih->states, entry) { 3339 s->timeout = PFTM_PURGE; 3340 /* Don't send out individual delete messages. */ 3341 s->sync_state = PFSTATE_NOSYNC; 3342 pf_unlink_state(s, PF_ENTER_LOCKED); 3343 goto relock; 3344 } 3345 PF_HASHROW_UNLOCK(ih); 3346 } 3347} 3348 3349static int 3350pf_clear_tables(void) 3351{ 3352 struct pfioc_table io; 3353 int error; 3354 3355 bzero(&io, sizeof(io)); 3356 3357 error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel, 3358 io.pfrio_flags); 3359 3360 return (error); 3361} 3362 3363static void 3364pf_clear_srcnodes(struct pf_src_node *n) 3365{ 3366 struct pf_state *s; 3367 int i; 3368 3369 for (i = 0; i <= V_pf_hashmask; i++) { 3370 struct pf_idhash *ih = &V_pf_idhash[i]; 3371 3372 PF_HASHROW_LOCK(ih); 3373 LIST_FOREACH(s, &ih->states, entry) { 3374 if (n == NULL || n == s->src_node) 3375 s->src_node = NULL; 3376 if (n == NULL || n == s->nat_src_node) 3377 s->nat_src_node = NULL; 3378 } 3379 PF_HASHROW_UNLOCK(ih); 3380 } 3381 3382 if (n == NULL) { 3383 struct pf_srchash *sh; 3384 3385 for (i = 0, sh = V_pf_srchash; i < V_pf_srchashmask; 3386 i++, sh++) { 3387 PF_HASHROW_LOCK(sh); 3388 LIST_FOREACH(n, &sh->nodes, entry) { 3389 n->expire = 1; 3390 n->states = 0; 3391 } 3392 PF_HASHROW_UNLOCK(sh); 3393 } 3394 } else { 3395 /* XXX: hash slot should already be locked here. */ 3396 n->expire = 1; 3397 n->states = 0; 3398 } 3399} 3400/* 3401 * XXX - Check for version missmatch!!! 3402 */ 3403 3404/* 3405 * Duplicate pfctl -Fa operation to get rid of as much as we can. 3406 */ 3407static int 3408shutdown_pf(void) 3409{ 3410 int error = 0; 3411 u_int32_t t[5]; 3412 char nn = '\0'; 3413 3414 V_pf_status.running = 0; 3415 do { 3416 if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn)) 3417 != 0) { 3418 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n")); 3419 break; 3420 } 3421 if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn)) 3422 != 0) { 3423 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n")); 3424 break; /* XXX: rollback? */ 3425 } 3426 if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn)) 3427 != 0) { 3428 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n")); 3429 break; /* XXX: rollback? */ 3430 } 3431 if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn)) 3432 != 0) { 3433 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n")); 3434 break; /* XXX: rollback? */ 3435 } 3436 if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn)) 3437 != 0) { 3438 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n")); 3439 break; /* XXX: rollback? */ 3440 } 3441 3442 /* XXX: these should always succeed here */ 3443 pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn); 3444 pf_commit_rules(t[1], PF_RULESET_FILTER, &nn); 3445 pf_commit_rules(t[2], PF_RULESET_NAT, &nn); 3446 pf_commit_rules(t[3], PF_RULESET_BINAT, &nn); 3447 pf_commit_rules(t[4], PF_RULESET_RDR, &nn); 3448 3449 if ((error = pf_clear_tables()) != 0) 3450 break; 3451 3452#ifdef ALTQ 3453 if ((error = pf_begin_altq(&t[0])) != 0) { 3454 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n")); 3455 break; 3456 } 3457 pf_commit_altq(t[0]); 3458#endif 3459 3460 pf_clear_states(); 3461 3462 pf_clear_srcnodes(NULL); 3463 3464 /* status does not use malloced mem so no need to cleanup */ 3465 /* fingerprints and interfaces have thier own cleanup code */ 3466 } while(0); 3467 3468 return (error); 3469} 3470 3471#ifdef INET 3472static int 3473pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, 3474 struct inpcb *inp) 3475{ 3476 int chk; 3477 3478 chk = pf_test(PF_IN, ifp, m, inp); 3479 if (chk && *m) { 3480 m_freem(*m); 3481 *m = NULL; 3482 } 3483 3484 return (chk); 3485} 3486 3487static int 3488pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, 3489 struct inpcb *inp) 3490{ 3491 int chk; 3492 3493 /* We need a proper CSUM befor we start (s. OpenBSD ip_output) */ 3494 if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 3495 in_delayed_cksum(*m); 3496 (*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 3497 } 3498 3499 chk = pf_test(PF_OUT, ifp, m, inp); 3500 if (chk && *m) { 3501 m_freem(*m); 3502 *m = NULL; 3503 } 3504 3505 return (chk); 3506} 3507#endif 3508 3509#ifdef INET6 3510static int 3511pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, 3512 struct inpcb *inp) 3513{ 3514 int chk; 3515 3516 /* 3517 * In case of loopback traffic IPv6 uses the real interface in 3518 * order to support scoped addresses. In order to support stateful 3519 * filtering we have change this to lo0 as it is the case in IPv4. 3520 */ 3521 CURVNET_SET(ifp->if_vnet); 3522 chk = pf_test6(PF_IN, (*m)->m_flags & M_LOOP ? V_loif : ifp, m, inp); 3523 CURVNET_RESTORE(); 3524 if (chk && *m) { 3525 m_freem(*m); 3526 *m = NULL; 3527 } 3528 return chk; 3529} 3530 3531static int 3532pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, 3533 struct inpcb *inp) 3534{ 3535 int chk; 3536 3537 /* We need a proper CSUM before we start (s. OpenBSD ip_output) */ 3538 if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 3539#ifdef INET 3540 /* XXX-BZ copy&paste error from r126261? */ 3541 in_delayed_cksum(*m); 3542#endif 3543 (*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 3544 } 3545 CURVNET_SET(ifp->if_vnet); 3546 chk = pf_test6(PF_OUT, ifp, m, inp); 3547 CURVNET_RESTORE(); 3548 if (chk && *m) { 3549 m_freem(*m); 3550 *m = NULL; 3551 } 3552 return chk; 3553} 3554#endif /* INET6 */ 3555 3556static int 3557hook_pf(void) 3558{ 3559#ifdef INET 3560 struct pfil_head *pfh_inet; 3561#endif 3562#ifdef INET6 3563 struct pfil_head *pfh_inet6; 3564#endif 3565 3566 if (V_pf_pfil_hooked) 3567 return (0); 3568 3569#ifdef INET 3570 pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3571 if (pfh_inet == NULL) 3572 return (ESRCH); /* XXX */ 3573 pfil_add_hook(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet); 3574 pfil_add_hook(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet); 3575#endif 3576#ifdef INET6 3577 pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3578 if (pfh_inet6 == NULL) { 3579#ifdef INET 3580 pfil_remove_hook(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, 3581 pfh_inet); 3582 pfil_remove_hook(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, 3583 pfh_inet); 3584#endif 3585 return (ESRCH); /* XXX */ 3586 } 3587 pfil_add_hook(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet6); 3588 pfil_add_hook(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet6); 3589#endif 3590 3591 V_pf_pfil_hooked = 1; 3592 return (0); 3593} 3594 3595static int 3596dehook_pf(void) 3597{ 3598#ifdef INET 3599 struct pfil_head *pfh_inet; 3600#endif 3601#ifdef INET6 3602 struct pfil_head *pfh_inet6; 3603#endif 3604 3605 if (V_pf_pfil_hooked == 0) 3606 return (0); 3607 3608#ifdef INET 3609 pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3610 if (pfh_inet == NULL) 3611 return (ESRCH); /* XXX */ 3612 pfil_remove_hook(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, 3613 pfh_inet); 3614 pfil_remove_hook(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, 3615 pfh_inet); 3616#endif 3617#ifdef INET6 3618 pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3619 if (pfh_inet6 == NULL) 3620 return (ESRCH); /* XXX */ 3621 pfil_remove_hook(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK, 3622 pfh_inet6); 3623 pfil_remove_hook(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK, 3624 pfh_inet6); 3625#endif 3626 3627 V_pf_pfil_hooked = 0; 3628 return (0); 3629} 3630 3631static int 3632pf_load(void) 3633{ 3634 int error; 3635 3636 VNET_ITERATOR_DECL(vnet_iter); 3637 3638 VNET_LIST_RLOCK(); 3639 VNET_FOREACH(vnet_iter) { 3640 CURVNET_SET(vnet_iter); 3641 V_pf_pfil_hooked = 0; 3642 V_pf_end_threads = 0; 3643 TAILQ_INIT(&V_pf_tags); 3644 TAILQ_INIT(&V_pf_qids); 3645 CURVNET_RESTORE(); 3646 } 3647 VNET_LIST_RUNLOCK(); 3648 3649 rw_init(&pf_rules_lock, "pf rulesets"); 3650 3651 pf_dev = make_dev(&pf_cdevsw, 0, 0, 0, 0600, PF_NAME); 3652 if ((error = pfattach()) != 0) 3653 return (error); 3654 3655 return (0); 3656} 3657 3658static int 3659pf_unload(void) 3660{ 3661 int error = 0; 3662 3663 PF_RULES_WLOCK(); 3664 V_pf_status.running = 0; 3665 PF_RULES_WUNLOCK(); 3666 swi_remove(V_pf_swi_cookie); 3667 error = dehook_pf(); 3668 if (error) { 3669 /* 3670 * Should not happen! 3671 * XXX Due to error code ESRCH, kldunload will show 3672 * a message like 'No such process'. 3673 */ 3674 printf("%s : pfil unregisteration fail\n", __FUNCTION__); 3675 return error; 3676 } 3677 PF_RULES_WLOCK(); 3678 shutdown_pf(); 3679 V_pf_end_threads = 1; 3680 while (V_pf_end_threads < 2) { 3681 wakeup_one(pf_purge_thread); 3682 rw_sleep(pf_purge_thread, &pf_rules_lock, 0, "pftmo", 0); 3683 } 3684 pf_normalize_cleanup(); 3685 pfi_cleanup(); 3686 pfr_cleanup(); 3687 pf_osfp_flush(); 3688 pf_cleanup(); 3689 PF_RULES_WUNLOCK(); 3690 destroy_dev(pf_dev); 3691 rw_destroy(&pf_rules_lock); 3692 3693 return (error); 3694} 3695 3696static int 3697pf_modevent(module_t mod, int type, void *data) 3698{ 3699 int error = 0; 3700 3701 switch(type) { 3702 case MOD_LOAD: 3703 error = pf_load(); 3704 break; 3705 case MOD_QUIESCE: 3706 /* 3707 * Module should not be unloaded due to race conditions. 3708 */ 3709 error = EBUSY; 3710 break; 3711 case MOD_UNLOAD: 3712 error = pf_unload(); 3713 break; 3714 default: 3715 error = EINVAL; 3716 break; 3717 } 3718 3719 return (error); 3720} 3721 3722static moduledata_t pf_mod = { 3723 "pf", 3724 pf_modevent, 3725 0 3726}; 3727 3728DECLARE_MODULE(pf, pf_mod, SI_SUB_PSEUDO, SI_ORDER_FIRST); 3729MODULE_VERSION(pf, PF_MODVER); 3730