1/* 2 * Copyright (c) 2007-2013 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29/* $apfw: pf_if.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */ 30/* $OpenBSD: pf_if.c,v 1.46 2006/12/13 09:01:59 itojun Exp $ */ 31 32/* 33 * Copyright 2005 Henning Brauer <henning@openbsd.org> 34 * Copyright 2005 Ryan McBride <mcbride@openbsd.org> 35 * Copyright (c) 2001 Daniel Hartmeier 36 * Copyright (c) 2003 Cedric Berger 37 * All rights reserved. 38 * 39 * Redistribution and use in source and binary forms, with or without 40 * modification, are permitted provided that the following conditions 41 * are met: 42 * 43 * - Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * - Redistributions in binary form must reproduce the above 46 * copyright notice, this list of conditions and the following 47 * disclaimer in the documentation and/or other materials provided 48 * with the distribution. 49 * 50 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 51 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 52 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 53 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 54 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 55 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 56 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 57 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 58 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 59 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 60 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 61 * POSSIBILITY OF SUCH DAMAGE. 62 */ 63 64#include <sys/param.h> 65#include <sys/systm.h> 66#include <sys/mbuf.h> 67#include <sys/filio.h> 68#include <sys/socket.h> 69#include <sys/socketvar.h> 70#include <sys/kernel.h> 71#include <sys/time.h> 72#include <sys/malloc.h> 73 74#include <net/if.h> 75#include <net/if_types.h> 76#include <net/if_var.h> 77 78#include <netinet/in.h> 79#include <netinet/in_var.h> 80#include <netinet/in_systm.h> 81#include <netinet/ip.h> 82#include <netinet/ip_var.h> 83 84#if INET6 85#include <netinet/ip6.h> 86#endif /* INET6 */ 87 88#include <net/pfvar.h> 89 90struct pfi_kif *pfi_all = NULL; 91 92static struct pool pfi_addr_pl; 93static struct pfi_ifhead pfi_ifs; 94static u_int32_t pfi_update = 1; 95static struct pfr_addr *pfi_buffer; 96static int pfi_buffer_cnt; 97static int pfi_buffer_max; 98 99__private_extern__ void pfi_kifaddr_update(void *); 100 101static void pfi_kif_update(struct pfi_kif *); 102static void pfi_dynaddr_update(struct pfi_dynaddr *dyn); 103static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, int, int); 104static void pfi_instance_add(struct ifnet *, int, int); 105static void pfi_address_add(struct sockaddr *, int, int); 106static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 107static int pfi_skip_if(const char *, struct pfi_kif *); 108static int pfi_unmask(void *); 109 110RB_PROTOTYPE_SC(static, pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 111RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 112 113#define PFI_BUFFER_MAX 0x10000 114#define PFI_MTYPE M_IFADDR 115 116#define IFG_ALL "ALL" 117 118void 119pfi_initialize(void) 120{ 121 if (pfi_all != NULL) /* already initialized */ 122 return; 123 124 pool_init(&pfi_addr_pl, sizeof (struct pfi_dynaddr), 0, 0, 0, 125 "pfiaddrpl", NULL); 126 pfi_buffer_max = 64; 127 pfi_buffer = _MALLOC(pfi_buffer_max * sizeof (*pfi_buffer), 128 PFI_MTYPE, M_WAITOK); 129 130 if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL) 131 panic("pfi_kif_get for pfi_all failed"); 132} 133 134#if 0 135void 136pfi_destroy(void) 137{ 138 pool_destroy(&pfi_addr_pl); 139 _FREE(pfi_buffer, PFI_MTYPE); 140} 141#endif 142 143struct pfi_kif * 144pfi_kif_get(const char *kif_name) 145{ 146 struct pfi_kif *kif; 147 struct pfi_kif_cmp s; 148 149 bzero(&s, sizeof (s)); 150 strlcpy(s.pfik_name, kif_name, sizeof (s.pfik_name)); 151 if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, 152 (struct pfi_kif *)(void *)&s)) != NULL) 153 return (kif); 154 155 /* create new one */ 156 if ((kif = _MALLOC(sizeof (*kif), PFI_MTYPE, M_WAITOK|M_ZERO)) == NULL) 157 return (NULL); 158 159 strlcpy(kif->pfik_name, kif_name, sizeof (kif->pfik_name)); 160 kif->pfik_tzero = pf_calendar_time_second(); 161 TAILQ_INIT(&kif->pfik_dynaddrs); 162 163 RB_INSERT(pfi_ifhead, &pfi_ifs, kif); 164 return (kif); 165} 166 167void 168pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what) 169{ 170 switch (what) { 171 case PFI_KIF_REF_RULE: 172 kif->pfik_rules++; 173 break; 174 case PFI_KIF_REF_STATE: 175 kif->pfik_states++; 176 break; 177 default: 178 panic("pfi_kif_ref with unknown type"); 179 } 180} 181 182void 183pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what) 184{ 185 if (kif == NULL) 186 return; 187 188 switch (what) { 189 case PFI_KIF_REF_NONE: 190 break; 191 case PFI_KIF_REF_RULE: 192 if (kif->pfik_rules <= 0) { 193 printf("pfi_kif_unref: rules refcount <= 0\n"); 194 return; 195 } 196 kif->pfik_rules--; 197 break; 198 case PFI_KIF_REF_STATE: 199 if (kif->pfik_states <= 0) { 200 printf("pfi_kif_unref: state refcount <= 0\n"); 201 return; 202 } 203 kif->pfik_states--; 204 break; 205 default: 206 panic("pfi_kif_unref with unknown type"); 207 } 208 209 if (kif->pfik_ifp != NULL || kif == pfi_all) 210 return; 211 212 if (kif->pfik_rules || kif->pfik_states) 213 return; 214 215 RB_REMOVE(pfi_ifhead, &pfi_ifs, kif); 216 _FREE(kif, PFI_MTYPE); 217} 218 219int 220pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif) 221{ 222 223 if (rule_kif == NULL || rule_kif == packet_kif) 224 return (1); 225 226 return (0); 227} 228 229void 230pfi_attach_ifnet(struct ifnet *ifp) 231{ 232 struct pfi_kif *kif; 233 234 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 235 236 pfi_update++; 237 if ((kif = pfi_kif_get(if_name(ifp))) == NULL) 238 panic("pfi_kif_get failed"); 239 240 ifnet_lock_exclusive(ifp); 241 kif->pfik_ifp = ifp; 242 ifp->if_pf_kif = kif; 243 ifnet_lock_done(ifp); 244 245 pfi_kif_update(kif); 246} 247 248/* 249 * Caller holds ifnet lock as writer (exclusive); 250 */ 251void 252pfi_detach_ifnet(struct ifnet *ifp) 253{ 254 struct pfi_kif *kif; 255 256 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 257 258 if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL) 259 return; 260 261 pfi_update++; 262 pfi_kif_update(kif); 263 264 ifnet_lock_exclusive(ifp); 265 kif->pfik_ifp = NULL; 266 ifp->if_pf_kif = NULL; 267 ifnet_lock_done(ifp); 268 269 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 270} 271 272int 273pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 274{ 275 switch (af) { 276#if INET 277 case AF_INET: 278 switch (dyn->pfid_acnt4) { 279 case 0: 280 return (0); 281 case 1: 282 return (PF_MATCHA(0, &dyn->pfid_addr4, 283 &dyn->pfid_mask4, a, AF_INET)); 284 default: 285 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 286 } 287 break; 288#endif /* INET */ 289#if INET6 290 case AF_INET6: 291 switch (dyn->pfid_acnt6) { 292 case 0: 293 return (0); 294 case 1: 295 return (PF_MATCHA(0, &dyn->pfid_addr6, 296 &dyn->pfid_mask6, a, AF_INET6)); 297 default: 298 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 299 } 300 break; 301#endif /* INET6 */ 302 default: 303 return (0); 304 } 305} 306 307int 308pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 309{ 310 struct pfi_dynaddr *dyn; 311 char tblname[PF_TABLE_NAME_SIZE]; 312 struct pf_ruleset *ruleset = NULL; 313 int rv = 0; 314 315 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 316 317 if (aw->type != PF_ADDR_DYNIFTL) 318 return (0); 319 if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK)) == NULL) 320 return (1); 321 bzero(dyn, sizeof (*dyn)); 322 323 if (strcmp(aw->v.ifname, "self") == 0) 324 dyn->pfid_kif = pfi_kif_get(IFG_ALL); 325 else 326 dyn->pfid_kif = pfi_kif_get(aw->v.ifname); 327 if (dyn->pfid_kif == NULL) { 328 rv = 1; 329 goto _bad; 330 } 331 pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE); 332 333 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 334 if (af == AF_INET && dyn->pfid_net == 32) 335 dyn->pfid_net = 128; 336 strlcpy(tblname, aw->v.ifname, sizeof (tblname)); 337 if (aw->iflags & PFI_AFLAG_NETWORK) 338 strlcat(tblname, ":network", sizeof (tblname)); 339 if (aw->iflags & PFI_AFLAG_BROADCAST) 340 strlcat(tblname, ":broadcast", sizeof (tblname)); 341 if (aw->iflags & PFI_AFLAG_PEER) 342 strlcat(tblname, ":peer", sizeof (tblname)); 343 if (aw->iflags & PFI_AFLAG_NOALIAS) 344 strlcat(tblname, ":0", sizeof (tblname)); 345 if (dyn->pfid_net != 128) 346 snprintf(tblname + strlen(tblname), 347 sizeof (tblname) - strlen(tblname), "/%d", dyn->pfid_net); 348 if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) { 349 rv = 1; 350 goto _bad; 351 } 352 353 if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) { 354 rv = 1; 355 goto _bad; 356 } 357 358 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 359 dyn->pfid_iflags = aw->iflags; 360 dyn->pfid_af = af; 361 362 TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); 363 aw->p.dyn = dyn; 364 pfi_kif_update(dyn->pfid_kif); 365 return (0); 366 367_bad: 368 if (dyn->pfid_kt != NULL) 369 pfr_detach_table(dyn->pfid_kt); 370 if (ruleset != NULL) 371 pf_remove_if_empty_ruleset(ruleset); 372 if (dyn->pfid_kif != NULL) 373 pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE); 374 pool_put(&pfi_addr_pl, dyn); 375 return (rv); 376} 377 378void 379pfi_kif_update(struct pfi_kif *kif) 380{ 381 struct pfi_dynaddr *p; 382 383 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 384 385 /* update all dynaddr */ 386 TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) 387 pfi_dynaddr_update(p); 388} 389 390void 391pfi_dynaddr_update(struct pfi_dynaddr *dyn) 392{ 393 struct pfi_kif *kif; 394 struct pfr_ktable *kt; 395 396 if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) 397 panic("pfi_dynaddr_update"); 398 399 kif = dyn->pfid_kif; 400 kt = dyn->pfid_kt; 401 402 if (kt->pfrkt_larg != pfi_update) { 403 /* this table needs to be brought up-to-date */ 404 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 405 kt->pfrkt_larg = pfi_update; 406 } 407 pfr_dynaddr_update(kt, dyn); 408} 409 410void 411pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 412{ 413 int e, size2 = 0; 414 415 pfi_buffer_cnt = 0; 416 417 if (kif->pfik_ifp != NULL) 418 pfi_instance_add(kif->pfik_ifp, net, flags); 419 420 if ((e = pfr_set_addrs(&kt->pfrkt_t, CAST_USER_ADDR_T(pfi_buffer), 421 pfi_buffer_cnt, &size2, NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) 422 printf("pfi_table_update: cannot set %d new addresses " 423 "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 424} 425 426void 427pfi_instance_add(struct ifnet *ifp, int net, int flags) 428{ 429 struct ifaddr *ia; 430 int got4 = 0, got6 = 0; 431 int net2, af; 432 433 if (ifp == NULL) 434 return; 435 ifnet_lock_shared(ifp); 436 TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) { 437 IFA_LOCK(ia); 438 if (ia->ifa_addr == NULL) { 439 IFA_UNLOCK(ia); 440 continue; 441 } 442 af = ia->ifa_addr->sa_family; 443 if (af != AF_INET && af != AF_INET6) { 444 IFA_UNLOCK(ia); 445 continue; 446 } 447 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) { 448 IFA_UNLOCK(ia); 449 continue; 450 } 451 if ((flags & PFI_AFLAG_BROADCAST) && 452 !(ifp->if_flags & IFF_BROADCAST)) { 453 IFA_UNLOCK(ia); 454 continue; 455 } 456 if ((flags & PFI_AFLAG_PEER) && 457 !(ifp->if_flags & IFF_POINTOPOINT)) { 458 IFA_UNLOCK(ia); 459 continue; 460 } 461 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 462 IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) 463 (void *)ia->ifa_addr)->sin6_addr)) { 464 IFA_UNLOCK(ia); 465 continue; 466 } 467 if (flags & PFI_AFLAG_NOALIAS) { 468 if (af == AF_INET && got4) { 469 IFA_UNLOCK(ia); 470 continue; 471 } 472 if (af == AF_INET6 && got6) { 473 IFA_UNLOCK(ia); 474 continue; 475 } 476 } 477 if (af == AF_INET) 478 got4 = 1; 479 else if (af == AF_INET6) 480 got6 = 1; 481 net2 = net; 482 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 483 if (af == AF_INET) 484 net2 = pfi_unmask(&((struct sockaddr_in *) 485 (void *)ia->ifa_netmask)->sin_addr); 486 else if (af == AF_INET6) 487 net2 = pfi_unmask(&((struct sockaddr_in6 *) 488 (void *)ia->ifa_netmask)->sin6_addr); 489 } 490 if (af == AF_INET && net2 > 32) 491 net2 = 32; 492 if (flags & PFI_AFLAG_BROADCAST) 493 pfi_address_add(ia->ifa_broadaddr, af, net2); 494 else if (flags & PFI_AFLAG_PEER) 495 pfi_address_add(ia->ifa_dstaddr, af, net2); 496 else 497 pfi_address_add(ia->ifa_addr, af, net2); 498 IFA_UNLOCK(ia); 499 } 500 ifnet_lock_done(ifp); 501} 502 503void 504pfi_address_add(struct sockaddr *sa, int af, int net) 505{ 506 struct pfr_addr *p; 507 int i; 508 509 if (pfi_buffer_cnt >= pfi_buffer_max) { 510 int new_max = pfi_buffer_max * 2; 511 512 if (new_max > PFI_BUFFER_MAX) { 513 printf("pfi_address_add: address buffer full (%d/%d)\n", 514 pfi_buffer_cnt, PFI_BUFFER_MAX); 515 return; 516 } 517 p = _MALLOC(new_max * sizeof (*pfi_buffer), PFI_MTYPE, 518 M_WAITOK); 519 if (p == NULL) { 520 printf("pfi_address_add: no memory to grow buffer " 521 "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 522 return; 523 } 524 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof (*pfi_buffer)); 525 /* no need to zero buffer */ 526 _FREE(pfi_buffer, PFI_MTYPE); 527 pfi_buffer = p; 528 pfi_buffer_max = new_max; 529 } 530 if (af == AF_INET && net > 32) 531 net = 128; 532 p = pfi_buffer + pfi_buffer_cnt++; 533 bzero(p, sizeof (*p)); 534 p->pfra_af = af; 535 p->pfra_net = net; 536 if (af == AF_INET) 537 p->pfra_ip4addr = ((struct sockaddr_in *)(void *)sa)->sin_addr; 538 else if (af == AF_INET6) { 539 p->pfra_ip6addr = 540 ((struct sockaddr_in6 *)(void *)sa)->sin6_addr; 541 if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) 542 p->pfra_ip6addr.s6_addr16[1] = 0; 543 } 544 /* mask network address bits */ 545 if (net < 128) 546 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 547 for (i = (p->pfra_net+7)/8; i < (int)sizeof (p->pfra_u); i++) 548 ((caddr_t)p)[i] = 0; 549} 550 551void 552pfi_dynaddr_remove(struct pf_addr_wrap *aw) 553{ 554 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 555 aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 556 return; 557 558 TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry); 559 pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE); 560 aw->p.dyn->pfid_kif = NULL; 561 pfr_detach_table(aw->p.dyn->pfid_kt); 562 aw->p.dyn->pfid_kt = NULL; 563 pool_put(&pfi_addr_pl, aw->p.dyn); 564 aw->p.dyn = NULL; 565} 566 567void 568pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 569{ 570 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 571 aw->p.dyn->pfid_kif == NULL) 572 return; 573 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 574} 575 576void 577pfi_kifaddr_update(void *v) 578{ 579 struct pfi_kif *kif = (struct pfi_kif *)v; 580 581 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 582 583 pfi_update++; 584 pfi_kif_update(kif); 585} 586 587int 588pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 589{ 590 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 591} 592 593void 594pfi_update_status(const char *name, struct pf_status *pfs) 595{ 596 struct pfi_kif *p; 597 struct pfi_kif_cmp key; 598 int i, j, k; 599 600 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 601 602 strlcpy(key.pfik_name, name, sizeof (key.pfik_name)); 603 p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)(void *)&key); 604 if (p == NULL) 605 return; 606 607 if (pfs) { 608 bzero(pfs->pcounters, sizeof (pfs->pcounters)); 609 bzero(pfs->bcounters, sizeof (pfs->bcounters)); 610 } 611 /* just clear statistics */ 612 if (pfs == NULL) { 613 bzero(p->pfik_packets, sizeof (p->pfik_packets)); 614 bzero(p->pfik_bytes, sizeof (p->pfik_bytes)); 615 p->pfik_tzero = pf_calendar_time_second(); 616 } 617 for (i = 0; i < 2; i++) 618 for (j = 0; j < 2; j++) 619 for (k = 0; k < 2; k++) { 620 pfs->pcounters[i][j][k] += 621 p->pfik_packets[i][j][k]; 622 pfs->bcounters[i][j] += 623 p->pfik_bytes[i][j][k]; 624 } 625} 626 627int 628pfi_get_ifaces(const char *name, user_addr_t buf, int *size) 629{ 630 struct pfi_kif *p, *nextp; 631 int n = 0; 632 633 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 634 635 for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) { 636 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); 637 if (pfi_skip_if(name, p)) 638 continue; 639 if (*size > n++) { 640 struct pfi_uif u; 641 642 if (!p->pfik_tzero) 643 p->pfik_tzero = pf_calendar_time_second(); 644 pfi_kif_ref(p, PFI_KIF_REF_RULE); 645 646 /* return the user space version of pfi_kif */ 647 bzero(&u, sizeof (u)); 648 bcopy(p->pfik_name, &u.pfik_name, sizeof (u.pfik_name)); 649 bcopy(p->pfik_packets, &u.pfik_packets, 650 sizeof (u.pfik_packets)); 651 bcopy(p->pfik_bytes, &u.pfik_bytes, 652 sizeof (u.pfik_bytes)); 653 u.pfik_tzero = p->pfik_tzero; 654 u.pfik_flags = p->pfik_flags; 655 u.pfik_states = p->pfik_states; 656 u.pfik_rules = p->pfik_rules; 657 658 if (copyout(&u, buf, sizeof (u))) { 659 pfi_kif_unref(p, PFI_KIF_REF_RULE); 660 return (EFAULT); 661 } 662 buf += sizeof (u); 663 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); 664 pfi_kif_unref(p, PFI_KIF_REF_RULE); 665 } 666 } 667 *size = n; 668 return (0); 669} 670 671int 672pfi_skip_if(const char *filter, struct pfi_kif *p) 673{ 674 int n; 675 676 if (filter == NULL || !*filter) 677 return (0); 678 if (strcmp(p->pfik_name, filter) == 0) 679 return (0); /* exact match */ 680 n = strlen(filter); 681 if (n < 1 || n >= IFNAMSIZ) 682 return (1); /* sanity check */ 683 if (filter[n-1] >= '0' && filter[n-1] <= '9') 684 return (1); /* only do exact match in that case */ 685 if (strncmp(p->pfik_name, filter, n)) 686 return (1); /* prefix doesn't match */ 687 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 688} 689 690int 691pfi_set_flags(const char *name, int flags) 692{ 693 struct pfi_kif *p; 694 695 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 696 697 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 698 if (pfi_skip_if(name, p)) 699 continue; 700 p->pfik_flags |= flags; 701 } 702 return (0); 703} 704 705int 706pfi_clear_flags(const char *name, int flags) 707{ 708 struct pfi_kif *p; 709 710 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 711 712 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 713 if (pfi_skip_if(name, p)) 714 continue; 715 p->pfik_flags &= ~flags; 716 } 717 return (0); 718} 719 720/* from pf_print_state.c */ 721int 722pfi_unmask(void *addr) 723{ 724 struct pf_addr *m = addr; 725 int i = 31, j = 0, b = 0; 726 u_int32_t tmp; 727 728 while (j < 4 && m->addr32[j] == 0xffffffff) { 729 b += 32; 730 j++; 731 } 732 if (j < 4) { 733 tmp = ntohl(m->addr32[j]); 734 for (i = 31; tmp & (1 << i); --i) 735 b++; 736 } 737 return (b); 738} 739