1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002,2003 Henning Brauer
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * - Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * - Redistributions in binary form must reproduce the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer in the documentation and/or other materials provided
17 * with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 *
32 * Effort sponsored in part by the Defense Advanced Research Projects
33 * Agency (DARPA) and Air Force Research Laboratory, Air Force
34 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
35 *
36 * $OpenBSD: pf_ruleset.c,v 1.2 2008/12/18 15:31:37 dhill Exp $
37 */
38
39 #include <sys/param.h>
40 #include <sys/socket.h>
41 #include <sys/systm.h>
42 #include <sys/refcount.h>
43 #include <sys/mbuf.h>
44
45 #include <netinet/in.h>
46 #include <netinet/in_systm.h>
47 #include <netinet/ip.h>
48 #include <netinet/tcp.h>
49
50 #include <net/if.h>
51 #include <net/vnet.h>
52 #include <net/pfvar.h>
53
54 #ifdef INET6
55 #include <netinet/ip6.h>
56 #endif /* INET6 */
57
58 #ifndef _KERNEL
59 #error "Kernel only file. Please use sbin/pfctl/pf_ruleset.c instead."
60 #endif
61
62 #define rs_malloc(x) malloc(x, M_TEMP, M_NOWAIT|M_ZERO)
63 #define rs_free(x) free(x, M_TEMP)
64
65 VNET_DEFINE(struct pf_kanchor_global, pf_anchors);
66 VNET_DEFINE(struct pf_kanchor, pf_main_anchor);
67 VNET_DEFINE(struct pf_keth_ruleset*, pf_keth);
68 VNET_DEFINE(struct pf_keth_anchor, pf_main_keth_anchor);
69 VNET_DEFINE(struct pf_keth_anchor_global, pf_keth_anchors);
70
71 static __inline int pf_kanchor_compare(struct pf_kanchor *,
72 struct pf_kanchor *);
73 static __inline int pf_keth_anchor_compare(struct pf_keth_anchor *,
74 struct pf_keth_anchor *);
75 static struct pf_kanchor *pf_find_kanchor(const char *);
76
77 RB_GENERATE(pf_kanchor_global, pf_kanchor, entry_global, pf_kanchor_compare);
78 RB_GENERATE(pf_kanchor_node, pf_kanchor, entry_node, pf_kanchor_compare);
79 RB_GENERATE(pf_keth_anchor_global, pf_keth_anchor, entry_global,
80 pf_keth_anchor_compare);
81 RB_GENERATE(pf_keth_anchor_node, pf_keth_anchor, entry_node,
82 pf_keth_anchor_compare);
83
84 static __inline int
pf_kanchor_compare(struct pf_kanchor * a,struct pf_kanchor * b)85 pf_kanchor_compare(struct pf_kanchor *a, struct pf_kanchor *b)
86 {
87 int c = strcmp(a->path, b->path);
88
89 return (c ? (c < 0 ? -1 : 1) : 0);
90 }
91
92 static __inline int
pf_keth_anchor_compare(struct pf_keth_anchor * a,struct pf_keth_anchor * b)93 pf_keth_anchor_compare(struct pf_keth_anchor *a, struct pf_keth_anchor *b)
94 {
95 int c = strcmp(a->path, b->path);
96
97 return (c ? (c < 0 ? -1 : 1) : 0);
98 }
99
100 int
pf_get_ruleset_number(u_int8_t action)101 pf_get_ruleset_number(u_int8_t action)
102 {
103 switch (action) {
104 case PF_SCRUB:
105 case PF_NOSCRUB:
106 return (PF_RULESET_SCRUB);
107 break;
108 case PF_PASS:
109 case PF_MATCH:
110 case PF_DROP:
111 return (PF_RULESET_FILTER);
112 break;
113 case PF_NAT:
114 case PF_NONAT:
115 return (PF_RULESET_NAT);
116 break;
117 case PF_BINAT:
118 case PF_NOBINAT:
119 return (PF_RULESET_BINAT);
120 break;
121 case PF_RDR:
122 case PF_NORDR:
123 return (PF_RULESET_RDR);
124 break;
125 default:
126 return (PF_RULESET_MAX);
127 break;
128 }
129 }
130
131 static struct pf_kanchor *
pf_find_kanchor(const char * path)132 pf_find_kanchor(const char *path)
133 {
134 struct pf_kanchor *key, *found;
135
136 key = (struct pf_kanchor *)rs_malloc(sizeof(*key));
137 if (key == NULL)
138 return (NULL);
139 strlcpy(key->path, path, sizeof(key->path));
140 found = RB_FIND(pf_kanchor_global, &V_pf_anchors, key);
141 rs_free(key);
142 return (found);
143 }
144
145 void
pf_init_kruleset(struct pf_kruleset * ruleset)146 pf_init_kruleset(struct pf_kruleset *ruleset)
147 {
148 int i;
149
150 memset(ruleset, 0, sizeof(struct pf_kruleset));
151 for (i = 0; i < PF_RULESET_MAX; i++) {
152 TAILQ_INIT(&ruleset->rules[i].queues[0]);
153 TAILQ_INIT(&ruleset->rules[i].queues[1]);
154 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0];
155 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1];
156 }
157 }
158
159 void
pf_init_keth(struct pf_keth_ruleset * rs)160 pf_init_keth(struct pf_keth_ruleset *rs)
161 {
162
163 bzero(rs, sizeof(*rs));
164 TAILQ_INIT(&rs->rules[0]);
165 TAILQ_INIT(&rs->rules[1]);
166 rs->active.rules = &rs->rules[0];
167 rs->active.open = 0;
168 rs->inactive.rules = &rs->rules[1];
169 rs->inactive.open = 0;
170
171 rs->vnet = curvnet;
172 }
173
174 struct pf_kruleset *
pf_find_kruleset(const char * path)175 pf_find_kruleset(const char *path)
176 {
177 struct pf_kanchor *anchor;
178
179 while (*path == '/')
180 path++;
181 if (!*path)
182 return (&pf_main_ruleset);
183 anchor = pf_find_kanchor(path);
184 if (anchor == NULL)
185 return (NULL);
186 else
187 return (&anchor->ruleset);
188 }
189 struct pf_kruleset *
pf_get_leaf_kruleset(char * path,char ** path_remainder)190 pf_get_leaf_kruleset(char *path, char **path_remainder)
191 {
192 struct pf_kruleset *ruleset;
193 char *leaf, *p;
194 int i = 0;
195
196 p = path;
197 while (*p == '/')
198 p++;
199
200 ruleset = pf_find_kruleset(p);
201 leaf = p;
202 while (ruleset == NULL) {
203 leaf = strrchr(p, '/');
204 if (leaf != NULL) {
205 *leaf = '\0';
206 i++;
207 ruleset = pf_find_kruleset(p);
208 } else {
209 leaf = path;
210 /*
211 * if no path component exists, then main ruleset is
212 * our parent.
213 */
214 ruleset = &pf_main_ruleset;
215 }
216 }
217
218 if (path_remainder != NULL)
219 *path_remainder = leaf;
220
221 /* restore slashes in path. */
222 while (i != 0) {
223 while (*leaf != '\0')
224 leaf++;
225 *leaf = '/';
226 i--;
227 }
228
229 return (ruleset);
230 }
231
232 static struct pf_kanchor *
pf_create_kanchor(struct pf_kanchor * parent,const char * aname)233 pf_create_kanchor(struct pf_kanchor *parent, const char *aname)
234 {
235 struct pf_kanchor *anchor, *dup;
236
237 if (!*aname || (strlen(aname) >= PF_ANCHOR_NAME_SIZE) ||
238 ((parent != NULL) && (strlen(parent->path) >= PF_ANCHOR_MAXPATH)))
239 return (NULL);
240
241 anchor = uma_zalloc(V_pf_anchor_z, M_NOWAIT | M_ZERO);
242 if (anchor == NULL)
243 return (NULL);
244
245 RB_INIT(&anchor->children);
246 strlcpy(anchor->name, aname, sizeof(anchor->name));
247 if (parent != NULL) {
248 /*
249 * Make sure path for levels 2, 3, ... is terminated by '/':
250 * 1/2/3/...
251 */
252 strlcpy(anchor->path, parent->path, sizeof(anchor->path));
253 strlcat(anchor->path, "/", sizeof(anchor->path));
254 }
255 strlcat(anchor->path, anchor->name, sizeof(anchor->path));
256
257 if ((dup = RB_INSERT(pf_kanchor_global, &V_pf_anchors, anchor)) !=
258 NULL) {
259 printf("%s: RB_INSERT1 "
260 "'%s' '%s' collides with '%s' '%s'\n", __func__,
261 anchor->path, anchor->name, dup->path, dup->name);
262 uma_zfree(V_pf_anchor_z, anchor);
263 return (NULL);
264 }
265
266 if (parent != NULL) {
267 anchor->parent = parent;
268 if ((dup = RB_INSERT(pf_kanchor_node, &parent->children,
269 anchor)) != NULL) {
270 printf("%s: "
271 "RB_INSERT2 '%s' '%s' collides with "
272 "'%s' '%s'\n", __func__, anchor->path,
273 anchor->name, dup->path, dup->name);
274 RB_REMOVE(pf_kanchor_global, &V_pf_anchors,
275 anchor);
276 uma_zfree(V_pf_anchor_z, anchor);
277 return (NULL);
278 }
279 }
280 pf_init_kruleset(&anchor->ruleset);
281 anchor->ruleset.anchor = anchor;
282 return (anchor);
283 }
284
285 struct pf_kruleset *
pf_find_or_create_kruleset(const char * path)286 pf_find_or_create_kruleset(const char *path)
287 {
288 char *p, *aname, *r;
289 struct pf_kruleset *ruleset;
290 struct pf_kanchor *anchor = NULL;
291
292 if (path[0] == 0)
293 return (&pf_main_ruleset);
294 while (*path == '/')
295 path++;
296 ruleset = pf_find_kruleset(path);
297 if (ruleset != NULL)
298 return (ruleset);
299 p = (char *)rs_malloc(MAXPATHLEN);
300 if (p == NULL)
301 return (NULL);
302 strlcpy(p, path, MAXPATHLEN);
303
304 ruleset = pf_get_leaf_kruleset(p, &aname);
305 anchor = ruleset->anchor;
306
307 while (*aname == '/')
308 aname++;
309 /*
310 * aname is a path remainder, which contains nodes we must create. We
311 * process the aname path from left to right, effectively descending
312 * from parents to children.
313 */
314 while ((r = strchr(aname, '/')) != NULL || *aname) {
315 if (r != NULL)
316 *r = 0;
317 anchor = pf_create_kanchor(anchor, aname);
318 if (anchor == NULL) {
319 rs_free(p);
320 return (NULL);
321 }
322 if (r == NULL)
323 break;
324 else
325 aname = r + 1;
326 }
327
328 rs_free(p);
329 return (&anchor->ruleset);
330 }
331
332 void
pf_remove_if_empty_kruleset(struct pf_kruleset * ruleset)333 pf_remove_if_empty_kruleset(struct pf_kruleset *ruleset)
334 {
335 struct pf_kanchor *parent;
336 int i;
337
338 while (ruleset != NULL) {
339 if (ruleset == &pf_main_ruleset ||
340 !RB_EMPTY(&ruleset->anchor->children) ||
341 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 ||
342 ruleset->topen)
343 return;
344 for (i = 0; i < PF_RULESET_MAX; ++i)
345 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) ||
346 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) ||
347 ruleset->rules[i].inactive.open)
348 return;
349 RB_REMOVE(pf_kanchor_global, &V_pf_anchors, ruleset->anchor);
350 if ((parent = ruleset->anchor->parent) != NULL)
351 RB_REMOVE(pf_kanchor_node, &parent->children,
352 ruleset->anchor);
353 uma_zfree(V_pf_anchor_z, ruleset->anchor);
354 if (parent == NULL)
355 return;
356 ruleset = &parent->ruleset;
357 }
358 }
359
360 int
pf_kanchor_setup(struct pf_krule * r,const struct pf_kruleset * s,const char * name)361 pf_kanchor_setup(struct pf_krule *r, const struct pf_kruleset *s,
362 const char *name)
363 {
364 char *p, *path;
365 struct pf_kruleset *ruleset;
366
367 r->anchor = NULL;
368 r->anchor_relative = 0;
369 r->anchor_wildcard = 0;
370 if (!name[0])
371 return (0);
372 path = (char *)rs_malloc(MAXPATHLEN);
373 if (path == NULL)
374 return (1);
375 if (name[0] == '/')
376 strlcpy(path, name + 1, MAXPATHLEN);
377 else {
378 /* relative path */
379 r->anchor_relative = 1;
380 if (s->anchor == NULL || !s->anchor->path[0])
381 path[0] = 0;
382 else
383 strlcpy(path, s->anchor->path, MAXPATHLEN);
384 while (name[0] == '.' && name[1] == '.' && name[2] == '/') {
385 if (!path[0]) {
386 DPFPRINTF(PF_DEBUG_NOISY, "%s: .. beyond root",
387 __func__);
388 rs_free(path);
389 return (1);
390 }
391 if ((p = strrchr(path, '/')) != NULL)
392 *p = 0;
393 else
394 path[0] = 0;
395 r->anchor_relative++;
396 name += 3;
397 }
398 if (path[0])
399 strlcat(path, "/", MAXPATHLEN);
400 strlcat(path, name, MAXPATHLEN);
401 }
402 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) {
403 r->anchor_wildcard = 1;
404 *p = 0;
405 }
406 ruleset = pf_find_or_create_kruleset(path);
407 rs_free(path);
408 if (ruleset == NULL || ruleset == &pf_main_ruleset) {
409 DPFPRINTF(PF_DEBUG_NOISY, "%s: ruleset", __func__);
410 return (1);
411 }
412 r->anchor = ruleset->anchor;
413 r->anchor->refcnt++;
414 return (0);
415 }
416
417 int
pf_kanchor_copyout(const struct pf_kruleset * rs,const struct pf_krule * r,char * anchor_call,size_t anchor_call_len)418 pf_kanchor_copyout(const struct pf_kruleset *rs, const struct pf_krule *r,
419 char *anchor_call, size_t anchor_call_len)
420 {
421 anchor_call[0] = 0;
422
423 if (r->anchor == NULL)
424 goto done;
425 if (!r->anchor_relative) {
426 strlcpy(anchor_call, "/", anchor_call_len);
427 strlcat(anchor_call, r->anchor->path,
428 anchor_call_len);
429 } else {
430 char a[MAXPATHLEN];
431 char *p;
432 int i;
433 if (rs == &pf_main_ruleset)
434 a[0] = 0;
435 else
436 strlcpy(a, rs->anchor->path, MAXPATHLEN);
437 for (i = 1; i < r->anchor_relative; ++i) {
438 if ((p = strrchr(a, '/')) == NULL)
439 p = a;
440 *p = 0;
441 strlcat(anchor_call, "../",
442 anchor_call_len);
443 }
444 if (strncmp(a, r->anchor->path, strlen(a))) {
445 printf("%s: '%s' '%s'\n", __func__, a,
446 r->anchor->path);
447 return (1);
448 }
449 if (strlen(r->anchor->path) > strlen(a))
450 strlcat(anchor_call, r->anchor->path + (a[0] ?
451 strlen(a) + 1 : 0), anchor_call_len);
452
453 }
454 if (r->anchor_wildcard)
455 strlcat(anchor_call, anchor_call[0] ? "/*" : "*",
456 anchor_call_len);
457
458 done:
459
460 return (0);
461 }
462
463 int
pf_kanchor_nvcopyout(const struct pf_kruleset * rs,const struct pf_krule * r,nvlist_t * nvl)464 pf_kanchor_nvcopyout(const struct pf_kruleset *rs, const struct pf_krule *r,
465 nvlist_t *nvl)
466 {
467 char anchor_call[MAXPATHLEN] = { 0 };
468 int ret;
469
470 ret = pf_kanchor_copyout(rs, r, anchor_call, sizeof(anchor_call));
471 MPASS(ret == 0);
472
473 nvlist_add_string(nvl, "anchor_call", anchor_call);
474
475 return (ret);
476 }
477
478 int
pf_keth_anchor_nvcopyout(const struct pf_keth_ruleset * rs,const struct pf_keth_rule * r,nvlist_t * nvl)479 pf_keth_anchor_nvcopyout(const struct pf_keth_ruleset *rs,
480 const struct pf_keth_rule *r, nvlist_t *nvl)
481 {
482 char anchor_call[MAXPATHLEN] = { 0 };
483
484 if (r->anchor == NULL)
485 goto done;
486 if (!r->anchor_relative) {
487 strlcpy(anchor_call, "/", sizeof(anchor_call));
488 strlcat(anchor_call, r->anchor->path,
489 sizeof(anchor_call));
490 } else {
491 char a[MAXPATHLEN];
492 char *p;
493 int i;
494 if (rs->anchor == NULL)
495 a[0] = 0;
496 else
497 strlcpy(a, rs->anchor->path, MAXPATHLEN);
498 for (i = 1; i < r->anchor_relative; ++i) {
499 if ((p = strrchr(a, '/')) == NULL)
500 p = a;
501 *p = 0;
502 strlcat(anchor_call, "../",
503 sizeof(anchor_call));
504 }
505 if (strncmp(a, r->anchor->path, strlen(a))) {
506 printf("%s(): '%s' '%s'\n", __func__, a,
507 r->anchor->path);
508 return (1);
509 }
510 if (strlen(r->anchor->path) > strlen(a))
511 strlcat(anchor_call, r->anchor->path + (a[0] ?
512 strlen(a) + 1 : 0), sizeof(anchor_call));
513
514 }
515 if (r->anchor_wildcard)
516 strlcat(anchor_call, anchor_call[0] ? "/*" : "*",
517 sizeof(anchor_call));
518
519 done:
520 nvlist_add_string(nvl, "anchor_call", anchor_call);
521
522 return (0);
523 }
524
525 void
pf_remove_kanchor(struct pf_krule * r)526 pf_remove_kanchor(struct pf_krule *r)
527 {
528 if (r->anchor == NULL)
529 return;
530 if (r->anchor->refcnt <= 0)
531 printf("%s: broken refcount\n", __func__);
532 else if (!--r->anchor->refcnt)
533 pf_remove_if_empty_kruleset(&r->anchor->ruleset);
534 r->anchor = NULL;
535 }
536
537 struct pf_keth_ruleset *
pf_find_keth_ruleset(const char * path)538 pf_find_keth_ruleset(const char *path)
539 {
540 struct pf_keth_anchor *anchor;
541
542 while (*path == '/')
543 path++;
544 if (!*path)
545 return (V_pf_keth);
546 anchor = pf_find_keth_anchor(path);
547 if (anchor == NULL)
548 return (NULL);
549 else
550 return (&anchor->ruleset);
551 }
552
553 static struct pf_keth_anchor *
_pf_find_keth_anchor(struct pf_keth_ruleset * rs,const char * path)554 _pf_find_keth_anchor(struct pf_keth_ruleset *rs, const char *path)
555 {
556 struct pf_keth_anchor *key, *found;
557
558 key = (struct pf_keth_anchor *)rs_malloc(sizeof(*key));
559 if (key == NULL)
560 return (NULL);
561 strlcpy(key->path, path, sizeof(key->path));
562 found = RB_FIND(pf_keth_anchor_global, &V_pf_keth_anchors, key);
563 rs_free(key);
564 return (found);
565 }
566
567 struct pf_keth_anchor *
pf_find_keth_anchor(const char * path)568 pf_find_keth_anchor(const char *path)
569 {
570 return (_pf_find_keth_anchor(V_pf_keth, path));
571 }
572
573 struct pf_keth_ruleset *
pf_find_or_create_keth_ruleset(const char * path)574 pf_find_or_create_keth_ruleset(const char *path)
575 {
576 char *p, *q, *r;
577 struct pf_keth_anchor *anchor = NULL, *dup = NULL, *parent = NULL;
578 struct pf_keth_ruleset *ruleset;
579
580 if (path[0] == 0)
581 return (V_pf_keth);
582 while (*path == '/')
583 path++;
584 ruleset = pf_find_keth_ruleset(path);
585 if (ruleset != NULL)
586 return (ruleset);
587 p = (char *)rs_malloc(MAXPATHLEN);
588 if (p == NULL)
589 return (NULL);
590 strlcpy(p, path, MAXPATHLEN);
591 while (parent == NULL && (q = strrchr(p, '/')) != NULL) {
592 *q = 0;
593 if ((ruleset = pf_find_keth_ruleset(p)) != NULL) {
594 parent = ruleset->anchor;
595 break;
596 }
597 }
598 if (q == NULL)
599 q = p;
600 else
601 q++;
602 strlcpy(p, path, MAXPATHLEN);
603 if (!*q) {
604 rs_free(p);
605 return (NULL);
606 }
607 while ((r = strchr(q, '/')) != NULL || *q) {
608 if (r != NULL)
609 *r = 0;
610 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE ||
611 (parent != NULL && strlen(parent->path) >=
612 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) {
613 rs_free(p);
614 return (NULL);
615 }
616 anchor = uma_zalloc(V_pf_eth_anchor_z, M_NOWAIT | M_ZERO);
617 if (anchor == NULL) {
618 rs_free(p);
619 return (NULL);
620 }
621 RB_INIT(&anchor->children);
622 strlcpy(anchor->name, q, sizeof(anchor->name));
623 if (parent != NULL) {
624 strlcpy(anchor->path, parent->path,
625 sizeof(anchor->path));
626 strlcat(anchor->path, "/", sizeof(anchor->path));
627 }
628 strlcat(anchor->path, anchor->name, sizeof(anchor->path));
629 if ((dup = RB_INSERT(pf_keth_anchor_global, &V_pf_keth_anchors, anchor)) !=
630 NULL) {
631 printf("%s: RB_INSERT1 "
632 "'%s' '%s' collides with '%s' '%s'\n", __func__,
633 anchor->path, anchor->name, dup->path, dup->name);
634 uma_zfree(V_pf_eth_anchor_z, anchor);
635 rs_free(p);
636 return (NULL);
637 }
638 if (parent != NULL) {
639 anchor->parent = parent;
640 if ((dup = RB_INSERT(pf_keth_anchor_node, &parent->children,
641 anchor)) != NULL) {
642 printf("%s: "
643 "RB_INSERT2 '%s' '%s' collides with "
644 "'%s' '%s'\n", __func__, anchor->path,
645 anchor->name, dup->path, dup->name);
646 RB_REMOVE(pf_keth_anchor_global, &V_pf_keth_anchors,
647 anchor);
648 uma_zfree(V_pf_eth_anchor_z, anchor);
649 rs_free(p);
650 return (NULL);
651 }
652 }
653 pf_init_keth(&anchor->ruleset);
654 anchor->ruleset.anchor = anchor;
655 parent = anchor;
656 if (r != NULL)
657 q = r + 1;
658 else
659 *q = 0;
660 }
661 rs_free(p);
662 return (&anchor->ruleset);
663 }
664
665 int
pf_keth_anchor_setup(struct pf_keth_rule * r,const struct pf_keth_ruleset * s,const char * name)666 pf_keth_anchor_setup(struct pf_keth_rule *r, const struct pf_keth_ruleset *s,
667 const char *name)
668 {
669 char *p, *path;
670 struct pf_keth_ruleset *ruleset;
671
672 r->anchor = NULL;
673 r->anchor_relative = 0;
674 r->anchor_wildcard = 0;
675 if (!name[0])
676 return (0);
677 path = (char *)rs_malloc(MAXPATHLEN);
678 if (path == NULL)
679 return (1);
680 if (name[0] == '/')
681 strlcpy(path, name + 1, MAXPATHLEN);
682 else {
683 /* relative path */
684 r->anchor_relative = 1;
685 if (s->anchor == NULL || !s->anchor->path[0])
686 path[0] = 0;
687 else
688 strlcpy(path, s->anchor->path, MAXPATHLEN);
689 while (name[0] == '.' && name[1] == '.' && name[2] == '/') {
690 if (!path[0]) {
691 DPFPRINTF(PF_DEBUG_NOISY, "%s: .. beyond root",
692 __func__);
693 rs_free(path);
694 return (1);
695 }
696 if ((p = strrchr(path, '/')) != NULL)
697 *p = 0;
698 else
699 path[0] = 0;
700 r->anchor_relative++;
701 name += 3;
702 }
703 if (path[0])
704 strlcat(path, "/", MAXPATHLEN);
705 strlcat(path, name, MAXPATHLEN);
706 }
707 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) {
708 r->anchor_wildcard = 1;
709 *p = 0;
710 }
711 ruleset = pf_find_or_create_keth_ruleset(path);
712 rs_free(path);
713 if (ruleset == NULL || ruleset->anchor == NULL) {
714 DPFPRINTF(PF_DEBUG_NOISY, "%s: ruleset", __func__);
715 return (1);
716 }
717 r->anchor = ruleset->anchor;
718 r->anchor->refcnt++;
719 return (0);
720 }
721
722 void
pf_keth_anchor_remove(struct pf_keth_rule * r)723 pf_keth_anchor_remove(struct pf_keth_rule *r)
724 {
725 if (r->anchor == NULL)
726 return;
727 if (r->anchor->refcnt <= 0) {
728 printf("%s: broken refcount\n", __func__);
729 r->anchor = NULL;
730 return;
731 }
732 if (!--r->anchor->refcnt)
733 pf_remove_if_empty_keth_ruleset(&r->anchor->ruleset);
734 r->anchor = NULL;
735 }
736
737 void
pf_remove_if_empty_keth_ruleset(struct pf_keth_ruleset * ruleset)738 pf_remove_if_empty_keth_ruleset(struct pf_keth_ruleset *ruleset)
739 {
740 struct pf_keth_anchor *parent;
741 int i;
742
743 while (ruleset != NULL) {
744 if (ruleset == V_pf_keth || ruleset->anchor == NULL ||
745 !RB_EMPTY(&ruleset->anchor->children) ||
746 ruleset->anchor->refcnt > 0)
747 return;
748 for (i = 0; i < PF_RULESET_MAX; ++i)
749 if (!TAILQ_EMPTY(ruleset->active.rules) ||
750 !TAILQ_EMPTY(ruleset->inactive.rules) ||
751 ruleset->inactive.open)
752 return;
753 RB_REMOVE(pf_keth_anchor_global, &V_pf_keth_anchors, ruleset->anchor);
754 if ((parent = ruleset->anchor->parent) != NULL)
755 RB_REMOVE(pf_keth_anchor_node, &parent->children,
756 ruleset->anchor);
757 uma_zfree(V_pf_eth_anchor_z, ruleset->anchor);
758 if (parent == NULL)
759 return;
760 ruleset = &parent->ruleset;
761 }
762 }
763