1 /* $OpenBSD: pfctl_radix.c,v 1.27 2005/05/21 21:03:58 henning Exp $ */
2
3 /*-
4 * SPDX-License-Identifier: BSD-2-Clause
5 *
6 * Copyright (c) 2002 Cedric Berger
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34
35 #include <sys/types.h>
36 #include <sys/ioctl.h>
37 #include <sys/socket.h>
38
39 #include <net/if.h>
40 #include <net/pfvar.h>
41
42 #include <errno.h>
43 #include <string.h>
44 #include <ctype.h>
45 #include <stdio.h>
46 #include <stdlib.h>
47 #include <limits.h>
48 #include <err.h>
49
50 #include "pfctl.h"
51
52 #define BUF_SIZE 256
53
54 extern int dev;
55
56 static int pfr_next_token(char buf[BUF_SIZE], FILE *);
57
58 static void
pfr_report_error(struct pfr_table * tbl,struct pfioc_table * io,const char * err)59 pfr_report_error(struct pfr_table *tbl, struct pfioc_table *io,
60 const char *err)
61 {
62 unsigned long maxcount;
63 size_t s;
64
65 s = sizeof(maxcount);
66 if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, NULL,
67 0) == -1)
68 return;
69
70 if (io->pfrio_size > maxcount || io->pfrio_size2 > maxcount)
71 fprintf(stderr, "cannot %s %s: too many elements.\n"
72 "Consider increasing net.pf.request_maxcount.",
73 err, tbl->pfrt_name);
74 }
75
76 int
pfr_add_tables(struct pfr_table * tbl,int size,int * nadd,int flags)77 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
78 {
79 struct pfioc_table io;
80
81 if (size < 0 || (size && tbl == NULL)) {
82 errno = EINVAL;
83 return (-1);
84 }
85 bzero(&io, sizeof io);
86 io.pfrio_flags = flags;
87 io.pfrio_buffer = tbl;
88 io.pfrio_esize = sizeof(*tbl);
89 io.pfrio_size = size;
90 if (ioctl(dev, DIOCRADDTABLES, &io)) {
91 pfr_report_error(tbl, &io, "add table");
92 return (-1);
93 }
94 if (nadd != NULL)
95 *nadd = io.pfrio_nadd;
96 return (0);
97 }
98
99 int
pfr_del_tables(struct pfr_table * tbl,int size,int * ndel,int flags)100 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
101 {
102 struct pfioc_table io;
103
104 if (size < 0 || (size && tbl == NULL)) {
105 errno = EINVAL;
106 return (-1);
107 }
108 bzero(&io, sizeof io);
109 io.pfrio_flags = flags;
110 io.pfrio_buffer = tbl;
111 io.pfrio_esize = sizeof(*tbl);
112 io.pfrio_size = size;
113 if (ioctl(dev, DIOCRDELTABLES, &io)) {
114 pfr_report_error(tbl, &io, "delete table");
115 return (-1);
116 }
117 if (ndel != NULL)
118 *ndel = io.pfrio_ndel;
119 return (0);
120 }
121
122 int
pfr_get_tables(struct pfr_table * filter,struct pfr_table * tbl,int * size,int flags)123 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
124 int flags)
125 {
126 struct pfioc_table io;
127
128 if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
129 errno = EINVAL;
130 return (-1);
131 }
132 bzero(&io, sizeof io);
133 io.pfrio_flags = flags;
134 if (filter != NULL)
135 io.pfrio_table = *filter;
136 io.pfrio_buffer = tbl;
137 io.pfrio_esize = sizeof(*tbl);
138 io.pfrio_size = *size;
139 if (ioctl(dev, DIOCRGETTABLES, &io)) {
140 pfr_report_error(tbl, &io, "get table");
141 return (-1);
142 }
143 *size = io.pfrio_size;
144 return (0);
145 }
146
147 int
pfr_get_tstats(struct pfr_table * filter,struct pfr_tstats * tbl,int * size,int flags)148 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
149 int flags)
150 {
151 struct pfioc_table io;
152
153 if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
154 errno = EINVAL;
155 return (-1);
156 }
157 bzero(&io, sizeof io);
158 io.pfrio_flags = flags;
159 if (filter != NULL)
160 io.pfrio_table = *filter;
161 io.pfrio_buffer = tbl;
162 io.pfrio_esize = sizeof(*tbl);
163 io.pfrio_size = *size;
164 if (ioctl(dev, DIOCRGETTSTATS, &io)) {
165 pfr_report_error(filter, &io, "get tstats for");
166 return (-1);
167 }
168 *size = io.pfrio_size;
169 return (0);
170 }
171
172 int
pfr_clr_addrs(struct pfr_table * tbl,int * ndel,int flags)173 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
174 {
175 struct pfioc_table io;
176
177 if (tbl == NULL) {
178 errno = EINVAL;
179 return (-1);
180 }
181 bzero(&io, sizeof io);
182 io.pfrio_flags = flags;
183 io.pfrio_table = *tbl;
184 if (ioctl(dev, DIOCRCLRADDRS, &io))
185 return (-1);
186 if (ndel != NULL)
187 *ndel = io.pfrio_ndel;
188 return (0);
189 }
190
191 int
pfr_add_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int flags)192 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
193 int *nadd, int flags)
194 {
195 int ret;
196
197 ret = pfctl_table_add_addrs(dev, tbl, addr, size, nadd, flags);
198 if (ret) {
199 errno = ret;
200 return (-1);
201 }
202 return (0);
203 }
204
205 int
pfr_del_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * ndel,int flags)206 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
207 int *ndel, int flags)
208 {
209 int ret;
210
211 ret = pfctl_table_del_addrs(dev, tbl, addr, size, ndel, flags);
212 if (ret) {
213 errno = ret;
214 return (-1);
215 }
216 return (0);
217 }
218
219 int
pfr_set_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * size2,int * nadd,int * ndel,int * nchange,int flags)220 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
221 int *size2, int *nadd, int *ndel, int *nchange, int flags)
222 {
223 int ret;
224
225 ret = pfctl_table_set_addrs(dev, tbl, addr, size, size2, nadd, ndel,
226 nchange, flags);
227 if (ret) {
228 errno = ret;
229 return (-1);
230 }
231 return (0);
232 }
233
234 int
pfr_get_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int * size,int flags)235 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
236 int flags)
237 {
238 int ret;
239
240 ret = pfctl_table_get_addrs(dev, tbl, addr, size, flags);
241 if (ret) {
242 errno = ret;
243 return (-1);
244 }
245 return (0);
246 }
247
248 int
pfr_get_astats(struct pfr_table * tbl,struct pfr_astats * addr,int * size,int flags)249 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
250 int flags)
251 {
252 struct pfioc_table io;
253
254 if (tbl == NULL || size == NULL || *size < 0 ||
255 (*size && addr == NULL)) {
256 errno = EINVAL;
257 return (-1);
258 }
259 bzero(&io, sizeof io);
260 io.pfrio_flags = flags;
261 io.pfrio_table = *tbl;
262 io.pfrio_buffer = addr;
263 io.pfrio_esize = sizeof(*addr);
264 io.pfrio_size = *size;
265 if (ioctl(dev, DIOCRGETASTATS, &io)) {
266 pfr_report_error(tbl, &io, "get astats from");
267 return (-1);
268 }
269 *size = io.pfrio_size;
270 return (0);
271 }
272
273 int
pfr_clr_astats(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nzero,int flags)274 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
275 int *nzero, int flags)
276 {
277 struct pfioc_table io;
278
279 if (size < 0 || !tbl || (size && !addr)) {
280 errno = EINVAL;
281 return (-1);
282 }
283 bzero(&io, sizeof io);
284 io.pfrio_flags = flags;
285 io.pfrio_table = *tbl;
286 io.pfrio_buffer = addr;
287 io.pfrio_esize = sizeof(*addr);
288 io.pfrio_size = size;
289 if (ioctl(dev, DIOCRCLRASTATS, &io) == -1)
290 return (-1);
291 if (nzero)
292 *nzero = io.pfrio_nzero;
293 return (0);
294 }
295
296 int
pfr_clr_tstats(struct pfr_table * tbl,int size,int * nzero,int flags)297 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
298 {
299 struct pfioc_table io;
300
301 if (size < 0 || (size && !tbl)) {
302 errno = EINVAL;
303 return (-1);
304 }
305 bzero(&io, sizeof io);
306 io.pfrio_flags = flags;
307 io.pfrio_buffer = tbl;
308 io.pfrio_esize = sizeof(*tbl);
309 io.pfrio_size = size;
310 if (ioctl(dev, DIOCRCLRTSTATS, &io)) {
311 pfr_report_error(tbl, &io, "clear tstats from");
312 return (-1);
313 }
314 if (nzero)
315 *nzero = io.pfrio_nzero;
316 return (0);
317 }
318
319 int
pfr_tst_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nmatch,int flags)320 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
321 int *nmatch, int flags)
322 {
323 struct pfioc_table io;
324
325 if (tbl == NULL || size < 0 || (size && addr == NULL)) {
326 errno = EINVAL;
327 return (-1);
328 }
329 bzero(&io, sizeof io);
330 io.pfrio_flags = flags;
331 io.pfrio_table = *tbl;
332 io.pfrio_buffer = addr;
333 io.pfrio_esize = sizeof(*addr);
334 io.pfrio_size = size;
335 if (ioctl(dev, DIOCRTSTADDRS, &io)) {
336 pfr_report_error(tbl, &io, "test addresses in");
337 return (-1);
338 }
339 if (nmatch)
340 *nmatch = io.pfrio_nmatch;
341 return (0);
342 }
343
344 int
pfr_ina_define(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int * naddr,int ticket,int flags)345 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
346 int *nadd, int *naddr, int ticket, int flags)
347 {
348 struct pfioc_table io;
349
350 if (tbl == NULL || size < 0 || (size && addr == NULL)) {
351 errno = EINVAL;
352 return (-1);
353 }
354 bzero(&io, sizeof io);
355 io.pfrio_flags = flags;
356 io.pfrio_table = *tbl;
357 io.pfrio_buffer = addr;
358 io.pfrio_esize = sizeof(*addr);
359 io.pfrio_size = size;
360 io.pfrio_ticket = ticket;
361 if (ioctl(dev, DIOCRINADEFINE, &io)) {
362 pfr_report_error(tbl, &io, "define inactive set table");
363 return (-1);
364 }
365 if (nadd != NULL)
366 *nadd = io.pfrio_nadd;
367 if (naddr != NULL)
368 *naddr = io.pfrio_naddr;
369 return (0);
370 }
371
372 /* interface management code */
373
374 int
pfi_get_ifaces(const char * filter,struct pfi_kif * buf,int * size)375 pfi_get_ifaces(const char *filter, struct pfi_kif *buf, int *size)
376 {
377 struct pfioc_iface io;
378
379 if (size == NULL || *size < 0 || (*size && buf == NULL)) {
380 errno = EINVAL;
381 return (-1);
382 }
383 bzero(&io, sizeof io);
384 if (filter != NULL)
385 if (strlcpy(io.pfiio_name, filter, sizeof(io.pfiio_name)) >=
386 sizeof(io.pfiio_name)) {
387 errno = EINVAL;
388 return (-1);
389 }
390 io.pfiio_buffer = buf;
391 io.pfiio_esize = sizeof(*buf);
392 io.pfiio_size = *size;
393 if (ioctl(dev, DIOCIGETIFACES, &io))
394 return (-1);
395 *size = io.pfiio_size;
396 return (0);
397 }
398
399 /* buffer management code */
400
401 const size_t buf_esize[PFRB_MAX] = { 0,
402 sizeof(struct pfr_table), sizeof(struct pfr_tstats),
403 sizeof(struct pfr_addr), sizeof(struct pfr_astats),
404 sizeof(struct pfi_kif), sizeof(struct pfioc_trans_e)
405 };
406
407 /*
408 * add one element to the buffer
409 */
410 int
pfr_buf_add(struct pfr_buffer * b,const void * e)411 pfr_buf_add(struct pfr_buffer *b, const void *e)
412 {
413 size_t bs;
414
415 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX ||
416 e == NULL) {
417 errno = EINVAL;
418 return (-1);
419 }
420 bs = buf_esize[b->pfrb_type];
421 if (b->pfrb_size == b->pfrb_msize)
422 if (pfr_buf_grow(b, 0))
423 return (-1);
424 memcpy(((caddr_t)b->pfrb_caddr) + bs * b->pfrb_size, e, bs);
425 b->pfrb_size++;
426 return (0);
427 }
428
429 /*
430 * return next element of the buffer (or first one if prev is NULL)
431 * see PFRB_FOREACH macro
432 */
433 void *
pfr_buf_next(struct pfr_buffer * b,const void * prev)434 pfr_buf_next(struct pfr_buffer *b, const void *prev)
435 {
436 size_t bs;
437
438 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX)
439 return (NULL);
440 if (b->pfrb_size == 0)
441 return (NULL);
442 if (prev == NULL)
443 return (b->pfrb_caddr);
444 bs = buf_esize[b->pfrb_type];
445 if ((((caddr_t)prev)-((caddr_t)b->pfrb_caddr)) / bs >= b->pfrb_size-1)
446 return (NULL);
447 return (((caddr_t)prev) + bs);
448 }
449
450 /*
451 * minsize:
452 * 0: make the buffer somewhat bigger
453 * n: make room for "n" entries in the buffer
454 */
455 int
pfr_buf_grow(struct pfr_buffer * b,int minsize)456 pfr_buf_grow(struct pfr_buffer *b, int minsize)
457 {
458 caddr_t p;
459 size_t bs;
460
461 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX) {
462 errno = EINVAL;
463 return (-1);
464 }
465 if (minsize != 0 && minsize <= b->pfrb_msize)
466 return (0);
467 bs = buf_esize[b->pfrb_type];
468 if (!b->pfrb_msize) {
469 if (minsize < 64)
470 minsize = 64;
471 b->pfrb_caddr = calloc(bs, minsize);
472 if (b->pfrb_caddr == NULL)
473 return (-1);
474 b->pfrb_msize = minsize;
475 } else {
476 if (minsize == 0)
477 minsize = b->pfrb_msize * 2;
478 if (minsize < 0 || minsize >= SIZE_T_MAX / bs) {
479 /* msize overflow */
480 errno = ENOMEM;
481 return (-1);
482 }
483 p = realloc(b->pfrb_caddr, minsize * bs);
484 if (p == NULL)
485 return (-1);
486 bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs);
487 b->pfrb_caddr = p;
488 b->pfrb_msize = minsize;
489 }
490 return (0);
491 }
492
493 /*
494 * reset buffer and free memory.
495 */
496 void
pfr_buf_clear(struct pfr_buffer * b)497 pfr_buf_clear(struct pfr_buffer *b)
498 {
499 if (b == NULL)
500 return;
501 if (b->pfrb_caddr != NULL)
502 free(b->pfrb_caddr);
503 b->pfrb_caddr = NULL;
504 b->pfrb_size = b->pfrb_msize = 0;
505 }
506
507 int
pfr_buf_load(struct pfr_buffer * b,char * file,int nonetwork,int (* append_addr)(struct pfr_buffer *,char *,int))508 pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
509 int (*append_addr)(struct pfr_buffer *, char *, int))
510 {
511 FILE *fp;
512 char buf[BUF_SIZE];
513 int rv;
514
515 if (file == NULL)
516 return (0);
517 if (!strcmp(file, "-"))
518 fp = stdin;
519 else {
520 fp = pfctl_fopen(file, "r");
521 if (fp == NULL)
522 return (-1);
523 }
524 while ((rv = pfr_next_token(buf, fp)) == 1)
525 if (append_addr(b, buf, nonetwork)) {
526 rv = -1;
527 break;
528 }
529 if (fp != stdin)
530 fclose(fp);
531 return (rv);
532 }
533
534 int
pfr_next_token(char buf[BUF_SIZE],FILE * fp)535 pfr_next_token(char buf[BUF_SIZE], FILE *fp)
536 {
537 static char next_ch = ' ';
538 int i = 0;
539
540 for (;;) {
541 /* skip spaces */
542 while (isspace(next_ch) && !feof(fp))
543 next_ch = fgetc(fp);
544 /* remove from '#' or ';' until end of line */
545 if (next_ch == '#' || next_ch == ';')
546 while (!feof(fp)) {
547 next_ch = fgetc(fp);
548 if (next_ch == '\n')
549 break;
550 }
551 else
552 break;
553 }
554 if (feof(fp)) {
555 next_ch = ' ';
556 return (0);
557 }
558 do {
559 if (i < BUF_SIZE)
560 buf[i++] = next_ch;
561 next_ch = fgetc(fp);
562 } while (!feof(fp) && !isspace(next_ch));
563 if (i >= BUF_SIZE) {
564 errno = EINVAL;
565 return (-1);
566 }
567 buf[i] = '\0';
568 return (1);
569 }
570
571 char *
pfr_strerror(int errnum)572 pfr_strerror(int errnum)
573 {
574 switch (errnum) {
575 case ESRCH:
576 return "Table does not exist";
577 case ENOENT:
578 return "Anchor or Ruleset does not exist";
579 default:
580 return strerror(errnum);
581 }
582 }
583