1 /* $OpenBSD: pfctl_radix.c,v 1.27 2005/05/21 21:03:58 henning Exp $ */
2
3 /*-
4 * SPDX-License-Identifier: BSD-2-Clause
5 *
6 * Copyright (c) 2002 Cedric Berger
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34
35 #include <sys/types.h>
36 #include <sys/ioctl.h>
37 #include <sys/socket.h>
38
39 #include <net/if.h>
40 #include <net/pfvar.h>
41
42 #include <errno.h>
43 #include <string.h>
44 #include <ctype.h>
45 #include <stdio.h>
46 #include <stdlib.h>
47 #include <limits.h>
48 #include <err.h>
49
50 #include "pfctl.h"
51 #include "pfctl_parser.h"
52
53 #define BUF_SIZE 256
54
55 extern int dev;
56
57 static int pfr_next_token(char buf[BUF_SIZE], FILE *);
58
59 struct pfr_ktablehead pfr_ktables = { 0 };
60 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
61
62 int
pfr_ktable_compare(struct pfr_ktable * p,struct pfr_ktable * q)63 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
64 {
65 int d;
66
67 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
68 return (d);
69 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
70 }
71
72 static void
pfr_report_error(struct pfr_table * tbl,struct pfioc_table * io,const char * err)73 pfr_report_error(struct pfr_table *tbl, struct pfioc_table *io,
74 const char *err)
75 {
76 unsigned long maxcount;
77 size_t s;
78
79 s = sizeof(maxcount);
80 if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, NULL,
81 0) == -1)
82 return;
83
84 if (io->pfrio_size > maxcount || io->pfrio_size2 > maxcount)
85 fprintf(stderr, "cannot %s %s: too many elements.\n"
86 "Consider increasing net.pf.request_maxcount.",
87 err, tbl->pfrt_name);
88 }
89
90 int
pfr_add_table(struct pfr_table * tbl,int * nadd,int flags)91 pfr_add_table(struct pfr_table *tbl, int *nadd, int flags)
92 {
93 return (pfctl_add_table(pfh, tbl, nadd, flags));
94 }
95
96 int
pfr_del_table(struct pfr_table * tbl,int * ndel,int flags)97 pfr_del_table(struct pfr_table *tbl, int *ndel, int flags)
98 {
99 return (pfctl_del_table(pfh, tbl, ndel, flags));
100 }
101
102 int
pfr_get_tables(struct pfr_table * filter,struct pfr_table * tbl,int * size,int flags)103 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
104 int flags)
105 {
106 struct pfioc_table io;
107
108 if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
109 errno = EINVAL;
110 return (-1);
111 }
112 bzero(&io, sizeof io);
113 io.pfrio_flags = flags;
114 if (filter != NULL)
115 io.pfrio_table = *filter;
116 io.pfrio_buffer = tbl;
117 io.pfrio_esize = sizeof(*tbl);
118 io.pfrio_size = *size;
119 if (ioctl(dev, DIOCRGETTABLES, &io)) {
120 pfr_report_error(tbl, &io, "get table");
121 return (-1);
122 }
123 *size = io.pfrio_size;
124 return (0);
125 }
126
127 int
pfr_clr_addrs(struct pfr_table * tbl,int * ndel,int flags)128 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
129 {
130 return (pfctl_clear_addrs(pfh, tbl, ndel, flags));
131 }
132
133 int
pfr_add_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int flags)134 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
135 int *nadd, int flags)
136 {
137 int ret;
138
139 if (*nadd)
140 *nadd = 0;
141
142 ret = pfctl_table_add_addrs_h(pfh, tbl, addr, size, nadd, flags);
143 if (ret) {
144 errno = ret;
145 return (-1);
146 }
147 return (0);
148 }
149
150 int
pfr_del_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * ndel,int flags)151 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
152 int *ndel, int flags)
153 {
154 int ret;
155
156 ret = pfctl_table_del_addrs_h(pfh, tbl, addr, size, ndel, flags);
157 if (ret) {
158 errno = ret;
159 return (-1);
160 }
161 return (0);
162 }
163
164 int
pfr_set_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * size2,int * nadd,int * ndel,int * nchange,int flags)165 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
166 int *size2, int *nadd, int *ndel, int *nchange, int flags)
167 {
168 int ret;
169
170 ret = pfctl_table_set_addrs(dev, tbl, addr, size, size2, nadd, ndel,
171 nchange, flags);
172 if (ret) {
173 errno = ret;
174 return (-1);
175 }
176 return (0);
177 }
178
179 int
pfr_get_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int * size,int flags)180 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
181 int flags)
182 {
183 int ret;
184
185 ret = pfctl_table_get_addrs(dev, tbl, addr, size, flags);
186 if (ret) {
187 errno = ret;
188 return (-1);
189 }
190 return (0);
191 }
192
193 int
pfr_get_astats(struct pfr_table * tbl,struct pfr_astats * addr,int * size,int flags)194 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
195 int flags)
196 {
197 struct pfioc_table io;
198
199 if (tbl == NULL || size == NULL || *size < 0 ||
200 (*size && addr == NULL)) {
201 errno = EINVAL;
202 return (-1);
203 }
204 bzero(&io, sizeof io);
205 io.pfrio_flags = flags;
206 io.pfrio_table = *tbl;
207 io.pfrio_buffer = addr;
208 io.pfrio_esize = sizeof(*addr);
209 io.pfrio_size = *size;
210 if (ioctl(dev, DIOCRGETASTATS, &io)) {
211 pfr_report_error(tbl, &io, "get astats from");
212 return (-1);
213 }
214 *size = io.pfrio_size;
215 return (0);
216 }
217
218 int
pfr_clr_astats(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nzero,int flags)219 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
220 int *nzero, int flags)
221 {
222 struct pfioc_table io;
223
224 if (size < 0 || !tbl || (size && !addr)) {
225 errno = EINVAL;
226 return (-1);
227 }
228 bzero(&io, sizeof io);
229 io.pfrio_flags = flags;
230 io.pfrio_table = *tbl;
231 io.pfrio_buffer = addr;
232 io.pfrio_esize = sizeof(*addr);
233 io.pfrio_size = size;
234 if (ioctl(dev, DIOCRCLRASTATS, &io) == -1)
235 return (-1);
236 if (nzero)
237 *nzero = io.pfrio_nzero;
238 return (0);
239 }
240
241 int
pfr_tst_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nmatch,int flags)242 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
243 int *nmatch, int flags)
244 {
245 struct pfioc_table io;
246
247 if (tbl == NULL || size < 0 || (size && addr == NULL)) {
248 errno = EINVAL;
249 return (-1);
250 }
251 bzero(&io, sizeof io);
252 io.pfrio_flags = flags;
253 io.pfrio_table = *tbl;
254 io.pfrio_buffer = addr;
255 io.pfrio_esize = sizeof(*addr);
256 io.pfrio_size = size;
257 if (ioctl(dev, DIOCRTSTADDRS, &io)) {
258 pfr_report_error(tbl, &io, "test addresses in");
259 return (-1);
260 }
261 if (nmatch)
262 *nmatch = io.pfrio_nmatch;
263 return (0);
264 }
265
266 int
pfr_ina_define(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int * naddr,int ticket,int flags)267 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
268 int *nadd, int *naddr, int ticket, int flags)
269 {
270 struct pfioc_table io;
271
272 if (tbl == NULL || size < 0 || (size && addr == NULL)) {
273 DBGPRINT("%s %p %d %p\n", __func__, tbl, size, addr);
274 errno = EINVAL;
275 return (-1);
276 }
277 bzero(&io, sizeof io);
278 io.pfrio_flags = flags;
279 io.pfrio_table = *tbl;
280 io.pfrio_buffer = addr;
281 io.pfrio_esize = sizeof(*addr);
282 io.pfrio_size = size;
283 io.pfrio_ticket = ticket;
284 if (ioctl(dev, DIOCRINADEFINE, &io)) {
285 pfr_report_error(tbl, &io, "define inactive set table");
286 return (-1);
287 }
288 if (nadd != NULL)
289 *nadd = io.pfrio_nadd;
290 if (naddr != NULL)
291 *naddr = io.pfrio_naddr;
292 return (0);
293 }
294
295 /* interface management code */
296
297 int
pfi_get_ifaces(const char * filter,struct pfi_kif * buf,int * size)298 pfi_get_ifaces(const char *filter, struct pfi_kif *buf, int *size)
299 {
300 struct pfioc_iface io;
301
302 if (size == NULL || *size < 0 || (*size && buf == NULL)) {
303 errno = EINVAL;
304 return (-1);
305 }
306 bzero(&io, sizeof io);
307 if (filter != NULL)
308 if (strlcpy(io.pfiio_name, filter, sizeof(io.pfiio_name)) >=
309 sizeof(io.pfiio_name)) {
310 errno = EINVAL;
311 return (-1);
312 }
313 io.pfiio_buffer = buf;
314 io.pfiio_esize = sizeof(*buf);
315 io.pfiio_size = *size;
316 if (ioctl(dev, DIOCIGETIFACES, &io))
317 return (-1);
318 *size = io.pfiio_size;
319 return (0);
320 }
321
322 /* buffer management code */
323
324 const size_t buf_esize[PFRB_MAX] = { 0,
325 sizeof(struct pfr_table), sizeof(struct pfr_tstats),
326 sizeof(struct pfr_addr), sizeof(struct pfr_astats),
327 sizeof(struct pfi_kif), sizeof(struct pfioc_trans_e)
328 };
329
330 /*
331 * add one element to the buffer
332 */
333 int
pfr_buf_add(struct pfr_buffer * b,const void * e)334 pfr_buf_add(struct pfr_buffer *b, const void *e)
335 {
336 size_t bs;
337
338 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX ||
339 e == NULL) {
340 errno = EINVAL;
341 return (-1);
342 }
343 bs = buf_esize[b->pfrb_type];
344 if (b->pfrb_size == b->pfrb_msize)
345 if (pfr_buf_grow(b, 0))
346 return (-1);
347 memcpy(((caddr_t)b->pfrb_caddr) + bs * b->pfrb_size, e, bs);
348 b->pfrb_size++;
349 return (0);
350 }
351
352 /*
353 * return next element of the buffer (or first one if prev is NULL)
354 * see PFRB_FOREACH macro
355 */
356 void *
pfr_buf_next(struct pfr_buffer * b,const void * prev)357 pfr_buf_next(struct pfr_buffer *b, const void *prev)
358 {
359 size_t bs;
360
361 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX)
362 return (NULL);
363 if (b->pfrb_size == 0)
364 return (NULL);
365 if (prev == NULL)
366 return (b->pfrb_caddr);
367 bs = buf_esize[b->pfrb_type];
368 if ((((caddr_t)prev)-((caddr_t)b->pfrb_caddr)) / bs >= b->pfrb_size-1)
369 return (NULL);
370 return (((caddr_t)prev) + bs);
371 }
372
373 /*
374 * minsize:
375 * 0: make the buffer somewhat bigger
376 * n: make room for "n" entries in the buffer
377 */
378 int
pfr_buf_grow(struct pfr_buffer * b,int minsize)379 pfr_buf_grow(struct pfr_buffer *b, int minsize)
380 {
381 caddr_t p;
382 size_t bs;
383
384 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX) {
385 errno = EINVAL;
386 return (-1);
387 }
388 if (minsize != 0 && minsize <= b->pfrb_msize)
389 return (0);
390 bs = buf_esize[b->pfrb_type];
391 if (!b->pfrb_msize) {
392 if (minsize < 64)
393 minsize = 64;
394 }
395 if (minsize == 0)
396 minsize = b->pfrb_msize * 2;
397 p = reallocarray(b->pfrb_caddr, minsize, bs);
398 if (p == NULL)
399 return (-1);
400 bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs);
401 b->pfrb_caddr = p;
402 b->pfrb_msize = minsize;
403 return (0);
404 }
405
406 /*
407 * reset buffer and free memory.
408 */
409 void
pfr_buf_clear(struct pfr_buffer * b)410 pfr_buf_clear(struct pfr_buffer *b)
411 {
412 if (b == NULL)
413 return;
414 free(b->pfrb_caddr);
415 b->pfrb_caddr = NULL;
416 b->pfrb_size = b->pfrb_msize = 0;
417 }
418
419 int
pfr_buf_load(struct pfr_buffer * b,char * file,int nonetwork,int (* append_addr)(struct pfr_buffer *,char *,int,int),int opts)420 pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
421 int (*append_addr)(struct pfr_buffer *, char *, int, int), int opts)
422 {
423 FILE *fp;
424 char buf[BUF_SIZE];
425 int rv;
426
427 if (file == NULL)
428 return (0);
429 if (!strcmp(file, "-"))
430 fp = stdin;
431 else {
432 fp = pfctl_fopen(file, "r");
433 if (fp == NULL)
434 return (-1);
435 }
436 while ((rv = pfr_next_token(buf, fp)) == 1)
437 if (append_addr(b, buf, nonetwork, opts)) {
438 rv = -1;
439 break;
440 }
441 if (fp != stdin)
442 fclose(fp);
443 return (rv);
444 }
445
446 int
pfr_next_token(char buf[BUF_SIZE],FILE * fp)447 pfr_next_token(char buf[BUF_SIZE], FILE *fp)
448 {
449 static char next_ch = ' ';
450 int i = 0;
451
452 for (;;) {
453 /* skip spaces */
454 while (isspace(next_ch) && !feof(fp))
455 next_ch = fgetc(fp);
456 /* remove from '#' or ';' until end of line */
457 if (next_ch == '#' || next_ch == ';')
458 while (!feof(fp)) {
459 next_ch = fgetc(fp);
460 if (next_ch == '\n')
461 break;
462 }
463 else
464 break;
465 }
466 if (feof(fp)) {
467 next_ch = ' ';
468 return (0);
469 }
470 do {
471 if (i < BUF_SIZE)
472 buf[i++] = next_ch;
473 next_ch = fgetc(fp);
474 } while (!feof(fp) && !isspace(next_ch));
475 if (i >= BUF_SIZE) {
476 errno = EINVAL;
477 return (-1);
478 }
479 buf[i] = '\0';
480 return (1);
481 }
482