1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 * $OpenBSD: pf_ruleset.c,v 1.2 2008/12/18 15:31:37 dhill Exp $ 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include <sys/param.h> 43 #include <sys/socket.h> 44 #include <sys/mbuf.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_systm.h> 48 #include <netinet/ip.h> 49 #include <netinet/tcp.h> 50 51 #include <net/if.h> 52 #include <net/vnet.h> 53 #include <net/pfvar.h> 54 55 #ifdef INET6 56 #include <netinet/ip6.h> 57 #endif /* INET6 */ 58 59 #include <arpa/inet.h> 60 #include <errno.h> 61 #include <stdio.h> 62 #include <stdlib.h> 63 #include <string.h> 64 #define rs_malloc(x) calloc(1, x) 65 #define rs_free(x) free(x) 66 67 #include "pfctl.h" 68 #include "pfctl_parser.h" 69 70 #ifdef PFDEBUG 71 #include <sys/stdarg.h> 72 #define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) 73 #else 74 #define DPFPRINTF(format, x...) ((void)0) 75 #endif /* PFDEBUG */ 76 77 struct pfctl_anchor_global pf_anchors; 78 extern struct pfctl_anchor pf_main_anchor; 79 extern struct pfctl_eth_anchor pf_eth_main_anchor; 80 #undef V_pf_anchors 81 #define V_pf_anchors pf_anchors 82 #undef pf_main_ruleset 83 #define pf_main_ruleset pf_main_anchor.ruleset 84 85 static __inline int pf_anchor_compare(struct pfctl_anchor *, 86 struct pfctl_anchor *); 87 static struct pfctl_anchor *pf_find_anchor(const char *); 88 89 RB_GENERATE(pfctl_anchor_global, pfctl_anchor, entry_global, 90 pf_anchor_compare); 91 RB_GENERATE(pfctl_anchor_node, pfctl_anchor, entry_node, pf_anchor_compare); 92 93 static __inline int 94 pf_anchor_compare(struct pfctl_anchor *a, struct pfctl_anchor *b) 95 { 96 int c = strcmp(a->path, b->path); 97 98 return (c ? (c < 0 ? -1 : 1) : 0); 99 } 100 101 int 102 pf_get_ruleset_number(u_int8_t action) 103 { 104 switch (action) { 105 case PF_SCRUB: 106 case PF_NOSCRUB: 107 return (PF_RULESET_SCRUB); 108 break; 109 case PF_PASS: 110 case PF_DROP: 111 case PF_MATCH: 112 return (PF_RULESET_FILTER); 113 break; 114 case PF_NAT: 115 case PF_NONAT: 116 return (PF_RULESET_NAT); 117 break; 118 case PF_BINAT: 119 case PF_NOBINAT: 120 return (PF_RULESET_BINAT); 121 break; 122 case PF_RDR: 123 case PF_NORDR: 124 return (PF_RULESET_RDR); 125 break; 126 default: 127 return (PF_RULESET_MAX); 128 break; 129 } 130 } 131 132 void 133 pf_init_ruleset(struct pfctl_ruleset *ruleset) 134 { 135 int i; 136 137 memset(ruleset, 0, sizeof(struct pfctl_ruleset)); 138 for (i = 0; i < PF_RULESET_MAX; i++) { 139 TAILQ_INIT(&ruleset->rules[i].queues[0]); 140 TAILQ_INIT(&ruleset->rules[i].queues[1]); 141 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 142 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 143 } 144 } 145 146 static struct pfctl_anchor * 147 pf_find_anchor(const char *path) 148 { 149 struct pfctl_anchor *key, *found; 150 151 key = (struct pfctl_anchor *)rs_malloc(sizeof(*key)); 152 if (key == NULL) 153 return (NULL); 154 strlcpy(key->path, path, sizeof(key->path)); 155 found = RB_FIND(pfctl_anchor_global, &V_pf_anchors, key); 156 rs_free(key); 157 return (found); 158 } 159 160 struct pfctl_ruleset * 161 pf_find_ruleset(const char *path) 162 { 163 struct pfctl_anchor *anchor; 164 165 while (*path == '/') 166 path++; 167 if (!*path) 168 return (&pf_main_ruleset); 169 anchor = pf_find_anchor(path); 170 if (anchor == NULL) 171 return (NULL); 172 else 173 return (&anchor->ruleset); 174 } 175 176 struct pfctl_ruleset * 177 pf_find_or_create_ruleset(const char *path) 178 { 179 char *p, *q, *r; 180 struct pfctl_ruleset *ruleset; 181 struct pfctl_anchor *anchor = NULL, *dup, *parent = NULL; 182 183 if (path[0] == 0) 184 return (&pf_main_ruleset); 185 while (*path == '/') 186 path++; 187 ruleset = pf_find_ruleset(path); 188 if (ruleset != NULL) 189 return (ruleset); 190 p = (char *)rs_malloc(MAXPATHLEN); 191 if (p == NULL) 192 return (NULL); 193 strlcpy(p, path, MAXPATHLEN); 194 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 195 *q = 0; 196 if ((ruleset = pf_find_ruleset(p)) != NULL) { 197 parent = ruleset->anchor; 198 break; 199 } 200 } 201 if (q == NULL) 202 q = p; 203 else 204 q++; 205 strlcpy(p, path, MAXPATHLEN); 206 if (!*q) { 207 rs_free(p); 208 return (NULL); 209 } 210 while ((r = strchr(q, '/')) != NULL || *q) { 211 if (r != NULL) 212 *r = 0; 213 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 214 (parent != NULL && strlen(parent->path) >= 215 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 216 rs_free(p); 217 return (NULL); 218 } 219 anchor = (struct pfctl_anchor *)rs_malloc(sizeof(*anchor)); 220 if (anchor == NULL) { 221 rs_free(p); 222 return (NULL); 223 } 224 RB_INIT(&anchor->children); 225 strlcpy(anchor->name, q, sizeof(anchor->name)); 226 if (parent != NULL) { 227 strlcpy(anchor->path, parent->path, 228 sizeof(anchor->path)); 229 strlcat(anchor->path, "/", sizeof(anchor->path)); 230 } 231 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 232 if ((dup = RB_INSERT(pfctl_anchor_global, &V_pf_anchors, anchor)) != 233 NULL) { 234 printf("pf_find_or_create_ruleset: RB_INSERT1 " 235 "'%s' '%s' collides with '%s' '%s'\n", 236 anchor->path, anchor->name, dup->path, dup->name); 237 rs_free(anchor); 238 rs_free(p); 239 return (NULL); 240 } 241 if (parent != NULL) { 242 anchor->parent = parent; 243 if ((dup = RB_INSERT(pfctl_anchor_node, &parent->children, 244 anchor)) != NULL) { 245 printf("pf_find_or_create_ruleset: " 246 "RB_INSERT2 '%s' '%s' collides with " 247 "'%s' '%s'\n", anchor->path, anchor->name, 248 dup->path, dup->name); 249 RB_REMOVE(pfctl_anchor_global, &V_pf_anchors, 250 anchor); 251 rs_free(anchor); 252 rs_free(p); 253 return (NULL); 254 } 255 } 256 pf_init_ruleset(&anchor->ruleset); 257 anchor->ruleset.anchor = anchor; 258 parent = anchor; 259 if (r != NULL) 260 q = r + 1; 261 else 262 *q = 0; 263 } 264 rs_free(p); 265 return (&anchor->ruleset); 266 } 267 268 void 269 pf_remove_if_empty_ruleset(struct pfctl_ruleset *ruleset) 270 { 271 struct pfctl_anchor *parent; 272 int i; 273 274 while (ruleset != NULL) { 275 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 276 !RB_EMPTY(&ruleset->anchor->children) || 277 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 278 ruleset->topen) 279 return; 280 for (i = 0; i < PF_RULESET_MAX; ++i) 281 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 282 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 283 ruleset->rules[i].inactive.open) 284 return; 285 RB_REMOVE(pfctl_anchor_global, &V_pf_anchors, ruleset->anchor); 286 if ((parent = ruleset->anchor->parent) != NULL) 287 RB_REMOVE(pfctl_anchor_node, &parent->children, 288 ruleset->anchor); 289 rs_free(ruleset->anchor); 290 if (parent == NULL) 291 return; 292 ruleset = &parent->ruleset; 293 } 294 } 295 296 void 297 pf_remove_if_empty_eth_ruleset(struct pfctl_eth_ruleset *ruleset) 298 { 299 struct pfctl_eth_anchor *parent; 300 301 return; 302 while (ruleset != NULL) { 303 if (ruleset == &pf_eth_main_anchor.ruleset || 304 ruleset->anchor == NULL || ruleset->anchor->refcnt > 0) 305 return; 306 if (!TAILQ_EMPTY(&ruleset->rules)) 307 return; 308 rs_free(ruleset->anchor); 309 if (parent == NULL) 310 return; 311 ruleset = &parent->ruleset; 312 } 313 } 314 315 void 316 pf_init_eth_ruleset(struct pfctl_eth_ruleset *ruleset) 317 { 318 319 memset(ruleset, 0, sizeof(*ruleset)); 320 TAILQ_INIT(&ruleset->rules); 321 } 322 323 324 static struct pfctl_eth_anchor* 325 _pf_find_eth_anchor(struct pfctl_eth_anchor *anchor, const char *path) 326 { 327 struct pfctl_eth_rule *r; 328 struct pfctl_eth_anchor *a; 329 330 if (strcmp(path, anchor->path) == 0) 331 return (anchor); 332 333 TAILQ_FOREACH(r, &anchor->ruleset.rules, entries) { 334 if (! r->anchor) 335 continue; 336 337 /* Step into anchor */ 338 a = _pf_find_eth_anchor(r->anchor, path); 339 if (a) 340 return (a); 341 } 342 343 return (NULL); 344 } 345 346 static struct pfctl_eth_anchor* 347 pf_find_eth_anchor(const char *path) 348 { 349 return (_pf_find_eth_anchor(&pf_eth_main_anchor, path)); 350 } 351 352 static struct pfctl_eth_ruleset* 353 pf_find_eth_ruleset(const char *path) 354 { 355 struct pfctl_eth_anchor *anchor; 356 357 while (*path == '/') 358 path++; 359 if (!*path) 360 return (&pf_eth_main_anchor.ruleset); 361 anchor = pf_find_eth_anchor(path); 362 if (anchor == NULL) 363 return (NULL); 364 else 365 return (&anchor->ruleset); 366 } 367 368 struct pfctl_eth_ruleset * 369 pf_find_or_create_eth_ruleset(const char *path) 370 { 371 char *p, *q, *r; 372 struct pfctl_eth_ruleset *ruleset; 373 struct pfctl_eth_anchor *anchor = NULL, *parent = NULL; 374 375 if (path[0] == 0) 376 return (&pf_eth_main_anchor.ruleset); 377 while (*path == '/') 378 path++; 379 ruleset = pf_find_eth_ruleset(path); 380 if (ruleset != NULL) 381 return (ruleset); 382 p = (char *)rs_malloc(MAXPATHLEN); 383 if (p == NULL) 384 return (NULL); 385 strlcpy(p, path, MAXPATHLEN); 386 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 387 *q = 0; 388 if ((ruleset = pf_find_eth_ruleset(p)) != NULL) { 389 parent = ruleset->anchor; 390 break; 391 } 392 } 393 if (q == NULL) 394 q = p; 395 else 396 q++; 397 strlcpy(p, path, MAXPATHLEN); 398 if (!*q) { 399 rs_free(p); 400 return (NULL); 401 } 402 while ((r = strchr(q, '/')) != NULL || *q) { 403 if (r != NULL) 404 *r = 0; 405 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 406 (parent != NULL && strlen(parent->path) >= 407 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 408 rs_free(p); 409 return (NULL); 410 } 411 anchor = (struct pfctl_eth_anchor *)rs_malloc(sizeof(*anchor)); 412 if (anchor == NULL) { 413 rs_free(p); 414 return (NULL); 415 } 416 strlcpy(anchor->name, q, sizeof(anchor->name)); 417 if (parent != NULL) { 418 strlcpy(anchor->path, parent->path, 419 sizeof(anchor->path)); 420 strlcat(anchor->path, "/", sizeof(anchor->path)); 421 } 422 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 423 if (parent != NULL) 424 anchor->parent = parent; 425 pf_init_eth_ruleset(&anchor->ruleset); 426 anchor->ruleset.anchor = anchor; 427 parent = anchor; 428 if (r != NULL) 429 q = r + 1; 430 else 431 *q = 0; 432 } 433 rs_free(p); 434 return (&anchor->ruleset); 435 } 436 437 int 438 pfctl_anchor_setup(struct pfctl_rule *r, const struct pfctl_ruleset *s, 439 const char *name) 440 { 441 char *p, *path; 442 struct pfctl_ruleset *ruleset; 443 444 r->anchor = NULL; 445 r->anchor_relative = 0; 446 r->anchor_wildcard = 0; 447 if (!name[0]) 448 return (0); 449 path = (char *)rs_malloc(MAXPATHLEN); 450 if (path == NULL) 451 return (1); 452 if (name[0] == '/') 453 strlcpy(path, name + 1, MAXPATHLEN); 454 else { 455 /* relative path */ 456 r->anchor_relative = 1; 457 if (s->anchor == NULL || !s->anchor->path[0]) 458 path[0] = 0; 459 else 460 strlcpy(path, s->anchor->path, MAXPATHLEN); 461 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 462 if (!path[0]) { 463 printf("pfctl_anchor_setup: .. beyond root\n"); 464 rs_free(path); 465 return (1); 466 } 467 if ((p = strrchr(path, '/')) != NULL) 468 *p = 0; 469 else 470 path[0] = 0; 471 r->anchor_relative++; 472 name += 3; 473 } 474 if (path[0]) 475 strlcat(path, "/", MAXPATHLEN); 476 strlcat(path, name, MAXPATHLEN); 477 } 478 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 479 r->anchor_wildcard = 1; 480 *p = 0; 481 } 482 ruleset = pf_find_or_create_ruleset(path); 483 rs_free(path); 484 if (ruleset == NULL || ruleset->anchor == NULL) { 485 printf("pfctl_anchor_setup: ruleset\n"); 486 return (1); 487 } 488 r->anchor = ruleset->anchor; 489 r->anchor->refcnt++; 490 return (0); 491 } 492 493 int 494 pfctl_eth_anchor_setup(struct pfctl *pf, struct pfctl_eth_rule *r, 495 const struct pfctl_eth_ruleset *s, const char *name) 496 { 497 char *p, *path; 498 struct pfctl_eth_ruleset *ruleset; 499 500 r->anchor = NULL; 501 if (!name[0]) 502 return (0); 503 path = (char *)rs_malloc(MAXPATHLEN); 504 if (path == NULL) 505 return (1); 506 if (name[0] == '/') 507 strlcpy(path, name + 1, MAXPATHLEN); 508 else { 509 /* relative path */ 510 if (s->anchor == NULL || !s->anchor->path[0]) 511 path[0] = 0; 512 else 513 strlcpy(path, s->anchor->path, MAXPATHLEN); 514 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 515 if (!path[0]) { 516 printf("%s: .. beyond root\n", __func__); 517 rs_free(path); 518 return (1); 519 } 520 if ((p = strrchr(path, '/')) != NULL) 521 *p = 0; 522 else 523 path[0] = 0; 524 name += 3; 525 } 526 if (path[0]) 527 strlcat(path, "/", MAXPATHLEN); 528 strlcat(path, name, MAXPATHLEN); 529 } 530 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 531 *p = 0; 532 } 533 ruleset = pf_find_or_create_eth_ruleset(path); 534 rs_free(path); 535 if (ruleset == NULL || ruleset->anchor == NULL) { 536 printf("%s: ruleset\n", __func__); 537 return (1); 538 } 539 r->anchor = ruleset->anchor; 540 r->anchor->refcnt++; 541 return (0); 542 } 543