1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 * $OpenBSD: pf_ruleset.c,v 1.2 2008/12/18 15:31:37 dhill Exp $ 37 */ 38 39 #include <sys/cdefs.h> 40 #include <sys/param.h> 41 #include <sys/socket.h> 42 #include <sys/mbuf.h> 43 44 #include <netinet/in.h> 45 #include <netinet/in_systm.h> 46 #include <netinet/ip.h> 47 #include <netinet/tcp.h> 48 49 #include <net/if.h> 50 #include <net/vnet.h> 51 #include <net/pfvar.h> 52 53 #ifdef INET6 54 #include <netinet/ip6.h> 55 #endif /* INET6 */ 56 57 #include <arpa/inet.h> 58 #include <errno.h> 59 #include <stdio.h> 60 #include <stdlib.h> 61 #include <string.h> 62 #define rs_malloc(x) calloc(1, x) 63 #define rs_free(x) free(x) 64 65 #include "pfctl.h" 66 #include "pfctl_parser.h" 67 68 #ifdef PFDEBUG 69 #include <sys/stdarg.h> 70 #define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) 71 #else 72 #define DPFPRINTF(format, x...) ((void)0) 73 #endif /* PFDEBUG */ 74 75 struct pfctl_anchor_global pf_anchors; 76 extern struct pfctl_anchor pf_main_anchor; 77 extern struct pfctl_eth_anchor pf_eth_main_anchor; 78 #undef V_pf_anchors 79 #define V_pf_anchors pf_anchors 80 #undef pf_main_ruleset 81 #define pf_main_ruleset pf_main_anchor.ruleset 82 83 static __inline int pf_anchor_compare(struct pfctl_anchor *, 84 struct pfctl_anchor *); 85 static struct pfctl_anchor *pf_find_anchor(const char *); 86 87 RB_GENERATE(pfctl_anchor_global, pfctl_anchor, entry_global, 88 pf_anchor_compare); 89 RB_GENERATE(pfctl_anchor_node, pfctl_anchor, entry_node, pf_anchor_compare); 90 91 static __inline int 92 pf_anchor_compare(struct pfctl_anchor *a, struct pfctl_anchor *b) 93 { 94 int c = strcmp(a->path, b->path); 95 96 return (c ? (c < 0 ? -1 : 1) : 0); 97 } 98 99 int 100 pf_get_ruleset_number(u_int8_t action) 101 { 102 switch (action) { 103 case PF_SCRUB: 104 case PF_NOSCRUB: 105 return (PF_RULESET_SCRUB); 106 break; 107 case PF_PASS: 108 case PF_DROP: 109 case PF_MATCH: 110 return (PF_RULESET_FILTER); 111 break; 112 case PF_NAT: 113 case PF_NONAT: 114 return (PF_RULESET_NAT); 115 break; 116 case PF_BINAT: 117 case PF_NOBINAT: 118 return (PF_RULESET_BINAT); 119 break; 120 case PF_RDR: 121 case PF_NORDR: 122 return (PF_RULESET_RDR); 123 break; 124 default: 125 return (PF_RULESET_MAX); 126 break; 127 } 128 } 129 130 void 131 pf_init_ruleset(struct pfctl_ruleset *ruleset) 132 { 133 int i; 134 135 memset(ruleset, 0, sizeof(struct pfctl_ruleset)); 136 for (i = 0; i < PF_RULESET_MAX; i++) { 137 TAILQ_INIT(&ruleset->rules[i].queues[0]); 138 TAILQ_INIT(&ruleset->rules[i].queues[1]); 139 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 140 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 141 } 142 } 143 144 static struct pfctl_anchor * 145 pf_find_anchor(const char *path) 146 { 147 struct pfctl_anchor *key, *found; 148 149 key = (struct pfctl_anchor *)rs_malloc(sizeof(*key)); 150 if (key == NULL) 151 return (NULL); 152 strlcpy(key->path, path, sizeof(key->path)); 153 found = RB_FIND(pfctl_anchor_global, &V_pf_anchors, key); 154 rs_free(key); 155 return (found); 156 } 157 158 struct pfctl_ruleset * 159 pf_find_ruleset(const char *path) 160 { 161 struct pfctl_anchor *anchor; 162 163 while (*path == '/') 164 path++; 165 if (!*path) 166 return (&pf_main_ruleset); 167 anchor = pf_find_anchor(path); 168 if (anchor == NULL) 169 return (NULL); 170 else 171 return (&anchor->ruleset); 172 } 173 174 struct pfctl_ruleset * 175 pf_find_or_create_ruleset(const char *path) 176 { 177 char *p, *q, *r; 178 struct pfctl_ruleset *ruleset; 179 struct pfctl_anchor *anchor = NULL, *dup, *parent = NULL; 180 181 if (path[0] == 0) 182 return (&pf_main_ruleset); 183 while (*path == '/') 184 path++; 185 ruleset = pf_find_ruleset(path); 186 if (ruleset != NULL) 187 return (ruleset); 188 p = (char *)rs_malloc(MAXPATHLEN); 189 if (p == NULL) 190 return (NULL); 191 strlcpy(p, path, MAXPATHLEN); 192 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 193 *q = 0; 194 if ((ruleset = pf_find_ruleset(p)) != NULL) { 195 parent = ruleset->anchor; 196 break; 197 } 198 } 199 if (q == NULL) 200 q = p; 201 else 202 q++; 203 strlcpy(p, path, MAXPATHLEN); 204 if (!*q) { 205 rs_free(p); 206 return (NULL); 207 } 208 while ((r = strchr(q, '/')) != NULL || *q) { 209 if (r != NULL) 210 *r = 0; 211 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 212 (parent != NULL && strlen(parent->path) >= 213 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 214 rs_free(p); 215 return (NULL); 216 } 217 anchor = (struct pfctl_anchor *)rs_malloc(sizeof(*anchor)); 218 if (anchor == NULL) { 219 rs_free(p); 220 return (NULL); 221 } 222 RB_INIT(&anchor->children); 223 strlcpy(anchor->name, q, sizeof(anchor->name)); 224 if (parent != NULL) { 225 strlcpy(anchor->path, parent->path, 226 sizeof(anchor->path)); 227 strlcat(anchor->path, "/", sizeof(anchor->path)); 228 } 229 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 230 if ((dup = RB_INSERT(pfctl_anchor_global, &V_pf_anchors, anchor)) != 231 NULL) { 232 printf("pf_find_or_create_ruleset: RB_INSERT1 " 233 "'%s' '%s' collides with '%s' '%s'\n", 234 anchor->path, anchor->name, dup->path, dup->name); 235 rs_free(anchor); 236 rs_free(p); 237 return (NULL); 238 } 239 if (parent != NULL) { 240 anchor->parent = parent; 241 if ((dup = RB_INSERT(pfctl_anchor_node, &parent->children, 242 anchor)) != NULL) { 243 printf("pf_find_or_create_ruleset: " 244 "RB_INSERT2 '%s' '%s' collides with " 245 "'%s' '%s'\n", anchor->path, anchor->name, 246 dup->path, dup->name); 247 RB_REMOVE(pfctl_anchor_global, &V_pf_anchors, 248 anchor); 249 rs_free(anchor); 250 rs_free(p); 251 return (NULL); 252 } 253 } 254 pf_init_ruleset(&anchor->ruleset); 255 anchor->ruleset.anchor = anchor; 256 parent = anchor; 257 if (r != NULL) 258 q = r + 1; 259 else 260 *q = 0; 261 } 262 rs_free(p); 263 return (&anchor->ruleset); 264 } 265 266 void 267 pf_remove_if_empty_ruleset(struct pfctl_ruleset *ruleset) 268 { 269 struct pfctl_anchor *parent; 270 int i; 271 272 while (ruleset != NULL) { 273 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 274 !RB_EMPTY(&ruleset->anchor->children) || 275 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 276 ruleset->topen) 277 return; 278 for (i = 0; i < PF_RULESET_MAX; ++i) 279 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 280 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 281 ruleset->rules[i].inactive.open) 282 return; 283 RB_REMOVE(pfctl_anchor_global, &V_pf_anchors, ruleset->anchor); 284 if ((parent = ruleset->anchor->parent) != NULL) 285 RB_REMOVE(pfctl_anchor_node, &parent->children, 286 ruleset->anchor); 287 rs_free(ruleset->anchor); 288 if (parent == NULL) 289 return; 290 ruleset = &parent->ruleset; 291 } 292 } 293 294 void 295 pf_remove_if_empty_eth_ruleset(struct pfctl_eth_ruleset *ruleset) 296 { 297 struct pfctl_eth_anchor *parent; 298 299 return; 300 while (ruleset != NULL) { 301 if (ruleset == &pf_eth_main_anchor.ruleset || 302 ruleset->anchor == NULL || ruleset->anchor->refcnt > 0) 303 return; 304 if (!TAILQ_EMPTY(&ruleset->rules)) 305 return; 306 rs_free(ruleset->anchor); 307 if (parent == NULL) 308 return; 309 ruleset = &parent->ruleset; 310 } 311 } 312 313 void 314 pf_init_eth_ruleset(struct pfctl_eth_ruleset *ruleset) 315 { 316 317 memset(ruleset, 0, sizeof(*ruleset)); 318 TAILQ_INIT(&ruleset->rules); 319 } 320 321 322 static struct pfctl_eth_anchor* 323 _pf_find_eth_anchor(struct pfctl_eth_anchor *anchor, const char *path) 324 { 325 struct pfctl_eth_rule *r; 326 struct pfctl_eth_anchor *a; 327 328 if (strcmp(path, anchor->path) == 0) 329 return (anchor); 330 331 TAILQ_FOREACH(r, &anchor->ruleset.rules, entries) { 332 if (! r->anchor) 333 continue; 334 335 /* Step into anchor */ 336 a = _pf_find_eth_anchor(r->anchor, path); 337 if (a) 338 return (a); 339 } 340 341 return (NULL); 342 } 343 344 static struct pfctl_eth_anchor* 345 pf_find_eth_anchor(const char *path) 346 { 347 return (_pf_find_eth_anchor(&pf_eth_main_anchor, path)); 348 } 349 350 static struct pfctl_eth_ruleset* 351 pf_find_eth_ruleset(const char *path) 352 { 353 struct pfctl_eth_anchor *anchor; 354 355 while (*path == '/') 356 path++; 357 if (!*path) 358 return (&pf_eth_main_anchor.ruleset); 359 anchor = pf_find_eth_anchor(path); 360 if (anchor == NULL) 361 return (NULL); 362 else 363 return (&anchor->ruleset); 364 } 365 366 struct pfctl_eth_ruleset * 367 pf_find_or_create_eth_ruleset(const char *path) 368 { 369 char *p, *q, *r; 370 struct pfctl_eth_ruleset *ruleset; 371 struct pfctl_eth_anchor *anchor = NULL, *parent = NULL; 372 373 if (path[0] == 0) 374 return (&pf_eth_main_anchor.ruleset); 375 while (*path == '/') 376 path++; 377 ruleset = pf_find_eth_ruleset(path); 378 if (ruleset != NULL) 379 return (ruleset); 380 p = (char *)rs_malloc(MAXPATHLEN); 381 if (p == NULL) 382 return (NULL); 383 strlcpy(p, path, MAXPATHLEN); 384 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 385 *q = 0; 386 if ((ruleset = pf_find_eth_ruleset(p)) != NULL) { 387 parent = ruleset->anchor; 388 break; 389 } 390 } 391 if (q == NULL) 392 q = p; 393 else 394 q++; 395 strlcpy(p, path, MAXPATHLEN); 396 if (!*q) { 397 rs_free(p); 398 return (NULL); 399 } 400 while ((r = strchr(q, '/')) != NULL || *q) { 401 if (r != NULL) 402 *r = 0; 403 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 404 (parent != NULL && strlen(parent->path) >= 405 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 406 rs_free(p); 407 return (NULL); 408 } 409 anchor = (struct pfctl_eth_anchor *)rs_malloc(sizeof(*anchor)); 410 if (anchor == NULL) { 411 rs_free(p); 412 return (NULL); 413 } 414 strlcpy(anchor->name, q, sizeof(anchor->name)); 415 if (parent != NULL) { 416 strlcpy(anchor->path, parent->path, 417 sizeof(anchor->path)); 418 strlcat(anchor->path, "/", sizeof(anchor->path)); 419 } 420 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 421 if (parent != NULL) 422 anchor->parent = parent; 423 pf_init_eth_ruleset(&anchor->ruleset); 424 anchor->ruleset.anchor = anchor; 425 parent = anchor; 426 if (r != NULL) 427 q = r + 1; 428 else 429 *q = 0; 430 } 431 rs_free(p); 432 return (&anchor->ruleset); 433 } 434 435 int 436 pfctl_anchor_setup(struct pfctl_rule *r, const struct pfctl_ruleset *s, 437 const char *name) 438 { 439 char *p, *path; 440 struct pfctl_ruleset *ruleset; 441 442 r->anchor = NULL; 443 r->anchor_relative = 0; 444 r->anchor_wildcard = 0; 445 if (!name[0]) 446 return (0); 447 path = (char *)rs_malloc(MAXPATHLEN); 448 if (path == NULL) 449 return (1); 450 if (name[0] == '/') 451 strlcpy(path, name + 1, MAXPATHLEN); 452 else { 453 /* relative path */ 454 r->anchor_relative = 1; 455 if (s->anchor == NULL || !s->anchor->path[0]) 456 path[0] = 0; 457 else 458 strlcpy(path, s->anchor->path, MAXPATHLEN); 459 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 460 if (!path[0]) { 461 printf("pfctl_anchor_setup: .. beyond root\n"); 462 rs_free(path); 463 return (1); 464 } 465 if ((p = strrchr(path, '/')) != NULL) 466 *p = 0; 467 else 468 path[0] = 0; 469 r->anchor_relative++; 470 name += 3; 471 } 472 if (path[0]) 473 strlcat(path, "/", MAXPATHLEN); 474 strlcat(path, name, MAXPATHLEN); 475 } 476 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 477 r->anchor_wildcard = 1; 478 *p = 0; 479 } 480 ruleset = pf_find_or_create_ruleset(path); 481 rs_free(path); 482 if (ruleset == NULL || ruleset->anchor == NULL) { 483 printf("pfctl_anchor_setup: ruleset\n"); 484 return (1); 485 } 486 r->anchor = ruleset->anchor; 487 r->anchor->refcnt++; 488 return (0); 489 } 490 491 int 492 pfctl_eth_anchor_setup(struct pfctl *pf, struct pfctl_eth_rule *r, 493 const struct pfctl_eth_ruleset *s, const char *name) 494 { 495 char *p, *path; 496 struct pfctl_eth_ruleset *ruleset; 497 498 r->anchor = NULL; 499 if (!name[0]) 500 return (0); 501 path = (char *)rs_malloc(MAXPATHLEN); 502 if (path == NULL) 503 return (1); 504 if (name[0] == '/') 505 strlcpy(path, name + 1, MAXPATHLEN); 506 else { 507 /* relative path */ 508 if (s->anchor == NULL || !s->anchor->path[0]) 509 path[0] = 0; 510 else 511 strlcpy(path, s->anchor->path, MAXPATHLEN); 512 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 513 if (!path[0]) { 514 printf("%s: .. beyond root\n", __func__); 515 rs_free(path); 516 return (1); 517 } 518 if ((p = strrchr(path, '/')) != NULL) 519 *p = 0; 520 else 521 path[0] = 0; 522 name += 3; 523 } 524 if (path[0]) 525 strlcat(path, "/", MAXPATHLEN); 526 strlcat(path, name, MAXPATHLEN); 527 } 528 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 529 *p = 0; 530 } 531 ruleset = pf_find_or_create_eth_ruleset(path); 532 rs_free(path); 533 if (ruleset == NULL || ruleset->anchor == NULL) { 534 printf("%s: ruleset\n", __func__); 535 return (1); 536 } 537 r->anchor = ruleset->anchor; 538 r->anchor->refcnt++; 539 return (0); 540 } 541