1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 * $OpenBSD: pf_ruleset.c,v 1.2 2008/12/18 15:31:37 dhill Exp $ 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include <sys/param.h> 43 #include <sys/socket.h> 44 #include <sys/mbuf.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_systm.h> 48 #include <netinet/ip.h> 49 #include <netinet/tcp.h> 50 51 #include <net/if.h> 52 #include <net/vnet.h> 53 #include <net/pfvar.h> 54 55 #ifdef INET6 56 #include <netinet/ip6.h> 57 #endif /* INET6 */ 58 59 #include <arpa/inet.h> 60 #include <errno.h> 61 #include <stdio.h> 62 #include <stdlib.h> 63 #include <string.h> 64 #define rs_malloc(x) calloc(1, x) 65 #define rs_free(x) free(x) 66 67 #ifdef PFDEBUG 68 #include <sys/stdarg.h> 69 #define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) 70 #else 71 #define DPFPRINTF(format, x...) ((void)0) 72 #endif /* PFDEBUG */ 73 74 struct pf_anchor_global pf_anchors; 75 struct pf_anchor pf_main_anchor; 76 #undef V_pf_anchors 77 #define V_pf_anchors pf_anchors 78 #undef pf_main_ruleset 79 #define pf_main_ruleset pf_main_anchor.ruleset 80 81 static __inline int pf_anchor_compare(struct pf_anchor *, 82 struct pf_anchor *); 83 static struct pf_anchor *pf_find_anchor(const char *); 84 85 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 86 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 87 88 static __inline int 89 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) 90 { 91 int c = strcmp(a->path, b->path); 92 93 return (c ? (c < 0 ? -1 : 1) : 0); 94 } 95 96 int 97 pf_get_ruleset_number(u_int8_t action) 98 { 99 switch (action) { 100 case PF_SCRUB: 101 case PF_NOSCRUB: 102 return (PF_RULESET_SCRUB); 103 break; 104 case PF_PASS: 105 case PF_DROP: 106 return (PF_RULESET_FILTER); 107 break; 108 case PF_NAT: 109 case PF_NONAT: 110 return (PF_RULESET_NAT); 111 break; 112 case PF_BINAT: 113 case PF_NOBINAT: 114 return (PF_RULESET_BINAT); 115 break; 116 case PF_RDR: 117 case PF_NORDR: 118 return (PF_RULESET_RDR); 119 break; 120 default: 121 return (PF_RULESET_MAX); 122 break; 123 } 124 } 125 126 void 127 pf_init_ruleset(struct pf_ruleset *ruleset) 128 { 129 int i; 130 131 memset(ruleset, 0, sizeof(struct pf_ruleset)); 132 for (i = 0; i < PF_RULESET_MAX; i++) { 133 TAILQ_INIT(&ruleset->rules[i].queues[0]); 134 TAILQ_INIT(&ruleset->rules[i].queues[1]); 135 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 136 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 137 } 138 } 139 140 static struct pf_anchor * 141 pf_find_anchor(const char *path) 142 { 143 struct pf_anchor *key, *found; 144 145 key = (struct pf_anchor *)rs_malloc(sizeof(*key)); 146 if (key == NULL) 147 return (NULL); 148 strlcpy(key->path, path, sizeof(key->path)); 149 found = RB_FIND(pf_anchor_global, &V_pf_anchors, key); 150 rs_free(key); 151 return (found); 152 } 153 154 struct pf_ruleset * 155 pf_find_ruleset(const char *path) 156 { 157 struct pf_anchor *anchor; 158 159 while (*path == '/') 160 path++; 161 if (!*path) 162 return (&pf_main_ruleset); 163 anchor = pf_find_anchor(path); 164 if (anchor == NULL) 165 return (NULL); 166 else 167 return (&anchor->ruleset); 168 } 169 170 struct pf_ruleset * 171 pf_find_or_create_ruleset(const char *path) 172 { 173 char *p, *q, *r; 174 struct pf_ruleset *ruleset; 175 struct pf_anchor *anchor = NULL, *dup, *parent = NULL; 176 177 if (path[0] == 0) 178 return (&pf_main_ruleset); 179 while (*path == '/') 180 path++; 181 ruleset = pf_find_ruleset(path); 182 if (ruleset != NULL) 183 return (ruleset); 184 p = (char *)rs_malloc(MAXPATHLEN); 185 if (p == NULL) 186 return (NULL); 187 strlcpy(p, path, MAXPATHLEN); 188 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 189 *q = 0; 190 if ((ruleset = pf_find_ruleset(p)) != NULL) { 191 parent = ruleset->anchor; 192 break; 193 } 194 } 195 if (q == NULL) 196 q = p; 197 else 198 q++; 199 strlcpy(p, path, MAXPATHLEN); 200 if (!*q) { 201 rs_free(p); 202 return (NULL); 203 } 204 while ((r = strchr(q, '/')) != NULL || *q) { 205 if (r != NULL) 206 *r = 0; 207 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 208 (parent != NULL && strlen(parent->path) >= 209 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 210 rs_free(p); 211 return (NULL); 212 } 213 anchor = (struct pf_anchor *)rs_malloc(sizeof(*anchor)); 214 if (anchor == NULL) { 215 rs_free(p); 216 return (NULL); 217 } 218 RB_INIT(&anchor->children); 219 strlcpy(anchor->name, q, sizeof(anchor->name)); 220 if (parent != NULL) { 221 strlcpy(anchor->path, parent->path, 222 sizeof(anchor->path)); 223 strlcat(anchor->path, "/", sizeof(anchor->path)); 224 } 225 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 226 if ((dup = RB_INSERT(pf_anchor_global, &V_pf_anchors, anchor)) != 227 NULL) { 228 printf("pf_find_or_create_ruleset: RB_INSERT1 " 229 "'%s' '%s' collides with '%s' '%s'\n", 230 anchor->path, anchor->name, dup->path, dup->name); 231 rs_free(anchor); 232 rs_free(p); 233 return (NULL); 234 } 235 if (parent != NULL) { 236 anchor->parent = parent; 237 if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 238 anchor)) != NULL) { 239 printf("pf_find_or_create_ruleset: " 240 "RB_INSERT2 '%s' '%s' collides with " 241 "'%s' '%s'\n", anchor->path, anchor->name, 242 dup->path, dup->name); 243 RB_REMOVE(pf_anchor_global, &V_pf_anchors, 244 anchor); 245 rs_free(anchor); 246 rs_free(p); 247 return (NULL); 248 } 249 } 250 pf_init_ruleset(&anchor->ruleset); 251 anchor->ruleset.anchor = anchor; 252 parent = anchor; 253 if (r != NULL) 254 q = r + 1; 255 else 256 *q = 0; 257 } 258 rs_free(p); 259 return (&anchor->ruleset); 260 } 261 262 void 263 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 264 { 265 struct pf_anchor *parent; 266 int i; 267 268 while (ruleset != NULL) { 269 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 270 !RB_EMPTY(&ruleset->anchor->children) || 271 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 272 ruleset->topen) 273 return; 274 for (i = 0; i < PF_RULESET_MAX; ++i) 275 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 276 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 277 ruleset->rules[i].inactive.open) 278 return; 279 RB_REMOVE(pf_anchor_global, &V_pf_anchors, ruleset->anchor); 280 if ((parent = ruleset->anchor->parent) != NULL) 281 RB_REMOVE(pf_anchor_node, &parent->children, 282 ruleset->anchor); 283 rs_free(ruleset->anchor); 284 if (parent == NULL) 285 return; 286 ruleset = &parent->ruleset; 287 } 288 } 289 int 290 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 291 const char *name) 292 { 293 char *p, *path; 294 struct pf_ruleset *ruleset; 295 296 r->anchor = NULL; 297 r->anchor_relative = 0; 298 r->anchor_wildcard = 0; 299 if (!name[0]) 300 return (0); 301 path = (char *)rs_malloc(MAXPATHLEN); 302 if (path == NULL) 303 return (1); 304 if (name[0] == '/') 305 strlcpy(path, name + 1, MAXPATHLEN); 306 else { 307 /* relative path */ 308 r->anchor_relative = 1; 309 if (s->anchor == NULL || !s->anchor->path[0]) 310 path[0] = 0; 311 else 312 strlcpy(path, s->anchor->path, MAXPATHLEN); 313 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 314 if (!path[0]) { 315 printf("pf_anchor_setup: .. beyond root\n"); 316 rs_free(path); 317 return (1); 318 } 319 if ((p = strrchr(path, '/')) != NULL) 320 *p = 0; 321 else 322 path[0] = 0; 323 r->anchor_relative++; 324 name += 3; 325 } 326 if (path[0]) 327 strlcat(path, "/", MAXPATHLEN); 328 strlcat(path, name, MAXPATHLEN); 329 } 330 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 331 r->anchor_wildcard = 1; 332 *p = 0; 333 } 334 ruleset = pf_find_or_create_ruleset(path); 335 rs_free(path); 336 if (ruleset == NULL || ruleset->anchor == NULL) { 337 printf("pf_anchor_setup: ruleset\n"); 338 return (1); 339 } 340 r->anchor = ruleset->anchor; 341 r->anchor->refcnt++; 342 return (0); 343 } 344