1 /* $OpenBSD: pfctl_radix.c,v 1.27 2005/05/21 21:03:58 henning Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-2-Clause 5 * 6 * Copyright (c) 2002 Cedric Berger 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 */ 34 35 #include <sys/types.h> 36 #include <sys/ioctl.h> 37 #include <sys/socket.h> 38 39 #include <net/if.h> 40 #include <net/pfvar.h> 41 42 #include <errno.h> 43 #include <string.h> 44 #include <ctype.h> 45 #include <stdio.h> 46 #include <stdlib.h> 47 #include <limits.h> 48 #include <err.h> 49 50 #include "pfctl.h" 51 #include "pfctl_parser.h" 52 53 #define BUF_SIZE 256 54 55 extern int dev; 56 57 static int pfr_next_token(char buf[BUF_SIZE], FILE *); 58 59 struct pfr_ktablehead pfr_ktables = { 0 }; 60 RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 61 62 int 63 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q) 64 { 65 int d; 66 67 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE))) 68 return (d); 69 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor)); 70 } 71 72 static void 73 pfr_report_error(struct pfr_table *tbl, struct pfioc_table *io, 74 const char *err) 75 { 76 unsigned long maxcount; 77 size_t s; 78 79 s = sizeof(maxcount); 80 if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, NULL, 81 0) == -1) 82 return; 83 84 if (io->pfrio_size > maxcount || io->pfrio_size2 > maxcount) 85 fprintf(stderr, "cannot %s %s: too many elements.\n" 86 "Consider increasing net.pf.request_maxcount.", 87 err, tbl->pfrt_name); 88 } 89 90 int 91 pfr_add_table(struct pfr_table *tbl, int *nadd, int flags) 92 { 93 return (pfctl_add_table(pfh, tbl, nadd, flags)); 94 } 95 96 int 97 pfr_del_table(struct pfr_table *tbl, int *ndel, int flags) 98 { 99 return (pfctl_del_table(pfh, tbl, ndel, flags)); 100 } 101 102 int 103 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size, 104 int flags) 105 { 106 struct pfioc_table io; 107 108 if (size == NULL || *size < 0 || (*size && tbl == NULL)) { 109 errno = EINVAL; 110 return (-1); 111 } 112 bzero(&io, sizeof io); 113 io.pfrio_flags = flags; 114 if (filter != NULL) 115 io.pfrio_table = *filter; 116 io.pfrio_buffer = tbl; 117 io.pfrio_esize = sizeof(*tbl); 118 io.pfrio_size = *size; 119 if (ioctl(dev, DIOCRGETTABLES, &io)) { 120 pfr_report_error(tbl, &io, "get table"); 121 return (-1); 122 } 123 *size = io.pfrio_size; 124 return (0); 125 } 126 127 int 128 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags) 129 { 130 return (pfctl_clear_addrs(pfh, tbl, ndel, flags)); 131 } 132 133 int 134 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 135 int *nadd, int flags) 136 { 137 int ret; 138 139 if (*nadd) 140 *nadd = 0; 141 142 ret = pfctl_table_add_addrs_h(pfh, tbl, addr, size, nadd, flags); 143 if (ret) { 144 errno = ret; 145 return (-1); 146 } 147 return (0); 148 } 149 150 int 151 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 152 int *ndel, int flags) 153 { 154 int ret; 155 156 ret = pfctl_table_del_addrs_h(pfh, tbl, addr, size, ndel, flags); 157 if (ret) { 158 errno = ret; 159 return (-1); 160 } 161 return (0); 162 } 163 164 int 165 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 166 int *size2, int *nadd, int *ndel, int *nchange, int flags) 167 { 168 int ret; 169 170 ret = pfctl_table_set_addrs(dev, tbl, addr, size, size2, nadd, ndel, 171 nchange, flags); 172 if (ret) { 173 errno = ret; 174 return (-1); 175 } 176 return (0); 177 } 178 179 int 180 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size, 181 int flags) 182 { 183 int ret; 184 185 ret = pfctl_table_get_addrs(dev, tbl, addr, size, flags); 186 if (ret) { 187 errno = ret; 188 return (-1); 189 } 190 return (0); 191 } 192 193 int 194 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size, 195 int flags) 196 { 197 struct pfioc_table io; 198 199 if (tbl == NULL || size == NULL || *size < 0 || 200 (*size && addr == NULL)) { 201 errno = EINVAL; 202 return (-1); 203 } 204 bzero(&io, sizeof io); 205 io.pfrio_flags = flags; 206 io.pfrio_table = *tbl; 207 io.pfrio_buffer = addr; 208 io.pfrio_esize = sizeof(*addr); 209 io.pfrio_size = *size; 210 if (ioctl(dev, DIOCRGETASTATS, &io)) { 211 pfr_report_error(tbl, &io, "get astats from"); 212 return (-1); 213 } 214 *size = io.pfrio_size; 215 return (0); 216 } 217 218 int 219 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size, 220 int *nzero, int flags) 221 { 222 struct pfioc_table io; 223 224 if (size < 0 || !tbl || (size && !addr)) { 225 errno = EINVAL; 226 return (-1); 227 } 228 bzero(&io, sizeof io); 229 io.pfrio_flags = flags; 230 io.pfrio_table = *tbl; 231 io.pfrio_buffer = addr; 232 io.pfrio_esize = sizeof(*addr); 233 io.pfrio_size = size; 234 if (ioctl(dev, DIOCRCLRASTATS, &io) == -1) 235 return (-1); 236 if (nzero) 237 *nzero = io.pfrio_nzero; 238 return (0); 239 } 240 241 int 242 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 243 int *nmatch, int flags) 244 { 245 struct pfioc_table io; 246 247 if (tbl == NULL || size < 0 || (size && addr == NULL)) { 248 errno = EINVAL; 249 return (-1); 250 } 251 bzero(&io, sizeof io); 252 io.pfrio_flags = flags; 253 io.pfrio_table = *tbl; 254 io.pfrio_buffer = addr; 255 io.pfrio_esize = sizeof(*addr); 256 io.pfrio_size = size; 257 if (ioctl(dev, DIOCRTSTADDRS, &io)) { 258 pfr_report_error(tbl, &io, "test addresses in"); 259 return (-1); 260 } 261 if (nmatch) 262 *nmatch = io.pfrio_nmatch; 263 return (0); 264 } 265 266 int 267 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size, 268 int *nadd, int *naddr, int ticket, int flags) 269 { 270 struct pfioc_table io; 271 272 if (tbl == NULL || size < 0 || (size && addr == NULL)) { 273 DBGPRINT("%s %p %d %p\n", __func__, tbl, size, addr); 274 errno = EINVAL; 275 return (-1); 276 } 277 bzero(&io, sizeof io); 278 io.pfrio_flags = flags; 279 io.pfrio_table = *tbl; 280 io.pfrio_buffer = addr; 281 io.pfrio_esize = sizeof(*addr); 282 io.pfrio_size = size; 283 io.pfrio_ticket = ticket; 284 if (ioctl(dev, DIOCRINADEFINE, &io)) { 285 pfr_report_error(tbl, &io, "define inactive set table"); 286 return (-1); 287 } 288 if (nadd != NULL) 289 *nadd = io.pfrio_nadd; 290 if (naddr != NULL) 291 *naddr = io.pfrio_naddr; 292 return (0); 293 } 294 295 /* interface management code */ 296 297 int 298 pfi_get_ifaces(const char *filter, struct pfi_kif *buf, int *size) 299 { 300 struct pfioc_iface io; 301 302 if (size == NULL || *size < 0 || (*size && buf == NULL)) { 303 errno = EINVAL; 304 return (-1); 305 } 306 bzero(&io, sizeof io); 307 if (filter != NULL) 308 if (strlcpy(io.pfiio_name, filter, sizeof(io.pfiio_name)) >= 309 sizeof(io.pfiio_name)) { 310 errno = EINVAL; 311 return (-1); 312 } 313 io.pfiio_buffer = buf; 314 io.pfiio_esize = sizeof(*buf); 315 io.pfiio_size = *size; 316 if (ioctl(dev, DIOCIGETIFACES, &io)) 317 return (-1); 318 *size = io.pfiio_size; 319 return (0); 320 } 321 322 /* buffer management code */ 323 324 const size_t buf_esize[PFRB_MAX] = { 0, 325 sizeof(struct pfr_table), sizeof(struct pfr_tstats), 326 sizeof(struct pfr_addr), sizeof(struct pfr_astats), 327 sizeof(struct pfi_kif), sizeof(struct pfioc_trans_e) 328 }; 329 330 /* 331 * add one element to the buffer 332 */ 333 int 334 pfr_buf_add(struct pfr_buffer *b, const void *e) 335 { 336 size_t bs; 337 338 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX || 339 e == NULL) { 340 errno = EINVAL; 341 return (-1); 342 } 343 bs = buf_esize[b->pfrb_type]; 344 if (b->pfrb_size == b->pfrb_msize) 345 if (pfr_buf_grow(b, 0)) 346 return (-1); 347 memcpy(((caddr_t)b->pfrb_caddr) + bs * b->pfrb_size, e, bs); 348 b->pfrb_size++; 349 return (0); 350 } 351 352 /* 353 * return next element of the buffer (or first one if prev is NULL) 354 * see PFRB_FOREACH macro 355 */ 356 void * 357 pfr_buf_next(struct pfr_buffer *b, const void *prev) 358 { 359 size_t bs; 360 361 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX) 362 return (NULL); 363 if (b->pfrb_size == 0) 364 return (NULL); 365 if (prev == NULL) 366 return (b->pfrb_caddr); 367 bs = buf_esize[b->pfrb_type]; 368 if ((((caddr_t)prev)-((caddr_t)b->pfrb_caddr)) / bs >= b->pfrb_size-1) 369 return (NULL); 370 return (((caddr_t)prev) + bs); 371 } 372 373 /* 374 * minsize: 375 * 0: make the buffer somewhat bigger 376 * n: make room for "n" entries in the buffer 377 */ 378 int 379 pfr_buf_grow(struct pfr_buffer *b, int minsize) 380 { 381 caddr_t p; 382 size_t bs; 383 384 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX) { 385 errno = EINVAL; 386 return (-1); 387 } 388 if (minsize != 0 && minsize <= b->pfrb_msize) 389 return (0); 390 bs = buf_esize[b->pfrb_type]; 391 if (!b->pfrb_msize) { 392 if (minsize < 64) 393 minsize = 64; 394 } 395 if (minsize == 0) 396 minsize = b->pfrb_msize * 2; 397 p = reallocarray(b->pfrb_caddr, minsize, bs); 398 if (p == NULL) 399 return (-1); 400 bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs); 401 b->pfrb_caddr = p; 402 b->pfrb_msize = minsize; 403 return (0); 404 } 405 406 /* 407 * reset buffer and free memory. 408 */ 409 void 410 pfr_buf_clear(struct pfr_buffer *b) 411 { 412 if (b == NULL) 413 return; 414 free(b->pfrb_caddr); 415 b->pfrb_caddr = NULL; 416 b->pfrb_size = b->pfrb_msize = 0; 417 } 418 419 int 420 pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork, 421 int (*append_addr)(struct pfr_buffer *, char *, int, int), int opts) 422 { 423 FILE *fp; 424 char buf[BUF_SIZE]; 425 int rv; 426 427 if (file == NULL) 428 return (0); 429 if (!strcmp(file, "-")) 430 fp = stdin; 431 else { 432 fp = pfctl_fopen(file, "r"); 433 if (fp == NULL) 434 return (-1); 435 } 436 while ((rv = pfr_next_token(buf, fp)) == 1) 437 if (append_addr(b, buf, nonetwork, opts)) { 438 rv = -1; 439 break; 440 } 441 if (fp != stdin) 442 fclose(fp); 443 return (rv); 444 } 445 446 int 447 pfr_next_token(char buf[BUF_SIZE], FILE *fp) 448 { 449 static char next_ch = ' '; 450 int i = 0; 451 452 for (;;) { 453 /* skip spaces */ 454 while (isspace(next_ch) && !feof(fp)) 455 next_ch = fgetc(fp); 456 /* remove from '#' or ';' until end of line */ 457 if (next_ch == '#' || next_ch == ';') 458 while (!feof(fp)) { 459 next_ch = fgetc(fp); 460 if (next_ch == '\n') 461 break; 462 } 463 else 464 break; 465 } 466 if (feof(fp)) { 467 next_ch = ' '; 468 return (0); 469 } 470 do { 471 if (i < BUF_SIZE) 472 buf[i++] = next_ch; 473 next_ch = fgetc(fp); 474 } while (!feof(fp) && !isspace(next_ch)); 475 if (i >= BUF_SIZE) { 476 errno = EINVAL; 477 return (-1); 478 } 479 buf[i] = '\0'; 480 return (1); 481 } 482