1 /*- 2 * Copyright (c) 2001 Daniel Hartmeier 3 * Copyright (c) 2003 Cedric Berger 4 * Copyright (c) 2005 Henning Brauer <henning@openbsd.org> 5 * Copyright (c) 2005 Ryan McBride <mcbride@openbsd.org> 6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * $OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $ 34 */ 35 36 #include <sys/cdefs.h> 37 __FBSDID("$FreeBSD$"); 38 39 #include "opt_inet.h" 40 #include "opt_inet6.h" 41 42 #include <sys/param.h> 43 #include <sys/kernel.h> 44 #include <sys/lock.h> 45 #include <sys/mbuf.h> 46 #include <sys/rwlock.h> 47 #include <sys/socket.h> 48 49 #include <net/if.h> 50 #include <net/if_var.h> 51 #include <net/vnet.h> 52 #include <net/pfvar.h> 53 #include <net/route.h> 54 55 VNET_DEFINE(struct pfi_kif *, pfi_all); 56 static VNET_DEFINE(long, pfi_update); 57 #define V_pfi_update VNET(pfi_update) 58 #define PFI_BUFFER_MAX 0x10000 59 60 static VNET_DEFINE(struct pfr_addr *, pfi_buffer); 61 static VNET_DEFINE(int, pfi_buffer_cnt); 62 static VNET_DEFINE(int, pfi_buffer_max); 63 #define V_pfi_buffer VNET(pfi_buffer) 64 #define V_pfi_buffer_cnt VNET(pfi_buffer_cnt) 65 #define V_pfi_buffer_max VNET(pfi_buffer_max) 66 67 eventhandler_tag pfi_attach_cookie; 68 eventhandler_tag pfi_detach_cookie; 69 eventhandler_tag pfi_attach_group_cookie; 70 eventhandler_tag pfi_change_group_cookie; 71 eventhandler_tag pfi_detach_group_cookie; 72 eventhandler_tag pfi_ifaddr_event_cookie; 73 74 static void pfi_attach_ifnet(struct ifnet *); 75 static void pfi_attach_ifgroup(struct ifg_group *); 76 77 static void pfi_kif_update(struct pfi_kif *); 78 static void pfi_dynaddr_update(struct pfi_dynaddr *dyn); 79 static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, int, 80 int); 81 static void pfi_instance_add(struct ifnet *, int, int); 82 static void pfi_address_add(struct sockaddr *, int, int); 83 static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 84 static int pfi_skip_if(const char *, struct pfi_kif *); 85 static int pfi_unmask(void *); 86 static void pfi_attach_ifnet_event(void * __unused, struct ifnet *); 87 static void pfi_detach_ifnet_event(void * __unused, struct ifnet *); 88 static void pfi_attach_group_event(void *, struct ifg_group *); 89 static void pfi_change_group_event(void *, char *); 90 static void pfi_detach_group_event(void *, struct ifg_group *); 91 static void pfi_ifaddr_event(void * __unused, struct ifnet *); 92 93 RB_HEAD(pfi_ifhead, pfi_kif); 94 static RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 95 static RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 96 static VNET_DEFINE(struct pfi_ifhead, pfi_ifs); 97 #define V_pfi_ifs VNET(pfi_ifs) 98 99 #define PFI_BUFFER_MAX 0x10000 100 MALLOC_DEFINE(PFI_MTYPE, "pf_ifnet", "pf(4) interface database"); 101 102 LIST_HEAD(pfi_list, pfi_kif); 103 static VNET_DEFINE(struct pfi_list, pfi_unlinked_kifs); 104 #define V_pfi_unlinked_kifs VNET(pfi_unlinked_kifs) 105 static struct mtx pfi_unlnkdkifs_mtx; 106 MTX_SYSINIT(pfi_unlnkdkifs_mtx, &pfi_unlnkdkifs_mtx, "pf unlinked interfaces", 107 MTX_DEF); 108 109 void 110 pfi_initialize(void) 111 { 112 struct ifg_group *ifg; 113 struct ifnet *ifp; 114 struct pfi_kif *kif; 115 116 V_pfi_buffer_max = 64; 117 V_pfi_buffer = malloc(V_pfi_buffer_max * sizeof(*V_pfi_buffer), 118 PFI_MTYPE, M_WAITOK); 119 120 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 121 PF_RULES_WLOCK(); 122 V_pfi_all = pfi_kif_attach(kif, IFG_ALL); 123 PF_RULES_WUNLOCK(); 124 125 IFNET_RLOCK(); 126 TAILQ_FOREACH(ifg, &V_ifg_head, ifg_next) 127 pfi_attach_ifgroup(ifg); 128 TAILQ_FOREACH(ifp, &V_ifnet, if_link) 129 pfi_attach_ifnet(ifp); 130 IFNET_RUNLOCK(); 131 132 pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_arrival_event, 133 pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY); 134 pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_departure_event, 135 pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY); 136 pfi_attach_group_cookie = EVENTHANDLER_REGISTER(group_attach_event, 137 pfi_attach_group_event, curvnet, EVENTHANDLER_PRI_ANY); 138 pfi_change_group_cookie = EVENTHANDLER_REGISTER(group_change_event, 139 pfi_change_group_event, curvnet, EVENTHANDLER_PRI_ANY); 140 pfi_detach_group_cookie = EVENTHANDLER_REGISTER(group_detach_event, 141 pfi_detach_group_event, curvnet, EVENTHANDLER_PRI_ANY); 142 pfi_ifaddr_event_cookie = EVENTHANDLER_REGISTER(ifaddr_event, 143 pfi_ifaddr_event, NULL, EVENTHANDLER_PRI_ANY); 144 } 145 146 void 147 pfi_cleanup(void) 148 { 149 struct pfi_kif *p; 150 151 EVENTHANDLER_DEREGISTER(ifnet_arrival_event, pfi_attach_cookie); 152 EVENTHANDLER_DEREGISTER(ifnet_departure_event, pfi_detach_cookie); 153 EVENTHANDLER_DEREGISTER(group_attach_event, pfi_attach_group_cookie); 154 EVENTHANDLER_DEREGISTER(group_change_event, pfi_change_group_cookie); 155 EVENTHANDLER_DEREGISTER(group_detach_event, pfi_detach_group_cookie); 156 EVENTHANDLER_DEREGISTER(ifaddr_event, pfi_ifaddr_event_cookie); 157 158 V_pfi_all = NULL; 159 while ((p = RB_MIN(pfi_ifhead, &V_pfi_ifs))) { 160 RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p); 161 free(p, PFI_MTYPE); 162 } 163 164 while ((p = LIST_FIRST(&V_pfi_unlinked_kifs))) { 165 LIST_REMOVE(p, pfik_list); 166 free(p, PFI_MTYPE); 167 } 168 169 free(V_pfi_buffer, PFI_MTYPE); 170 } 171 172 struct pfi_kif * 173 pfi_kif_find(const char *kif_name) 174 { 175 struct pfi_kif_cmp s; 176 177 PF_RULES_ASSERT(); 178 179 bzero(&s, sizeof(s)); 180 strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name)); 181 182 return (RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&s)); 183 } 184 185 struct pfi_kif * 186 pfi_kif_attach(struct pfi_kif *kif, const char *kif_name) 187 { 188 struct pfi_kif *kif1; 189 190 PF_RULES_WASSERT(); 191 KASSERT(kif != NULL, ("%s: null kif", __func__)); 192 193 kif1 = pfi_kif_find(kif_name); 194 if (kif1 != NULL) { 195 free(kif, PFI_MTYPE); 196 return (kif1); 197 } 198 199 bzero(kif, sizeof(*kif)); 200 strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name)); 201 /* 202 * It seems that the value of time_second is in unintialzied state 203 * when pf sets interface statistics clear time in boot phase if pf 204 * was statically linked to kernel. Instead of setting the bogus 205 * time value have pfi_get_ifaces handle this case. In 206 * pfi_get_ifaces it uses time_second if it sees the time is 0. 207 */ 208 kif->pfik_tzero = time_second > 1 ? time_second : 0; 209 TAILQ_INIT(&kif->pfik_dynaddrs); 210 211 RB_INSERT(pfi_ifhead, &V_pfi_ifs, kif); 212 213 return (kif); 214 } 215 216 void 217 pfi_kif_ref(struct pfi_kif *kif) 218 { 219 220 PF_RULES_WASSERT(); 221 kif->pfik_rulerefs++; 222 } 223 224 void 225 pfi_kif_unref(struct pfi_kif *kif) 226 { 227 228 PF_RULES_WASSERT(); 229 KASSERT(kif->pfik_rulerefs > 0, ("%s: %p has zero refs", __func__, kif)); 230 231 kif->pfik_rulerefs--; 232 233 if (kif->pfik_rulerefs > 0) 234 return; 235 236 /* kif referencing an existing ifnet or group should exist. */ 237 if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all) 238 return; 239 240 RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif); 241 242 kif->pfik_flags |= PFI_IFLAG_REFS; 243 244 mtx_lock(&pfi_unlnkdkifs_mtx); 245 LIST_INSERT_HEAD(&V_pfi_unlinked_kifs, kif, pfik_list); 246 mtx_unlock(&pfi_unlnkdkifs_mtx); 247 } 248 249 void 250 pfi_kif_purge(void) 251 { 252 struct pfi_kif *kif, *kif1; 253 254 /* 255 * Do naive mark-and-sweep garbage collecting of old kifs. 256 * Reference flag is raised by pf_purge_expired_states(). 257 */ 258 mtx_lock(&pfi_unlnkdkifs_mtx); 259 LIST_FOREACH_SAFE(kif, &V_pfi_unlinked_kifs, pfik_list, kif1) { 260 if (!(kif->pfik_flags & PFI_IFLAG_REFS)) { 261 LIST_REMOVE(kif, pfik_list); 262 free(kif, PFI_MTYPE); 263 } else 264 kif->pfik_flags &= ~PFI_IFLAG_REFS; 265 } 266 mtx_unlock(&pfi_unlnkdkifs_mtx); 267 } 268 269 int 270 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif) 271 { 272 struct ifg_list *p; 273 274 if (rule_kif == NULL || rule_kif == packet_kif) 275 return (1); 276 277 if (rule_kif->pfik_group != NULL) 278 /* XXXGL: locking? */ 279 TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next) 280 if (p->ifgl_group == rule_kif->pfik_group) 281 return (1); 282 283 return (0); 284 } 285 286 static void 287 pfi_attach_ifnet(struct ifnet *ifp) 288 { 289 struct pfi_kif *kif; 290 291 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 292 293 PF_RULES_WLOCK(); 294 V_pfi_update++; 295 kif = pfi_kif_attach(kif, ifp->if_xname); 296 297 kif->pfik_ifp = ifp; 298 ifp->if_pf_kif = kif; 299 300 pfi_kif_update(kif); 301 PF_RULES_WUNLOCK(); 302 } 303 304 static void 305 pfi_attach_ifgroup(struct ifg_group *ifg) 306 { 307 struct pfi_kif *kif; 308 309 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 310 311 PF_RULES_WLOCK(); 312 V_pfi_update++; 313 kif = pfi_kif_attach(kif, ifg->ifg_group); 314 315 kif->pfik_group = ifg; 316 ifg->ifg_pf_kif = kif; 317 PF_RULES_WUNLOCK(); 318 } 319 320 int 321 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 322 { 323 switch (af) { 324 #ifdef INET 325 case AF_INET: 326 switch (dyn->pfid_acnt4) { 327 case 0: 328 return (0); 329 case 1: 330 return (PF_MATCHA(0, &dyn->pfid_addr4, 331 &dyn->pfid_mask4, a, AF_INET)); 332 default: 333 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 334 } 335 break; 336 #endif /* INET */ 337 #ifdef INET6 338 case AF_INET6: 339 switch (dyn->pfid_acnt6) { 340 case 0: 341 return (0); 342 case 1: 343 return (PF_MATCHA(0, &dyn->pfid_addr6, 344 &dyn->pfid_mask6, a, AF_INET6)); 345 default: 346 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 347 } 348 break; 349 #endif /* INET6 */ 350 default: 351 return (0); 352 } 353 } 354 355 int 356 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 357 { 358 struct pfi_dynaddr *dyn; 359 char tblname[PF_TABLE_NAME_SIZE]; 360 struct pf_ruleset *ruleset = NULL; 361 struct pfi_kif *kif; 362 int rv = 0; 363 364 PF_RULES_WASSERT(); 365 KASSERT(aw->type == PF_ADDR_DYNIFTL, ("%s: type %u", 366 __func__, aw->type)); 367 KASSERT(aw->p.dyn == NULL, ("%s: dyn is %p", __func__, aw->p.dyn)); 368 369 if ((dyn = malloc(sizeof(*dyn), PFI_MTYPE, M_NOWAIT | M_ZERO)) == NULL) 370 return (ENOMEM); 371 372 if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_NOWAIT)) == NULL) { 373 free(dyn, PFI_MTYPE); 374 return (ENOMEM); 375 } 376 377 if (!strcmp(aw->v.ifname, "self")) 378 dyn->pfid_kif = pfi_kif_attach(kif, IFG_ALL); 379 else 380 dyn->pfid_kif = pfi_kif_attach(kif, aw->v.ifname); 381 pfi_kif_ref(dyn->pfid_kif); 382 383 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 384 if (af == AF_INET && dyn->pfid_net == 32) 385 dyn->pfid_net = 128; 386 strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 387 if (aw->iflags & PFI_AFLAG_NETWORK) 388 strlcat(tblname, ":network", sizeof(tblname)); 389 if (aw->iflags & PFI_AFLAG_BROADCAST) 390 strlcat(tblname, ":broadcast", sizeof(tblname)); 391 if (aw->iflags & PFI_AFLAG_PEER) 392 strlcat(tblname, ":peer", sizeof(tblname)); 393 if (aw->iflags & PFI_AFLAG_NOALIAS) 394 strlcat(tblname, ":0", sizeof(tblname)); 395 if (dyn->pfid_net != 128) 396 snprintf(tblname + strlen(tblname), 397 sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 398 if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) { 399 rv = ENOMEM; 400 goto _bad; 401 } 402 403 if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) { 404 rv = ENOMEM; 405 goto _bad; 406 } 407 408 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 409 dyn->pfid_iflags = aw->iflags; 410 dyn->pfid_af = af; 411 412 TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); 413 aw->p.dyn = dyn; 414 pfi_kif_update(dyn->pfid_kif); 415 416 return (0); 417 418 _bad: 419 if (dyn->pfid_kt != NULL) 420 pfr_detach_table(dyn->pfid_kt); 421 if (ruleset != NULL) 422 pf_remove_if_empty_ruleset(ruleset); 423 if (dyn->pfid_kif != NULL) 424 pfi_kif_unref(dyn->pfid_kif); 425 free(dyn, PFI_MTYPE); 426 427 return (rv); 428 } 429 430 static void 431 pfi_kif_update(struct pfi_kif *kif) 432 { 433 struct ifg_list *ifgl; 434 struct pfi_dynaddr *p; 435 436 PF_RULES_WASSERT(); 437 438 /* update all dynaddr */ 439 TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) 440 pfi_dynaddr_update(p); 441 442 /* again for all groups kif is member of */ 443 if (kif->pfik_ifp != NULL) { 444 IF_ADDR_RLOCK(kif->pfik_ifp); 445 TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next) 446 pfi_kif_update((struct pfi_kif *) 447 ifgl->ifgl_group->ifg_pf_kif); 448 IF_ADDR_RUNLOCK(kif->pfik_ifp); 449 } 450 } 451 452 static void 453 pfi_dynaddr_update(struct pfi_dynaddr *dyn) 454 { 455 struct pfi_kif *kif; 456 struct pfr_ktable *kt; 457 458 PF_RULES_WASSERT(); 459 KASSERT(dyn && dyn->pfid_kif && dyn->pfid_kt, 460 ("%s: bad argument", __func__)); 461 462 kif = dyn->pfid_kif; 463 kt = dyn->pfid_kt; 464 465 if (kt->pfrkt_larg != V_pfi_update) { 466 /* this table needs to be brought up-to-date */ 467 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 468 kt->pfrkt_larg = V_pfi_update; 469 } 470 pfr_dynaddr_update(kt, dyn); 471 } 472 473 static void 474 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 475 { 476 int e, size2 = 0; 477 struct ifg_member *ifgm; 478 479 V_pfi_buffer_cnt = 0; 480 481 if (kif->pfik_ifp != NULL) 482 pfi_instance_add(kif->pfik_ifp, net, flags); 483 else if (kif->pfik_group != NULL) { 484 IFNET_RLOCK_NOSLEEP(); 485 TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next) 486 pfi_instance_add(ifgm->ifgm_ifp, net, flags); 487 IFNET_RUNLOCK_NOSLEEP(); 488 } 489 490 if ((e = pfr_set_addrs(&kt->pfrkt_t, V_pfi_buffer, V_pfi_buffer_cnt, &size2, 491 NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) 492 printf("%s: cannot set %d new addresses into table %s: %d\n", 493 __func__, V_pfi_buffer_cnt, kt->pfrkt_name, e); 494 } 495 496 static void 497 pfi_instance_add(struct ifnet *ifp, int net, int flags) 498 { 499 struct ifaddr *ia; 500 int got4 = 0, got6 = 0; 501 int net2, af; 502 503 IF_ADDR_RLOCK(ifp); 504 TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_list) { 505 if (ia->ifa_addr == NULL) 506 continue; 507 af = ia->ifa_addr->sa_family; 508 if (af != AF_INET && af != AF_INET6) 509 continue; 510 /* 511 * XXX: For point-to-point interfaces, (ifname:0) and IPv4, 512 * jump over addresses without a proper route to work 513 * around a problem with ppp not fully removing the 514 * address used during IPCP. 515 */ 516 if ((ifp->if_flags & IFF_POINTOPOINT) && 517 !(ia->ifa_flags & IFA_ROUTE) && 518 (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET)) 519 continue; 520 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 521 continue; 522 if ((flags & PFI_AFLAG_BROADCAST) && 523 !(ifp->if_flags & IFF_BROADCAST)) 524 continue; 525 if ((flags & PFI_AFLAG_PEER) && 526 !(ifp->if_flags & IFF_POINTOPOINT)) 527 continue; 528 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 529 IN6_IS_ADDR_LINKLOCAL( 530 &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 531 continue; 532 if (flags & PFI_AFLAG_NOALIAS) { 533 if (af == AF_INET && got4) 534 continue; 535 if (af == AF_INET6 && got6) 536 continue; 537 } 538 if (af == AF_INET) 539 got4 = 1; 540 else if (af == AF_INET6) 541 got6 = 1; 542 net2 = net; 543 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 544 if (af == AF_INET) 545 net2 = pfi_unmask(&((struct sockaddr_in *) 546 ia->ifa_netmask)->sin_addr); 547 else if (af == AF_INET6) 548 net2 = pfi_unmask(&((struct sockaddr_in6 *) 549 ia->ifa_netmask)->sin6_addr); 550 } 551 if (af == AF_INET && net2 > 32) 552 net2 = 32; 553 if (flags & PFI_AFLAG_BROADCAST) 554 pfi_address_add(ia->ifa_broadaddr, af, net2); 555 else if (flags & PFI_AFLAG_PEER) 556 pfi_address_add(ia->ifa_dstaddr, af, net2); 557 else 558 pfi_address_add(ia->ifa_addr, af, net2); 559 } 560 IF_ADDR_RUNLOCK(ifp); 561 } 562 563 static void 564 pfi_address_add(struct sockaddr *sa, int af, int net) 565 { 566 struct pfr_addr *p; 567 int i; 568 569 if (V_pfi_buffer_cnt >= V_pfi_buffer_max) { 570 int new_max = V_pfi_buffer_max * 2; 571 572 if (new_max > PFI_BUFFER_MAX) { 573 printf("%s: address buffer full (%d/%d)\n", __func__, 574 V_pfi_buffer_cnt, PFI_BUFFER_MAX); 575 return; 576 } 577 p = malloc(new_max * sizeof(*V_pfi_buffer), PFI_MTYPE, 578 M_NOWAIT); 579 if (p == NULL) { 580 printf("%s: no memory to grow buffer (%d/%d)\n", 581 __func__, V_pfi_buffer_cnt, PFI_BUFFER_MAX); 582 return; 583 } 584 memcpy(V_pfi_buffer, p, V_pfi_buffer_cnt * sizeof(*V_pfi_buffer)); 585 /* no need to zero buffer */ 586 free(V_pfi_buffer, PFI_MTYPE); 587 V_pfi_buffer = p; 588 V_pfi_buffer_max = new_max; 589 } 590 if (af == AF_INET && net > 32) 591 net = 128; 592 p = V_pfi_buffer + V_pfi_buffer_cnt++; 593 bzero(p, sizeof(*p)); 594 p->pfra_af = af; 595 p->pfra_net = net; 596 if (af == AF_INET) 597 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 598 else if (af == AF_INET6) { 599 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 600 if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) 601 p->pfra_ip6addr.s6_addr16[1] = 0; 602 } 603 /* mask network address bits */ 604 if (net < 128) 605 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 606 for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 607 ((caddr_t)p)[i] = 0; 608 } 609 610 void 611 pfi_dynaddr_remove(struct pfi_dynaddr *dyn) 612 { 613 614 KASSERT(dyn->pfid_kif != NULL, ("%s: null pfid_kif", __func__)); 615 KASSERT(dyn->pfid_kt != NULL, ("%s: null pfid_kt", __func__)); 616 617 TAILQ_REMOVE(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); 618 pfi_kif_unref(dyn->pfid_kif); 619 pfr_detach_table(dyn->pfid_kt); 620 free(dyn, PFI_MTYPE); 621 } 622 623 void 624 pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 625 { 626 627 KASSERT(aw->type == PF_ADDR_DYNIFTL, 628 ("%s: type %u", __func__, aw->type)); 629 630 if (aw->p.dyn == NULL || aw->p.dyn->pfid_kif == NULL) 631 return; 632 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 633 } 634 635 static int 636 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 637 { 638 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 639 } 640 641 void 642 pfi_update_status(const char *name, struct pf_status *pfs) 643 { 644 struct pfi_kif *p; 645 struct pfi_kif_cmp key; 646 struct ifg_member p_member, *ifgm; 647 TAILQ_HEAD(, ifg_member) ifg_members; 648 int i, j, k; 649 650 strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 651 p = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&key); 652 if (p == NULL) 653 return; 654 655 if (p->pfik_group != NULL) { 656 bcopy(&p->pfik_group->ifg_members, &ifg_members, 657 sizeof(ifg_members)); 658 } else { 659 /* build a temporary list for p only */ 660 bzero(&p_member, sizeof(p_member)); 661 p_member.ifgm_ifp = p->pfik_ifp; 662 TAILQ_INIT(&ifg_members); 663 TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next); 664 } 665 if (pfs) { 666 bzero(pfs->pcounters, sizeof(pfs->pcounters)); 667 bzero(pfs->bcounters, sizeof(pfs->bcounters)); 668 } 669 TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) { 670 if (ifgm->ifgm_ifp == NULL) 671 continue; 672 p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif; 673 674 /* just clear statistics */ 675 if (pfs == NULL) { 676 bzero(p->pfik_packets, sizeof(p->pfik_packets)); 677 bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 678 p->pfik_tzero = time_second; 679 continue; 680 } 681 for (i = 0; i < 2; i++) 682 for (j = 0; j < 2; j++) 683 for (k = 0; k < 2; k++) { 684 pfs->pcounters[i][j][k] += 685 p->pfik_packets[i][j][k]; 686 pfs->bcounters[i][j] += 687 p->pfik_bytes[i][j][k]; 688 } 689 } 690 } 691 692 void 693 pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size) 694 { 695 struct pfi_kif *p, *nextp; 696 int n = 0; 697 698 for (p = RB_MIN(pfi_ifhead, &V_pfi_ifs); p; p = nextp) { 699 nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p); 700 if (pfi_skip_if(name, p)) 701 continue; 702 if (*size <= n++) 703 break; 704 if (!p->pfik_tzero) 705 p->pfik_tzero = time_second; 706 bcopy(p, buf++, sizeof(*buf)); 707 nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p); 708 } 709 *size = n; 710 } 711 712 static int 713 pfi_skip_if(const char *filter, struct pfi_kif *p) 714 { 715 int n; 716 717 if (filter == NULL || !*filter) 718 return (0); 719 if (!strcmp(p->pfik_name, filter)) 720 return (0); /* exact match */ 721 n = strlen(filter); 722 if (n < 1 || n >= IFNAMSIZ) 723 return (1); /* sanity check */ 724 if (filter[n-1] >= '0' && filter[n-1] <= '9') 725 return (1); /* only do exact match in that case */ 726 if (strncmp(p->pfik_name, filter, n)) 727 return (1); /* prefix doesn't match */ 728 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 729 } 730 731 int 732 pfi_set_flags(const char *name, int flags) 733 { 734 struct pfi_kif *p; 735 736 RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) { 737 if (pfi_skip_if(name, p)) 738 continue; 739 p->pfik_flags |= flags; 740 } 741 return (0); 742 } 743 744 int 745 pfi_clear_flags(const char *name, int flags) 746 { 747 struct pfi_kif *p; 748 749 RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) { 750 if (pfi_skip_if(name, p)) 751 continue; 752 p->pfik_flags &= ~flags; 753 } 754 return (0); 755 } 756 757 /* from pf_print_state.c */ 758 static int 759 pfi_unmask(void *addr) 760 { 761 struct pf_addr *m = addr; 762 int i = 31, j = 0, b = 0; 763 u_int32_t tmp; 764 765 while (j < 4 && m->addr32[j] == 0xffffffff) { 766 b += 32; 767 j++; 768 } 769 if (j < 4) { 770 tmp = ntohl(m->addr32[j]); 771 for (i = 31; tmp & (1 << i); --i) 772 b++; 773 } 774 return (b); 775 } 776 777 static void 778 pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp) 779 { 780 781 CURVNET_SET(ifp->if_vnet); 782 pfi_attach_ifnet(ifp); 783 #ifdef ALTQ 784 PF_RULES_WLOCK(); 785 pf_altq_ifnet_event(ifp, 0); 786 PF_RULES_WUNLOCK(); 787 #endif 788 CURVNET_RESTORE(); 789 } 790 791 static void 792 pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp) 793 { 794 struct pfi_kif *kif = (struct pfi_kif *)ifp->if_pf_kif; 795 796 CURVNET_SET(ifp->if_vnet); 797 PF_RULES_WLOCK(); 798 V_pfi_update++; 799 pfi_kif_update(kif); 800 801 kif->pfik_ifp = NULL; 802 ifp->if_pf_kif = NULL; 803 #ifdef ALTQ 804 pf_altq_ifnet_event(ifp, 1); 805 #endif 806 PF_RULES_WUNLOCK(); 807 CURVNET_RESTORE(); 808 } 809 810 static void 811 pfi_attach_group_event(void *arg , struct ifg_group *ifg) 812 { 813 814 CURVNET_SET((struct vnet *)arg); 815 pfi_attach_ifgroup(ifg); 816 CURVNET_RESTORE(); 817 } 818 819 static void 820 pfi_change_group_event(void *arg, char *gname) 821 { 822 struct pfi_kif *kif; 823 824 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 825 826 CURVNET_SET((struct vnet *)arg); 827 PF_RULES_WLOCK(); 828 V_pfi_update++; 829 kif = pfi_kif_attach(kif, gname); 830 pfi_kif_update(kif); 831 PF_RULES_WUNLOCK(); 832 CURVNET_RESTORE(); 833 } 834 835 static void 836 pfi_detach_group_event(void *arg, struct ifg_group *ifg) 837 { 838 struct pfi_kif *kif = (struct pfi_kif *)ifg->ifg_pf_kif; 839 840 CURVNET_SET((struct vnet *)arg); 841 PF_RULES_WLOCK(); 842 V_pfi_update++; 843 844 kif->pfik_group = NULL; 845 ifg->ifg_pf_kif = NULL; 846 PF_RULES_WUNLOCK(); 847 CURVNET_RESTORE(); 848 } 849 850 static void 851 pfi_ifaddr_event(void *arg __unused, struct ifnet *ifp) 852 { 853 854 CURVNET_SET(ifp->if_vnet); 855 PF_RULES_WLOCK(); 856 if (ifp && ifp->if_pf_kif) { 857 V_pfi_update++; 858 pfi_kif_update(ifp->if_pf_kif); 859 } 860 PF_RULES_WUNLOCK(); 861 CURVNET_RESTORE(); 862 } 863