xref: /freebsd/sys/netpfil/pf/pf_if.c (revision 88f578841fd49ff796b62a8d3531bd73afd1a88e)
1 /*-
2  * Copyright (c) 2001 Daniel Hartmeier
3  * Copyright (c) 2003 Cedric Berger
4  * Copyright (c) 2005 Henning Brauer <henning@openbsd.org>
5  * Copyright (c) 2005 Ryan McBride <mcbride@openbsd.org>
6  * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  *    - Redistributions of source code must retain the above copyright
14  *      notice, this list of conditions and the following disclaimer.
15  *    - Redistributions in binary form must reproduce the above
16  *      copyright notice, this list of conditions and the following
17  *      disclaimer in the documentation and/or other materials provided
18  *      with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  *
33  *	$OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include "opt_inet.h"
40 #include "opt_inet6.h"
41 
42 #include <sys/param.h>
43 #include <sys/kernel.h>
44 #include <sys/lock.h>
45 #include <sys/mbuf.h>
46 #include <sys/rwlock.h>
47 #include <sys/socket.h>
48 
49 #include <net/if.h>
50 #include <net/if_var.h>
51 #include <net/vnet.h>
52 #include <net/pfvar.h>
53 #include <net/route.h>
54 
55 VNET_DEFINE(struct pfi_kif *,	 pfi_all);
56 static VNET_DEFINE(long, pfi_update);
57 #define	V_pfi_update	VNET(pfi_update)
58 #define PFI_BUFFER_MAX	0x10000
59 
60 static VNET_DEFINE(struct pfr_addr *, pfi_buffer);
61 static VNET_DEFINE(int, pfi_buffer_cnt);
62 static VNET_DEFINE(int,	pfi_buffer_max);
63 #define	V_pfi_buffer		 VNET(pfi_buffer)
64 #define	V_pfi_buffer_cnt	 VNET(pfi_buffer_cnt)
65 #define	V_pfi_buffer_max	 VNET(pfi_buffer_max)
66 
67 eventhandler_tag	 pfi_attach_cookie;
68 eventhandler_tag	 pfi_detach_cookie;
69 eventhandler_tag	 pfi_attach_group_cookie;
70 eventhandler_tag	 pfi_change_group_cookie;
71 eventhandler_tag	 pfi_detach_group_cookie;
72 eventhandler_tag	 pfi_ifaddr_event_cookie;
73 
74 static void	 pfi_attach_ifnet(struct ifnet *);
75 static void	 pfi_attach_ifgroup(struct ifg_group *);
76 
77 static void	 pfi_kif_update(struct pfi_kif *);
78 static void	 pfi_dynaddr_update(struct pfi_dynaddr *dyn);
79 static void	 pfi_table_update(struct pfr_ktable *, struct pfi_kif *, int,
80 		    int);
81 static void	 pfi_instance_add(struct ifnet *, int, int);
82 static void	 pfi_address_add(struct sockaddr *, int, int);
83 static int	 pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
84 static int	 pfi_skip_if(const char *, struct pfi_kif *);
85 static int	 pfi_unmask(void *);
86 static void	 pfi_attach_ifnet_event(void * __unused, struct ifnet *);
87 static void	 pfi_detach_ifnet_event(void * __unused, struct ifnet *);
88 static void	 pfi_attach_group_event(void *, struct ifg_group *);
89 static void	 pfi_change_group_event(void *, char *);
90 static void	 pfi_detach_group_event(void *, struct ifg_group *);
91 static void	 pfi_ifaddr_event(void * __unused, struct ifnet *);
92 
93 RB_HEAD(pfi_ifhead, pfi_kif);
94 static RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
95 static RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
96 static VNET_DEFINE(struct pfi_ifhead, pfi_ifs);
97 #define	V_pfi_ifs	VNET(pfi_ifs)
98 
99 #define	PFI_BUFFER_MAX		0x10000
100 MALLOC_DEFINE(PFI_MTYPE, "pf_ifnet", "pf(4) interface database");
101 
102 LIST_HEAD(pfi_list, pfi_kif);
103 static VNET_DEFINE(struct pfi_list, pfi_unlinked_kifs);
104 #define	V_pfi_unlinked_kifs	VNET(pfi_unlinked_kifs)
105 static struct mtx pfi_unlnkdkifs_mtx;
106 MTX_SYSINIT(pfi_unlnkdkifs_mtx, &pfi_unlnkdkifs_mtx, "pf unlinked interfaces",
107     MTX_DEF);
108 
109 void
110 pfi_initialize(void)
111 {
112 	struct ifg_group *ifg;
113 	struct ifnet *ifp;
114 	struct pfi_kif *kif;
115 
116 	V_pfi_buffer_max = 64;
117 	V_pfi_buffer = malloc(V_pfi_buffer_max * sizeof(*V_pfi_buffer),
118 	    PFI_MTYPE, M_WAITOK);
119 
120 	kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
121 	PF_RULES_WLOCK();
122 	V_pfi_all = pfi_kif_attach(kif, IFG_ALL);
123 	PF_RULES_WUNLOCK();
124 
125 	IFNET_RLOCK();
126 	TAILQ_FOREACH(ifg, &V_ifg_head, ifg_next)
127 		pfi_attach_ifgroup(ifg);
128 	TAILQ_FOREACH(ifp, &V_ifnet, if_link)
129 		pfi_attach_ifnet(ifp);
130 	IFNET_RUNLOCK();
131 
132 	pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_arrival_event,
133 	    pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
134 	pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_departure_event,
135 	    pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
136 	pfi_attach_group_cookie = EVENTHANDLER_REGISTER(group_attach_event,
137 	    pfi_attach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
138 	pfi_change_group_cookie = EVENTHANDLER_REGISTER(group_change_event,
139 	    pfi_change_group_event, curvnet, EVENTHANDLER_PRI_ANY);
140 	pfi_detach_group_cookie = EVENTHANDLER_REGISTER(group_detach_event,
141 	    pfi_detach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
142 	pfi_ifaddr_event_cookie = EVENTHANDLER_REGISTER(ifaddr_event,
143 	    pfi_ifaddr_event, NULL, EVENTHANDLER_PRI_ANY);
144 }
145 
146 void
147 pfi_cleanup(void)
148 {
149 	struct pfi_kif *p;
150 
151 	EVENTHANDLER_DEREGISTER(ifnet_arrival_event, pfi_attach_cookie);
152 	EVENTHANDLER_DEREGISTER(ifnet_departure_event, pfi_detach_cookie);
153 	EVENTHANDLER_DEREGISTER(group_attach_event, pfi_attach_group_cookie);
154 	EVENTHANDLER_DEREGISTER(group_change_event, pfi_change_group_cookie);
155 	EVENTHANDLER_DEREGISTER(group_detach_event, pfi_detach_group_cookie);
156 	EVENTHANDLER_DEREGISTER(ifaddr_event, pfi_ifaddr_event_cookie);
157 
158 	V_pfi_all = NULL;
159 	while ((p = RB_MIN(pfi_ifhead, &V_pfi_ifs))) {
160 		RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p);
161 		free(p, PFI_MTYPE);
162 	}
163 
164 	while ((p = LIST_FIRST(&V_pfi_unlinked_kifs))) {
165 		LIST_REMOVE(p, pfik_list);
166 		free(p, PFI_MTYPE);
167 	}
168 
169 	free(V_pfi_buffer, PFI_MTYPE);
170 }
171 
172 struct pfi_kif *
173 pfi_kif_find(const char *kif_name)
174 {
175 	struct pfi_kif_cmp s;
176 
177 	PF_RULES_ASSERT();
178 
179 	bzero(&s, sizeof(s));
180 	strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name));
181 
182 	return (RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&s));
183 }
184 
185 struct pfi_kif *
186 pfi_kif_attach(struct pfi_kif *kif, const char *kif_name)
187 {
188 	struct pfi_kif *kif1;
189 
190 	PF_RULES_WASSERT();
191 	KASSERT(kif != NULL, ("%s: null kif", __func__));
192 
193 	kif1 = pfi_kif_find(kif_name);
194 	if (kif1 != NULL) {
195 		free(kif, PFI_MTYPE);
196 		return (kif1);
197 	}
198 
199 	bzero(kif, sizeof(*kif));
200 	strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name));
201 	/*
202 	 * It seems that the value of time_second is in unintialzied state
203 	 * when pf sets interface statistics clear time in boot phase if pf
204 	 * was statically linked to kernel. Instead of setting the bogus
205 	 * time value have pfi_get_ifaces handle this case. In
206 	 * pfi_get_ifaces it uses time_second if it sees the time is 0.
207 	 */
208 	kif->pfik_tzero = time_second > 1 ? time_second : 0;
209 	TAILQ_INIT(&kif->pfik_dynaddrs);
210 
211 	RB_INSERT(pfi_ifhead, &V_pfi_ifs, kif);
212 
213 	return (kif);
214 }
215 
216 void
217 pfi_kif_ref(struct pfi_kif *kif)
218 {
219 
220 	PF_RULES_WASSERT();
221 	kif->pfik_rulerefs++;
222 }
223 
224 void
225 pfi_kif_unref(struct pfi_kif *kif)
226 {
227 
228 	PF_RULES_WASSERT();
229 	KASSERT(kif->pfik_rulerefs > 0, ("%s: %p has zero refs", __func__, kif));
230 
231 	kif->pfik_rulerefs--;
232 
233 	if (kif->pfik_rulerefs > 0)
234 		return;
235 
236 	/* kif referencing an existing ifnet or group should exist. */
237 	if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all)
238 		return;
239 
240 	RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif);
241 
242 	kif->pfik_flags |= PFI_IFLAG_REFS;
243 
244 	mtx_lock(&pfi_unlnkdkifs_mtx);
245 	LIST_INSERT_HEAD(&V_pfi_unlinked_kifs, kif, pfik_list);
246 	mtx_unlock(&pfi_unlnkdkifs_mtx);
247 }
248 
249 void
250 pfi_kif_purge(void)
251 {
252 	struct pfi_kif *kif, *kif1;
253 
254 	/*
255 	 * Do naive mark-and-sweep garbage collecting of old kifs.
256 	 * Reference flag is raised by pf_purge_expired_states().
257 	 */
258 	mtx_lock(&pfi_unlnkdkifs_mtx);
259 	LIST_FOREACH_SAFE(kif, &V_pfi_unlinked_kifs, pfik_list, kif1) {
260 		if (!(kif->pfik_flags & PFI_IFLAG_REFS)) {
261 			LIST_REMOVE(kif, pfik_list);
262 			free(kif, PFI_MTYPE);
263 		} else
264 			kif->pfik_flags &= ~PFI_IFLAG_REFS;
265 	}
266 	mtx_unlock(&pfi_unlnkdkifs_mtx);
267 }
268 
269 int
270 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
271 {
272 	struct ifg_list	*p;
273 
274 	if (rule_kif == NULL || rule_kif == packet_kif)
275 		return (1);
276 
277 	if (rule_kif->pfik_group != NULL)
278 		/* XXXGL: locking? */
279 		TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next)
280 			if (p->ifgl_group == rule_kif->pfik_group)
281 				return (1);
282 
283 	return (0);
284 }
285 
286 static void
287 pfi_attach_ifnet(struct ifnet *ifp)
288 {
289 	struct pfi_kif *kif;
290 
291 	kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
292 
293 	PF_RULES_WLOCK();
294 	V_pfi_update++;
295 	kif = pfi_kif_attach(kif, ifp->if_xname);
296 
297 	kif->pfik_ifp = ifp;
298 	ifp->if_pf_kif = kif;
299 
300 	pfi_kif_update(kif);
301 	PF_RULES_WUNLOCK();
302 }
303 
304 static void
305 pfi_attach_ifgroup(struct ifg_group *ifg)
306 {
307 	struct pfi_kif *kif;
308 
309 	kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
310 
311 	PF_RULES_WLOCK();
312 	V_pfi_update++;
313 	kif = pfi_kif_attach(kif, ifg->ifg_group);
314 
315 	kif->pfik_group = ifg;
316 	ifg->ifg_pf_kif = kif;
317 	PF_RULES_WUNLOCK();
318 }
319 
320 int
321 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
322 {
323 	switch (af) {
324 #ifdef INET
325 	case AF_INET:
326 		switch (dyn->pfid_acnt4) {
327 		case 0:
328 			return (0);
329 		case 1:
330 			return (PF_MATCHA(0, &dyn->pfid_addr4,
331 			    &dyn->pfid_mask4, a, AF_INET));
332 		default:
333 			return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
334 		}
335 		break;
336 #endif /* INET */
337 #ifdef INET6
338 	case AF_INET6:
339 		switch (dyn->pfid_acnt6) {
340 		case 0:
341 			return (0);
342 		case 1:
343 			return (PF_MATCHA(0, &dyn->pfid_addr6,
344 			    &dyn->pfid_mask6, a, AF_INET6));
345 		default:
346 			return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
347 		}
348 		break;
349 #endif /* INET6 */
350 	default:
351 		return (0);
352 	}
353 }
354 
355 int
356 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
357 {
358 	struct pfi_dynaddr	*dyn;
359 	char			 tblname[PF_TABLE_NAME_SIZE];
360 	struct pf_ruleset	*ruleset = NULL;
361 	struct pfi_kif		*kif;
362 	int			 rv = 0;
363 
364 	PF_RULES_WASSERT();
365 	KASSERT(aw->type == PF_ADDR_DYNIFTL, ("%s: type %u",
366 	    __func__, aw->type));
367 	KASSERT(aw->p.dyn == NULL, ("%s: dyn is %p", __func__, aw->p.dyn));
368 
369 	if ((dyn = malloc(sizeof(*dyn), PFI_MTYPE, M_NOWAIT | M_ZERO)) == NULL)
370 		return (ENOMEM);
371 
372 	if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_NOWAIT)) == NULL) {
373 		free(dyn, PFI_MTYPE);
374 		return (ENOMEM);
375 	}
376 
377 	if (!strcmp(aw->v.ifname, "self"))
378 		dyn->pfid_kif = pfi_kif_attach(kif, IFG_ALL);
379 	else
380 		dyn->pfid_kif = pfi_kif_attach(kif, aw->v.ifname);
381 	pfi_kif_ref(dyn->pfid_kif);
382 
383 	dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
384 	if (af == AF_INET && dyn->pfid_net == 32)
385 		dyn->pfid_net = 128;
386 	strlcpy(tblname, aw->v.ifname, sizeof(tblname));
387 	if (aw->iflags & PFI_AFLAG_NETWORK)
388 		strlcat(tblname, ":network", sizeof(tblname));
389 	if (aw->iflags & PFI_AFLAG_BROADCAST)
390 		strlcat(tblname, ":broadcast", sizeof(tblname));
391 	if (aw->iflags & PFI_AFLAG_PEER)
392 		strlcat(tblname, ":peer", sizeof(tblname));
393 	if (aw->iflags & PFI_AFLAG_NOALIAS)
394 		strlcat(tblname, ":0", sizeof(tblname));
395 	if (dyn->pfid_net != 128)
396 		snprintf(tblname + strlen(tblname),
397 		    sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
398 	if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
399 		rv = ENOMEM;
400 		goto _bad;
401 	}
402 
403 	if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) {
404 		rv = ENOMEM;
405 		goto _bad;
406 	}
407 
408 	dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE;
409 	dyn->pfid_iflags = aw->iflags;
410 	dyn->pfid_af = af;
411 
412 	TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
413 	aw->p.dyn = dyn;
414 	pfi_kif_update(dyn->pfid_kif);
415 
416 	return (0);
417 
418 _bad:
419 	if (dyn->pfid_kt != NULL)
420 		pfr_detach_table(dyn->pfid_kt);
421 	if (ruleset != NULL)
422 		pf_remove_if_empty_ruleset(ruleset);
423 	if (dyn->pfid_kif != NULL)
424 		pfi_kif_unref(dyn->pfid_kif);
425 	free(dyn, PFI_MTYPE);
426 
427 	return (rv);
428 }
429 
430 static void
431 pfi_kif_update(struct pfi_kif *kif)
432 {
433 	struct ifg_list		*ifgl;
434 	struct pfi_dynaddr	*p;
435 
436 	PF_RULES_WASSERT();
437 
438 	/* update all dynaddr */
439 	TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
440 		pfi_dynaddr_update(p);
441 
442 	/* again for all groups kif is member of */
443 	if (kif->pfik_ifp != NULL) {
444 		IF_ADDR_RLOCK(kif->pfik_ifp);
445 		TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)
446 			pfi_kif_update((struct pfi_kif *)
447 			    ifgl->ifgl_group->ifg_pf_kif);
448 		IF_ADDR_RUNLOCK(kif->pfik_ifp);
449 	}
450 }
451 
452 static void
453 pfi_dynaddr_update(struct pfi_dynaddr *dyn)
454 {
455 	struct pfi_kif		*kif;
456 	struct pfr_ktable	*kt;
457 
458 	PF_RULES_WASSERT();
459 	KASSERT(dyn && dyn->pfid_kif && dyn->pfid_kt,
460 	    ("%s: bad argument", __func__));
461 
462 	kif = dyn->pfid_kif;
463 	kt = dyn->pfid_kt;
464 
465 	if (kt->pfrkt_larg != V_pfi_update) {
466 		/* this table needs to be brought up-to-date */
467 		pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags);
468 		kt->pfrkt_larg = V_pfi_update;
469 	}
470 	pfr_dynaddr_update(kt, dyn);
471 }
472 
473 static void
474 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
475 {
476 	int			 e, size2 = 0;
477 	struct ifg_member	*ifgm;
478 
479 	V_pfi_buffer_cnt = 0;
480 
481 	if (kif->pfik_ifp != NULL)
482 		pfi_instance_add(kif->pfik_ifp, net, flags);
483 	else if (kif->pfik_group != NULL) {
484 		IFNET_RLOCK_NOSLEEP();
485 		TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next)
486 			pfi_instance_add(ifgm->ifgm_ifp, net, flags);
487 		IFNET_RUNLOCK_NOSLEEP();
488 	}
489 
490 	if ((e = pfr_set_addrs(&kt->pfrkt_t, V_pfi_buffer, V_pfi_buffer_cnt, &size2,
491 	    NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
492 		printf("%s: cannot set %d new addresses into table %s: %d\n",
493 		    __func__, V_pfi_buffer_cnt, kt->pfrkt_name, e);
494 }
495 
496 static void
497 pfi_instance_add(struct ifnet *ifp, int net, int flags)
498 {
499 	struct ifaddr	*ia;
500 	int		 got4 = 0, got6 = 0;
501 	int		 net2, af;
502 
503 	IF_ADDR_RLOCK(ifp);
504 	TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_list) {
505 		if (ia->ifa_addr == NULL)
506 			continue;
507 		af = ia->ifa_addr->sa_family;
508 		if (af != AF_INET && af != AF_INET6)
509 			continue;
510 		/*
511 		 * XXX: For point-to-point interfaces, (ifname:0) and IPv4,
512 		 *      jump over addresses without a proper route to work
513 		 *      around a problem with ppp not fully removing the
514 		 *      address used during IPCP.
515 		 */
516 		if ((ifp->if_flags & IFF_POINTOPOINT) &&
517 		    !(ia->ifa_flags & IFA_ROUTE) &&
518 		    (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET))
519 			continue;
520 		if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6)
521 			continue;
522 		if ((flags & PFI_AFLAG_BROADCAST) &&
523 		    !(ifp->if_flags & IFF_BROADCAST))
524 			continue;
525 		if ((flags & PFI_AFLAG_PEER) &&
526 		    !(ifp->if_flags & IFF_POINTOPOINT))
527 			continue;
528 		if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
529 		    IN6_IS_ADDR_LINKLOCAL(
530 		    &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
531 			continue;
532 		if (flags & PFI_AFLAG_NOALIAS) {
533 			if (af == AF_INET && got4)
534 				continue;
535 			if (af == AF_INET6 && got6)
536 				continue;
537 		}
538 		if (af == AF_INET)
539 			got4 = 1;
540 		else if (af == AF_INET6)
541 			got6 = 1;
542 		net2 = net;
543 		if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
544 			if (af == AF_INET)
545 				net2 = pfi_unmask(&((struct sockaddr_in *)
546 				    ia->ifa_netmask)->sin_addr);
547 			else if (af == AF_INET6)
548 				net2 = pfi_unmask(&((struct sockaddr_in6 *)
549 				    ia->ifa_netmask)->sin6_addr);
550 		}
551 		if (af == AF_INET && net2 > 32)
552 			net2 = 32;
553 		if (flags & PFI_AFLAG_BROADCAST)
554 			pfi_address_add(ia->ifa_broadaddr, af, net2);
555 		else if (flags & PFI_AFLAG_PEER)
556 			pfi_address_add(ia->ifa_dstaddr, af, net2);
557 		else
558 			pfi_address_add(ia->ifa_addr, af, net2);
559 	}
560 	IF_ADDR_RUNLOCK(ifp);
561 }
562 
563 static void
564 pfi_address_add(struct sockaddr *sa, int af, int net)
565 {
566 	struct pfr_addr	*p;
567 	int		 i;
568 
569 	if (V_pfi_buffer_cnt >= V_pfi_buffer_max) {
570 		int		 new_max = V_pfi_buffer_max * 2;
571 
572 		if (new_max > PFI_BUFFER_MAX) {
573 			printf("%s: address buffer full (%d/%d)\n", __func__,
574 			    V_pfi_buffer_cnt, PFI_BUFFER_MAX);
575 			return;
576 		}
577 		p = malloc(new_max * sizeof(*V_pfi_buffer), PFI_MTYPE,
578 		    M_NOWAIT);
579 		if (p == NULL) {
580 			printf("%s: no memory to grow buffer (%d/%d)\n",
581 			    __func__, V_pfi_buffer_cnt, PFI_BUFFER_MAX);
582 			return;
583 		}
584 		memcpy(V_pfi_buffer, p, V_pfi_buffer_cnt * sizeof(*V_pfi_buffer));
585 		/* no need to zero buffer */
586 		free(V_pfi_buffer, PFI_MTYPE);
587 		V_pfi_buffer = p;
588 		V_pfi_buffer_max = new_max;
589 	}
590 	if (af == AF_INET && net > 32)
591 		net = 128;
592 	p = V_pfi_buffer + V_pfi_buffer_cnt++;
593 	bzero(p, sizeof(*p));
594 	p->pfra_af = af;
595 	p->pfra_net = net;
596 	if (af == AF_INET)
597 		p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr;
598 	else if (af == AF_INET6) {
599 		p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr;
600 		if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr))
601 			p->pfra_ip6addr.s6_addr16[1] = 0;
602 	}
603 	/* mask network address bits */
604 	if (net < 128)
605 		((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
606 	for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++)
607 		((caddr_t)p)[i] = 0;
608 }
609 
610 void
611 pfi_dynaddr_remove(struct pfi_dynaddr *dyn)
612 {
613 
614 	KASSERT(dyn->pfid_kif != NULL, ("%s: null pfid_kif", __func__));
615 	KASSERT(dyn->pfid_kt != NULL, ("%s: null pfid_kt", __func__));
616 
617 	TAILQ_REMOVE(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
618 	pfi_kif_unref(dyn->pfid_kif);
619 	pfr_detach_table(dyn->pfid_kt);
620 	free(dyn, PFI_MTYPE);
621 }
622 
623 void
624 pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
625 {
626 
627 	KASSERT(aw->type == PF_ADDR_DYNIFTL,
628 	    ("%s: type %u", __func__, aw->type));
629 
630 	if (aw->p.dyn == NULL || aw->p.dyn->pfid_kif == NULL)
631 		return;
632 	aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
633 }
634 
635 static int
636 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
637 {
638 	return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
639 }
640 
641 void
642 pfi_update_status(const char *name, struct pf_status *pfs)
643 {
644 	struct pfi_kif		*p;
645 	struct pfi_kif_cmp	 key;
646 	struct ifg_member	 p_member, *ifgm;
647 	TAILQ_HEAD(, ifg_member) ifg_members;
648 	int			 i, j, k;
649 
650 	strlcpy(key.pfik_name, name, sizeof(key.pfik_name));
651 	p = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&key);
652 	if (p == NULL)
653 		return;
654 
655 	if (p->pfik_group != NULL) {
656 		bcopy(&p->pfik_group->ifg_members, &ifg_members,
657 		    sizeof(ifg_members));
658 	} else {
659 		/* build a temporary list for p only */
660 		bzero(&p_member, sizeof(p_member));
661 		p_member.ifgm_ifp = p->pfik_ifp;
662 		TAILQ_INIT(&ifg_members);
663 		TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next);
664 	}
665 	if (pfs) {
666 		bzero(pfs->pcounters, sizeof(pfs->pcounters));
667 		bzero(pfs->bcounters, sizeof(pfs->bcounters));
668 	}
669 	TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) {
670 		if (ifgm->ifgm_ifp == NULL)
671 			continue;
672 		p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif;
673 
674 		/* just clear statistics */
675 		if (pfs == NULL) {
676 			bzero(p->pfik_packets, sizeof(p->pfik_packets));
677 			bzero(p->pfik_bytes, sizeof(p->pfik_bytes));
678 			p->pfik_tzero = time_second;
679 			continue;
680 		}
681 		for (i = 0; i < 2; i++)
682 			for (j = 0; j < 2; j++)
683 				for (k = 0; k < 2; k++) {
684 					pfs->pcounters[i][j][k] +=
685 						p->pfik_packets[i][j][k];
686 					pfs->bcounters[i][j] +=
687 						p->pfik_bytes[i][j][k];
688 				}
689 	}
690 }
691 
692 void
693 pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size)
694 {
695 	struct pfi_kif	*p, *nextp;
696 	int		 n = 0;
697 
698 	for (p = RB_MIN(pfi_ifhead, &V_pfi_ifs); p; p = nextp) {
699 		nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
700 		if (pfi_skip_if(name, p))
701 			continue;
702 		if (*size <= n++)
703 			break;
704 		if (!p->pfik_tzero)
705 			p->pfik_tzero = time_second;
706 		bcopy(p, buf++, sizeof(*buf));
707 		nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
708 	}
709 	*size = n;
710 }
711 
712 static int
713 pfi_skip_if(const char *filter, struct pfi_kif *p)
714 {
715 	int	n;
716 
717 	if (filter == NULL || !*filter)
718 		return (0);
719 	if (!strcmp(p->pfik_name, filter))
720 		return (0);	/* exact match */
721 	n = strlen(filter);
722 	if (n < 1 || n >= IFNAMSIZ)
723 		return (1);	/* sanity check */
724 	if (filter[n-1] >= '0' && filter[n-1] <= '9')
725 		return (1);	/* only do exact match in that case */
726 	if (strncmp(p->pfik_name, filter, n))
727 		return (1);	/* prefix doesn't match */
728 	return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
729 }
730 
731 int
732 pfi_set_flags(const char *name, int flags)
733 {
734 	struct pfi_kif	*p;
735 
736 	RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
737 		if (pfi_skip_if(name, p))
738 			continue;
739 		p->pfik_flags |= flags;
740 	}
741 	return (0);
742 }
743 
744 int
745 pfi_clear_flags(const char *name, int flags)
746 {
747 	struct pfi_kif	*p;
748 
749 	RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
750 		if (pfi_skip_if(name, p))
751 			continue;
752 		p->pfik_flags &= ~flags;
753 	}
754 	return (0);
755 }
756 
757 /* from pf_print_state.c */
758 static int
759 pfi_unmask(void *addr)
760 {
761 	struct pf_addr *m = addr;
762 	int i = 31, j = 0, b = 0;
763 	u_int32_t tmp;
764 
765 	while (j < 4 && m->addr32[j] == 0xffffffff) {
766 		b += 32;
767 		j++;
768 	}
769 	if (j < 4) {
770 		tmp = ntohl(m->addr32[j]);
771 		for (i = 31; tmp & (1 << i); --i)
772 			b++;
773 	}
774 	return (b);
775 }
776 
777 static void
778 pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp)
779 {
780 
781 	CURVNET_SET(ifp->if_vnet);
782 	pfi_attach_ifnet(ifp);
783 #ifdef ALTQ
784 	PF_RULES_WLOCK();
785 	pf_altq_ifnet_event(ifp, 0);
786 	PF_RULES_WUNLOCK();
787 #endif
788 	CURVNET_RESTORE();
789 }
790 
791 static void
792 pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp)
793 {
794 	struct pfi_kif *kif = (struct pfi_kif *)ifp->if_pf_kif;
795 
796 	CURVNET_SET(ifp->if_vnet);
797 	PF_RULES_WLOCK();
798 	V_pfi_update++;
799 	pfi_kif_update(kif);
800 
801 	kif->pfik_ifp = NULL;
802 	ifp->if_pf_kif = NULL;
803 #ifdef ALTQ
804 	pf_altq_ifnet_event(ifp, 1);
805 #endif
806 	PF_RULES_WUNLOCK();
807 	CURVNET_RESTORE();
808 }
809 
810 static void
811 pfi_attach_group_event(void *arg , struct ifg_group *ifg)
812 {
813 
814 	CURVNET_SET((struct vnet *)arg);
815 	pfi_attach_ifgroup(ifg);
816 	CURVNET_RESTORE();
817 }
818 
819 static void
820 pfi_change_group_event(void *arg, char *gname)
821 {
822 	struct pfi_kif *kif;
823 
824 	kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK);
825 
826 	CURVNET_SET((struct vnet *)arg);
827 	PF_RULES_WLOCK();
828 	V_pfi_update++;
829 	kif = pfi_kif_attach(kif, gname);
830 	pfi_kif_update(kif);
831 	PF_RULES_WUNLOCK();
832 	CURVNET_RESTORE();
833 }
834 
835 static void
836 pfi_detach_group_event(void *arg, struct ifg_group *ifg)
837 {
838 	struct pfi_kif *kif = (struct pfi_kif *)ifg->ifg_pf_kif;
839 
840 	CURVNET_SET((struct vnet *)arg);
841 	PF_RULES_WLOCK();
842 	V_pfi_update++;
843 
844 	kif->pfik_group = NULL;
845 	ifg->ifg_pf_kif = NULL;
846 	PF_RULES_WUNLOCK();
847 	CURVNET_RESTORE();
848 }
849 
850 static void
851 pfi_ifaddr_event(void *arg __unused, struct ifnet *ifp)
852 {
853 
854 	CURVNET_SET(ifp->if_vnet);
855 	PF_RULES_WLOCK();
856 	if (ifp && ifp->if_pf_kif) {
857 		V_pfi_update++;
858 		pfi_kif_update(ifp->if_pf_kif);
859 	}
860 	PF_RULES_WUNLOCK();
861 	CURVNET_RESTORE();
862 }
863