1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 * $OpenBSD: pf_ioctl.c,v 1.213 2009/02/15 21:46:12 mbalmer Exp $ 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD$"); 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_bpf.h" 46 #include "opt_pf.h" 47 48 #include <sys/param.h> 49 #include <sys/_bitset.h> 50 #include <sys/bitset.h> 51 #include <sys/bus.h> 52 #include <sys/conf.h> 53 #include <sys/endian.h> 54 #include <sys/fcntl.h> 55 #include <sys/filio.h> 56 #include <sys/hash.h> 57 #include <sys/interrupt.h> 58 #include <sys/jail.h> 59 #include <sys/kernel.h> 60 #include <sys/kthread.h> 61 #include <sys/lock.h> 62 #include <sys/mbuf.h> 63 #include <sys/module.h> 64 #include <sys/nv.h> 65 #include <sys/proc.h> 66 #include <sys/sdt.h> 67 #include <sys/smp.h> 68 #include <sys/socket.h> 69 #include <sys/sysctl.h> 70 #include <sys/md5.h> 71 #include <sys/ucred.h> 72 73 #include <net/if.h> 74 #include <net/if_var.h> 75 #include <net/vnet.h> 76 #include <net/route.h> 77 #include <net/pfil.h> 78 #include <net/pfvar.h> 79 #include <net/if_pfsync.h> 80 #include <net/if_pflog.h> 81 82 #include <netinet/in.h> 83 #include <netinet/ip.h> 84 #include <netinet/ip_var.h> 85 #include <netinet6/ip6_var.h> 86 #include <netinet/ip_icmp.h> 87 #include <netpfil/pf/pf_nv.h> 88 89 #ifdef INET6 90 #include <netinet/ip6.h> 91 #endif /* INET6 */ 92 93 #ifdef ALTQ 94 #include <net/altq/altq.h> 95 #endif 96 97 SDT_PROBE_DEFINE3(pf, ioctl, ioctl, error, "int", "int", "int"); 98 SDT_PROBE_DEFINE3(pf, ioctl, function, error, "char *", "int", "int"); 99 SDT_PROBE_DEFINE2(pf, ioctl, addrule, error, "int", "int"); 100 SDT_PROBE_DEFINE2(pf, ioctl, nvchk, error, "int", "int"); 101 102 static struct pf_kpool *pf_get_kpool(const char *, u_int32_t, u_int8_t, 103 u_int32_t, u_int8_t, u_int8_t, u_int8_t); 104 105 static void pf_mv_kpool(struct pf_kpalist *, struct pf_kpalist *); 106 static void pf_empty_kpool(struct pf_kpalist *); 107 static int pfioctl(struct cdev *, u_long, caddr_t, int, 108 struct thread *); 109 #ifdef ALTQ 110 static int pf_begin_altq(u_int32_t *); 111 static int pf_rollback_altq(u_int32_t); 112 static int pf_commit_altq(u_int32_t); 113 static int pf_enable_altq(struct pf_altq *); 114 static int pf_disable_altq(struct pf_altq *); 115 static u_int32_t pf_qname2qid(const char *); 116 static void pf_qid_unref(u_int32_t); 117 #endif /* ALTQ */ 118 static int pf_begin_rules(u_int32_t *, int, const char *); 119 static int pf_rollback_rules(u_int32_t, int, char *); 120 static int pf_setup_pfsync_matching(struct pf_kruleset *); 121 static void pf_hash_rule(MD5_CTX *, struct pf_krule *); 122 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 123 static int pf_commit_rules(u_int32_t, int, char *); 124 static int pf_addr_setup(struct pf_kruleset *, 125 struct pf_addr_wrap *, sa_family_t); 126 static void pf_addr_copyout(struct pf_addr_wrap *); 127 static void pf_src_node_copy(const struct pf_ksrc_node *, 128 struct pf_src_node *); 129 #ifdef ALTQ 130 static int pf_export_kaltq(struct pf_altq *, 131 struct pfioc_altq_v1 *, size_t); 132 static int pf_import_kaltq(struct pfioc_altq_v1 *, 133 struct pf_altq *, size_t); 134 #endif /* ALTQ */ 135 136 VNET_DEFINE(struct pf_krule, pf_default_rule); 137 138 #ifdef ALTQ 139 VNET_DEFINE_STATIC(int, pf_altq_running); 140 #define V_pf_altq_running VNET(pf_altq_running) 141 #endif 142 143 #define TAGID_MAX 50000 144 struct pf_tagname { 145 TAILQ_ENTRY(pf_tagname) namehash_entries; 146 TAILQ_ENTRY(pf_tagname) taghash_entries; 147 char name[PF_TAG_NAME_SIZE]; 148 uint16_t tag; 149 int ref; 150 }; 151 152 struct pf_tagset { 153 TAILQ_HEAD(, pf_tagname) *namehash; 154 TAILQ_HEAD(, pf_tagname) *taghash; 155 unsigned int mask; 156 uint32_t seed; 157 BITSET_DEFINE(, TAGID_MAX) avail; 158 }; 159 160 VNET_DEFINE(struct pf_tagset, pf_tags); 161 #define V_pf_tags VNET(pf_tags) 162 static unsigned int pf_rule_tag_hashsize; 163 #define PF_RULE_TAG_HASH_SIZE_DEFAULT 128 164 SYSCTL_UINT(_net_pf, OID_AUTO, rule_tag_hashsize, CTLFLAG_RDTUN, 165 &pf_rule_tag_hashsize, PF_RULE_TAG_HASH_SIZE_DEFAULT, 166 "Size of pf(4) rule tag hashtable"); 167 168 #ifdef ALTQ 169 VNET_DEFINE(struct pf_tagset, pf_qids); 170 #define V_pf_qids VNET(pf_qids) 171 static unsigned int pf_queue_tag_hashsize; 172 #define PF_QUEUE_TAG_HASH_SIZE_DEFAULT 128 173 SYSCTL_UINT(_net_pf, OID_AUTO, queue_tag_hashsize, CTLFLAG_RDTUN, 174 &pf_queue_tag_hashsize, PF_QUEUE_TAG_HASH_SIZE_DEFAULT, 175 "Size of pf(4) queue tag hashtable"); 176 #endif 177 VNET_DEFINE(uma_zone_t, pf_tag_z); 178 #define V_pf_tag_z VNET(pf_tag_z) 179 static MALLOC_DEFINE(M_PFALTQ, "pf_altq", "pf(4) altq configuration db"); 180 static MALLOC_DEFINE(M_PFRULE, "pf_rule", "pf(4) rules"); 181 182 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 183 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 184 #endif 185 186 static void pf_init_tagset(struct pf_tagset *, unsigned int *, 187 unsigned int); 188 static void pf_cleanup_tagset(struct pf_tagset *); 189 static uint16_t tagname2hashindex(const struct pf_tagset *, const char *); 190 static uint16_t tag2hashindex(const struct pf_tagset *, uint16_t); 191 static u_int16_t tagname2tag(struct pf_tagset *, const char *); 192 static u_int16_t pf_tagname2tag(const char *); 193 static void tag_unref(struct pf_tagset *, u_int16_t); 194 195 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x 196 197 struct cdev *pf_dev; 198 199 /* 200 * XXX - These are new and need to be checked when moveing to a new version 201 */ 202 static void pf_clear_all_states(void); 203 static unsigned int pf_clear_states(const struct pf_kstate_kill *); 204 static void pf_killstates(struct pf_kstate_kill *, 205 unsigned int *); 206 static int pf_killstates_row(struct pf_kstate_kill *, 207 struct pf_idhash *); 208 static int pf_killstates_nv(struct pfioc_nv *); 209 static int pf_clearstates_nv(struct pfioc_nv *); 210 static int pf_getstate(struct pfioc_nv *); 211 static int pf_clear_tables(void); 212 static void pf_clear_srcnodes(struct pf_ksrc_node *); 213 static void pf_kill_srcnodes(struct pfioc_src_node_kill *); 214 static int pf_keepcounters(struct pfioc_nv *); 215 static void pf_tbladdr_copyout(struct pf_addr_wrap *); 216 217 /* 218 * Wrapper functions for pfil(9) hooks 219 */ 220 #ifdef INET 221 static pfil_return_t pf_check_in(struct mbuf **m, struct ifnet *ifp, 222 int flags, void *ruleset __unused, struct inpcb *inp); 223 static pfil_return_t pf_check_out(struct mbuf **m, struct ifnet *ifp, 224 int flags, void *ruleset __unused, struct inpcb *inp); 225 #endif 226 #ifdef INET6 227 static pfil_return_t pf_check6_in(struct mbuf **m, struct ifnet *ifp, 228 int flags, void *ruleset __unused, struct inpcb *inp); 229 static pfil_return_t pf_check6_out(struct mbuf **m, struct ifnet *ifp, 230 int flags, void *ruleset __unused, struct inpcb *inp); 231 #endif 232 233 static void hook_pf(void); 234 static void dehook_pf(void); 235 static int shutdown_pf(void); 236 static int pf_load(void); 237 static void pf_unload(void); 238 239 static struct cdevsw pf_cdevsw = { 240 .d_ioctl = pfioctl, 241 .d_name = PF_NAME, 242 .d_version = D_VERSION, 243 }; 244 245 volatile VNET_DEFINE_STATIC(int, pf_pfil_hooked); 246 #define V_pf_pfil_hooked VNET(pf_pfil_hooked) 247 248 /* 249 * We need a flag that is neither hooked nor running to know when 250 * the VNET is "valid". We primarily need this to control (global) 251 * external event, e.g., eventhandlers. 252 */ 253 VNET_DEFINE(int, pf_vnet_active); 254 #define V_pf_vnet_active VNET(pf_vnet_active) 255 256 int pf_end_threads; 257 struct proc *pf_purge_proc; 258 259 struct rmlock pf_rules_lock; 260 struct sx pf_ioctl_lock; 261 struct sx pf_end_lock; 262 263 /* pfsync */ 264 VNET_DEFINE(pfsync_state_import_t *, pfsync_state_import_ptr); 265 VNET_DEFINE(pfsync_insert_state_t *, pfsync_insert_state_ptr); 266 VNET_DEFINE(pfsync_update_state_t *, pfsync_update_state_ptr); 267 VNET_DEFINE(pfsync_delete_state_t *, pfsync_delete_state_ptr); 268 VNET_DEFINE(pfsync_clear_states_t *, pfsync_clear_states_ptr); 269 VNET_DEFINE(pfsync_defer_t *, pfsync_defer_ptr); 270 pfsync_detach_ifnet_t *pfsync_detach_ifnet_ptr; 271 272 /* pflog */ 273 pflog_packet_t *pflog_packet_ptr = NULL; 274 275 extern u_long pf_ioctl_maxcount; 276 277 /* 278 * Copy a user-provided string, returning an error if truncation would occur. 279 * Avoid scanning past "sz" bytes in the source string since there's no 280 * guarantee that it's nul-terminated. 281 */ 282 static int 283 pf_user_strcpy(char *dst, const char *src, size_t sz) 284 { 285 if (strnlen(src, sz) == sz) 286 return (EINVAL); 287 (void)strlcpy(dst, src, sz); 288 return (0); 289 } 290 291 static void 292 pfattach_vnet(void) 293 { 294 u_int32_t *my_timeout = V_pf_default_rule.timeout; 295 296 pf_initialize(); 297 pfr_initialize(); 298 pfi_initialize_vnet(); 299 pf_normalize_init(); 300 pf_syncookies_init(); 301 302 V_pf_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT; 303 V_pf_limits[PF_LIMIT_SRC_NODES].limit = PFSNODE_HIWAT; 304 305 RB_INIT(&V_pf_anchors); 306 pf_init_kruleset(&pf_main_ruleset); 307 308 /* default rule should never be garbage collected */ 309 V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next; 310 #ifdef PF_DEFAULT_TO_DROP 311 V_pf_default_rule.action = PF_DROP; 312 #else 313 V_pf_default_rule.action = PF_PASS; 314 #endif 315 V_pf_default_rule.nr = -1; 316 V_pf_default_rule.rtableid = -1; 317 318 pf_counter_u64_init(&V_pf_default_rule.evaluations, M_WAITOK); 319 for (int i = 0; i < 2; i++) { 320 pf_counter_u64_init(&V_pf_default_rule.packets[i], M_WAITOK); 321 pf_counter_u64_init(&V_pf_default_rule.bytes[i], M_WAITOK); 322 } 323 V_pf_default_rule.states_cur = counter_u64_alloc(M_WAITOK); 324 V_pf_default_rule.states_tot = counter_u64_alloc(M_WAITOK); 325 V_pf_default_rule.src_nodes = counter_u64_alloc(M_WAITOK); 326 327 #ifdef PF_WANT_32_TO_64_COUNTER 328 V_pf_kifmarker = malloc(sizeof(*V_pf_kifmarker), PFI_MTYPE, M_WAITOK | M_ZERO); 329 V_pf_rulemarker = malloc(sizeof(*V_pf_rulemarker), M_PFRULE, M_WAITOK | M_ZERO); 330 PF_RULES_WLOCK(); 331 LIST_INSERT_HEAD(&V_pf_allkiflist, V_pf_kifmarker, pfik_allkiflist); 332 LIST_INSERT_HEAD(&V_pf_allrulelist, &V_pf_default_rule, allrulelist); 333 V_pf_allrulecount++; 334 LIST_INSERT_HEAD(&V_pf_allrulelist, V_pf_rulemarker, allrulelist); 335 PF_RULES_WUNLOCK(); 336 #endif 337 338 /* initialize default timeouts */ 339 my_timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 340 my_timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 341 my_timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 342 my_timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 343 my_timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 344 my_timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 345 my_timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 346 my_timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 347 my_timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 348 my_timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 349 my_timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 350 my_timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 351 my_timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 352 my_timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 353 my_timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 354 my_timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 355 my_timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 356 my_timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 357 my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 358 my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 359 360 bzero(&V_pf_status, sizeof(V_pf_status)); 361 V_pf_status.debug = PF_DEBUG_URGENT; 362 363 V_pf_pfil_hooked = 0; 364 365 /* XXX do our best to avoid a conflict */ 366 V_pf_status.hostid = arc4random(); 367 368 for (int i = 0; i < PFRES_MAX; i++) 369 V_pf_status.counters[i] = counter_u64_alloc(M_WAITOK); 370 for (int i = 0; i < LCNT_MAX; i++) 371 V_pf_status.lcounters[i] = counter_u64_alloc(M_WAITOK); 372 for (int i = 0; i < FCNT_MAX; i++) 373 pf_counter_u64_init(&V_pf_status.fcounters[i], M_WAITOK); 374 for (int i = 0; i < SCNT_MAX; i++) 375 V_pf_status.scounters[i] = counter_u64_alloc(M_WAITOK); 376 377 if (swi_add(&V_pf_swi_ie, "pf send", pf_intr, curvnet, SWI_NET, 378 INTR_MPSAFE, &V_pf_swi_cookie) != 0) 379 /* XXXGL: leaked all above. */ 380 return; 381 } 382 383 static struct pf_kpool * 384 pf_get_kpool(const char *anchor, u_int32_t ticket, u_int8_t rule_action, 385 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 386 u_int8_t check_ticket) 387 { 388 struct pf_kruleset *ruleset; 389 struct pf_krule *rule; 390 int rs_num; 391 392 ruleset = pf_find_kruleset(anchor); 393 if (ruleset == NULL) 394 return (NULL); 395 rs_num = pf_get_ruleset_number(rule_action); 396 if (rs_num >= PF_RULESET_MAX) 397 return (NULL); 398 if (active) { 399 if (check_ticket && ticket != 400 ruleset->rules[rs_num].active.ticket) 401 return (NULL); 402 if (r_last) 403 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 404 pf_krulequeue); 405 else 406 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 407 } else { 408 if (check_ticket && ticket != 409 ruleset->rules[rs_num].inactive.ticket) 410 return (NULL); 411 if (r_last) 412 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 413 pf_krulequeue); 414 else 415 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 416 } 417 if (!r_last) { 418 while ((rule != NULL) && (rule->nr != rule_number)) 419 rule = TAILQ_NEXT(rule, entries); 420 } 421 if (rule == NULL) 422 return (NULL); 423 424 return (&rule->rpool); 425 } 426 427 static void 428 pf_mv_kpool(struct pf_kpalist *poola, struct pf_kpalist *poolb) 429 { 430 struct pf_kpooladdr *mv_pool_pa; 431 432 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 433 TAILQ_REMOVE(poola, mv_pool_pa, entries); 434 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 435 } 436 } 437 438 static void 439 pf_empty_kpool(struct pf_kpalist *poola) 440 { 441 struct pf_kpooladdr *pa; 442 443 while ((pa = TAILQ_FIRST(poola)) != NULL) { 444 switch (pa->addr.type) { 445 case PF_ADDR_DYNIFTL: 446 pfi_dynaddr_remove(pa->addr.p.dyn); 447 break; 448 case PF_ADDR_TABLE: 449 /* XXX: this could be unfinished pooladdr on pabuf */ 450 if (pa->addr.p.tbl != NULL) 451 pfr_detach_table(pa->addr.p.tbl); 452 break; 453 } 454 if (pa->kif) 455 pfi_kkif_unref(pa->kif); 456 TAILQ_REMOVE(poola, pa, entries); 457 free(pa, M_PFRULE); 458 } 459 } 460 461 static void 462 pf_unlink_rule(struct pf_krulequeue *rulequeue, struct pf_krule *rule) 463 { 464 465 PF_RULES_WASSERT(); 466 467 TAILQ_REMOVE(rulequeue, rule, entries); 468 469 PF_UNLNKDRULES_LOCK(); 470 rule->rule_ref |= PFRULE_REFS; 471 TAILQ_INSERT_TAIL(&V_pf_unlinked_rules, rule, entries); 472 PF_UNLNKDRULES_UNLOCK(); 473 } 474 475 void 476 pf_free_rule(struct pf_krule *rule) 477 { 478 479 PF_RULES_WASSERT(); 480 481 if (rule->tag) 482 tag_unref(&V_pf_tags, rule->tag); 483 if (rule->match_tag) 484 tag_unref(&V_pf_tags, rule->match_tag); 485 #ifdef ALTQ 486 if (rule->pqid != rule->qid) 487 pf_qid_unref(rule->pqid); 488 pf_qid_unref(rule->qid); 489 #endif 490 switch (rule->src.addr.type) { 491 case PF_ADDR_DYNIFTL: 492 pfi_dynaddr_remove(rule->src.addr.p.dyn); 493 break; 494 case PF_ADDR_TABLE: 495 pfr_detach_table(rule->src.addr.p.tbl); 496 break; 497 } 498 switch (rule->dst.addr.type) { 499 case PF_ADDR_DYNIFTL: 500 pfi_dynaddr_remove(rule->dst.addr.p.dyn); 501 break; 502 case PF_ADDR_TABLE: 503 pfr_detach_table(rule->dst.addr.p.tbl); 504 break; 505 } 506 if (rule->overload_tbl) 507 pfr_detach_table(rule->overload_tbl); 508 if (rule->kif) 509 pfi_kkif_unref(rule->kif); 510 pf_kanchor_remove(rule); 511 pf_empty_kpool(&rule->rpool.list); 512 513 pf_krule_free(rule); 514 } 515 516 static void 517 pf_init_tagset(struct pf_tagset *ts, unsigned int *tunable_size, 518 unsigned int default_size) 519 { 520 unsigned int i; 521 unsigned int hashsize; 522 523 if (*tunable_size == 0 || !powerof2(*tunable_size)) 524 *tunable_size = default_size; 525 526 hashsize = *tunable_size; 527 ts->namehash = mallocarray(hashsize, sizeof(*ts->namehash), M_PFHASH, 528 M_WAITOK); 529 ts->taghash = mallocarray(hashsize, sizeof(*ts->taghash), M_PFHASH, 530 M_WAITOK); 531 ts->mask = hashsize - 1; 532 ts->seed = arc4random(); 533 for (i = 0; i < hashsize; i++) { 534 TAILQ_INIT(&ts->namehash[i]); 535 TAILQ_INIT(&ts->taghash[i]); 536 } 537 BIT_FILL(TAGID_MAX, &ts->avail); 538 } 539 540 static void 541 pf_cleanup_tagset(struct pf_tagset *ts) 542 { 543 unsigned int i; 544 unsigned int hashsize; 545 struct pf_tagname *t, *tmp; 546 547 /* 548 * Only need to clean up one of the hashes as each tag is hashed 549 * into each table. 550 */ 551 hashsize = ts->mask + 1; 552 for (i = 0; i < hashsize; i++) 553 TAILQ_FOREACH_SAFE(t, &ts->namehash[i], namehash_entries, tmp) 554 uma_zfree(V_pf_tag_z, t); 555 556 free(ts->namehash, M_PFHASH); 557 free(ts->taghash, M_PFHASH); 558 } 559 560 static uint16_t 561 tagname2hashindex(const struct pf_tagset *ts, const char *tagname) 562 { 563 size_t len; 564 565 len = strnlen(tagname, PF_TAG_NAME_SIZE - 1); 566 return (murmur3_32_hash(tagname, len, ts->seed) & ts->mask); 567 } 568 569 static uint16_t 570 tag2hashindex(const struct pf_tagset *ts, uint16_t tag) 571 { 572 573 return (tag & ts->mask); 574 } 575 576 static u_int16_t 577 tagname2tag(struct pf_tagset *ts, const char *tagname) 578 { 579 struct pf_tagname *tag; 580 u_int32_t index; 581 u_int16_t new_tagid; 582 583 PF_RULES_WASSERT(); 584 585 index = tagname2hashindex(ts, tagname); 586 TAILQ_FOREACH(tag, &ts->namehash[index], namehash_entries) 587 if (strcmp(tagname, tag->name) == 0) { 588 tag->ref++; 589 return (tag->tag); 590 } 591 592 /* 593 * new entry 594 * 595 * to avoid fragmentation, we do a linear search from the beginning 596 * and take the first free slot we find. 597 */ 598 new_tagid = BIT_FFS(TAGID_MAX, &ts->avail); 599 /* 600 * Tags are 1-based, with valid tags in the range [1..TAGID_MAX]. 601 * BIT_FFS() returns a 1-based bit number, with 0 indicating no bits 602 * set. It may also return a bit number greater than TAGID_MAX due 603 * to rounding of the number of bits in the vector up to a multiple 604 * of the vector word size at declaration/allocation time. 605 */ 606 if ((new_tagid == 0) || (new_tagid > TAGID_MAX)) 607 return (0); 608 609 /* Mark the tag as in use. Bits are 0-based for BIT_CLR() */ 610 BIT_CLR(TAGID_MAX, new_tagid - 1, &ts->avail); 611 612 /* allocate and fill new struct pf_tagname */ 613 tag = uma_zalloc(V_pf_tag_z, M_NOWAIT); 614 if (tag == NULL) 615 return (0); 616 strlcpy(tag->name, tagname, sizeof(tag->name)); 617 tag->tag = new_tagid; 618 tag->ref = 1; 619 620 /* Insert into namehash */ 621 TAILQ_INSERT_TAIL(&ts->namehash[index], tag, namehash_entries); 622 623 /* Insert into taghash */ 624 index = tag2hashindex(ts, new_tagid); 625 TAILQ_INSERT_TAIL(&ts->taghash[index], tag, taghash_entries); 626 627 return (tag->tag); 628 } 629 630 static void 631 tag_unref(struct pf_tagset *ts, u_int16_t tag) 632 { 633 struct pf_tagname *t; 634 uint16_t index; 635 636 PF_RULES_WASSERT(); 637 638 index = tag2hashindex(ts, tag); 639 TAILQ_FOREACH(t, &ts->taghash[index], taghash_entries) 640 if (tag == t->tag) { 641 if (--t->ref == 0) { 642 TAILQ_REMOVE(&ts->taghash[index], t, 643 taghash_entries); 644 index = tagname2hashindex(ts, t->name); 645 TAILQ_REMOVE(&ts->namehash[index], t, 646 namehash_entries); 647 /* Bits are 0-based for BIT_SET() */ 648 BIT_SET(TAGID_MAX, tag - 1, &ts->avail); 649 uma_zfree(V_pf_tag_z, t); 650 } 651 break; 652 } 653 } 654 655 static u_int16_t 656 pf_tagname2tag(const char *tagname) 657 { 658 return (tagname2tag(&V_pf_tags, tagname)); 659 } 660 661 #ifdef ALTQ 662 static u_int32_t 663 pf_qname2qid(const char *qname) 664 { 665 return ((u_int32_t)tagname2tag(&V_pf_qids, qname)); 666 } 667 668 static void 669 pf_qid_unref(u_int32_t qid) 670 { 671 tag_unref(&V_pf_qids, (u_int16_t)qid); 672 } 673 674 static int 675 pf_begin_altq(u_int32_t *ticket) 676 { 677 struct pf_altq *altq, *tmp; 678 int error = 0; 679 680 PF_RULES_WASSERT(); 681 682 /* Purge the old altq lists */ 683 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) { 684 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 685 /* detach and destroy the discipline */ 686 error = altq_remove(altq); 687 } 688 free(altq, M_PFALTQ); 689 } 690 TAILQ_INIT(V_pf_altq_ifs_inactive); 691 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) { 692 pf_qid_unref(altq->qid); 693 free(altq, M_PFALTQ); 694 } 695 TAILQ_INIT(V_pf_altqs_inactive); 696 if (error) 697 return (error); 698 *ticket = ++V_ticket_altqs_inactive; 699 V_altqs_inactive_open = 1; 700 return (0); 701 } 702 703 static int 704 pf_rollback_altq(u_int32_t ticket) 705 { 706 struct pf_altq *altq, *tmp; 707 int error = 0; 708 709 PF_RULES_WASSERT(); 710 711 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 712 return (0); 713 /* Purge the old altq lists */ 714 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) { 715 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 716 /* detach and destroy the discipline */ 717 error = altq_remove(altq); 718 } 719 free(altq, M_PFALTQ); 720 } 721 TAILQ_INIT(V_pf_altq_ifs_inactive); 722 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) { 723 pf_qid_unref(altq->qid); 724 free(altq, M_PFALTQ); 725 } 726 TAILQ_INIT(V_pf_altqs_inactive); 727 V_altqs_inactive_open = 0; 728 return (error); 729 } 730 731 static int 732 pf_commit_altq(u_int32_t ticket) 733 { 734 struct pf_altqqueue *old_altqs, *old_altq_ifs; 735 struct pf_altq *altq, *tmp; 736 int err, error = 0; 737 738 PF_RULES_WASSERT(); 739 740 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 741 return (EBUSY); 742 743 /* swap altqs, keep the old. */ 744 old_altqs = V_pf_altqs_active; 745 old_altq_ifs = V_pf_altq_ifs_active; 746 V_pf_altqs_active = V_pf_altqs_inactive; 747 V_pf_altq_ifs_active = V_pf_altq_ifs_inactive; 748 V_pf_altqs_inactive = old_altqs; 749 V_pf_altq_ifs_inactive = old_altq_ifs; 750 V_ticket_altqs_active = V_ticket_altqs_inactive; 751 752 /* Attach new disciplines */ 753 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 754 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 755 /* attach the discipline */ 756 error = altq_pfattach(altq); 757 if (error == 0 && V_pf_altq_running) 758 error = pf_enable_altq(altq); 759 if (error != 0) 760 return (error); 761 } 762 } 763 764 /* Purge the old altq lists */ 765 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) { 766 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 767 /* detach and destroy the discipline */ 768 if (V_pf_altq_running) 769 error = pf_disable_altq(altq); 770 err = altq_pfdetach(altq); 771 if (err != 0 && error == 0) 772 error = err; 773 err = altq_remove(altq); 774 if (err != 0 && error == 0) 775 error = err; 776 } 777 free(altq, M_PFALTQ); 778 } 779 TAILQ_INIT(V_pf_altq_ifs_inactive); 780 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) { 781 pf_qid_unref(altq->qid); 782 free(altq, M_PFALTQ); 783 } 784 TAILQ_INIT(V_pf_altqs_inactive); 785 786 V_altqs_inactive_open = 0; 787 return (error); 788 } 789 790 static int 791 pf_enable_altq(struct pf_altq *altq) 792 { 793 struct ifnet *ifp; 794 struct tb_profile tb; 795 int error = 0; 796 797 if ((ifp = ifunit(altq->ifname)) == NULL) 798 return (EINVAL); 799 800 if (ifp->if_snd.altq_type != ALTQT_NONE) 801 error = altq_enable(&ifp->if_snd); 802 803 /* set tokenbucket regulator */ 804 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 805 tb.rate = altq->ifbandwidth; 806 tb.depth = altq->tbrsize; 807 error = tbr_set(&ifp->if_snd, &tb); 808 } 809 810 return (error); 811 } 812 813 static int 814 pf_disable_altq(struct pf_altq *altq) 815 { 816 struct ifnet *ifp; 817 struct tb_profile tb; 818 int error; 819 820 if ((ifp = ifunit(altq->ifname)) == NULL) 821 return (EINVAL); 822 823 /* 824 * when the discipline is no longer referenced, it was overridden 825 * by a new one. if so, just return. 826 */ 827 if (altq->altq_disc != ifp->if_snd.altq_disc) 828 return (0); 829 830 error = altq_disable(&ifp->if_snd); 831 832 if (error == 0) { 833 /* clear tokenbucket regulator */ 834 tb.rate = 0; 835 error = tbr_set(&ifp->if_snd, &tb); 836 } 837 838 return (error); 839 } 840 841 static int 842 pf_altq_ifnet_event_add(struct ifnet *ifp, int remove, u_int32_t ticket, 843 struct pf_altq *altq) 844 { 845 struct ifnet *ifp1; 846 int error = 0; 847 848 /* Deactivate the interface in question */ 849 altq->local_flags &= ~PFALTQ_FLAG_IF_REMOVED; 850 if ((ifp1 = ifunit(altq->ifname)) == NULL || 851 (remove && ifp1 == ifp)) { 852 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED; 853 } else { 854 error = altq_add(ifp1, altq); 855 856 if (ticket != V_ticket_altqs_inactive) 857 error = EBUSY; 858 859 if (error) 860 free(altq, M_PFALTQ); 861 } 862 863 return (error); 864 } 865 866 void 867 pf_altq_ifnet_event(struct ifnet *ifp, int remove) 868 { 869 struct pf_altq *a1, *a2, *a3; 870 u_int32_t ticket; 871 int error = 0; 872 873 /* 874 * No need to re-evaluate the configuration for events on interfaces 875 * that do not support ALTQ, as it's not possible for such 876 * interfaces to be part of the configuration. 877 */ 878 if (!ALTQ_IS_READY(&ifp->if_snd)) 879 return; 880 881 /* Interrupt userland queue modifications */ 882 if (V_altqs_inactive_open) 883 pf_rollback_altq(V_ticket_altqs_inactive); 884 885 /* Start new altq ruleset */ 886 if (pf_begin_altq(&ticket)) 887 return; 888 889 /* Copy the current active set */ 890 TAILQ_FOREACH(a1, V_pf_altq_ifs_active, entries) { 891 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT); 892 if (a2 == NULL) { 893 error = ENOMEM; 894 break; 895 } 896 bcopy(a1, a2, sizeof(struct pf_altq)); 897 898 error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2); 899 if (error) 900 break; 901 902 TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, a2, entries); 903 } 904 if (error) 905 goto out; 906 TAILQ_FOREACH(a1, V_pf_altqs_active, entries) { 907 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT); 908 if (a2 == NULL) { 909 error = ENOMEM; 910 break; 911 } 912 bcopy(a1, a2, sizeof(struct pf_altq)); 913 914 if ((a2->qid = pf_qname2qid(a2->qname)) == 0) { 915 error = EBUSY; 916 free(a2, M_PFALTQ); 917 break; 918 } 919 a2->altq_disc = NULL; 920 TAILQ_FOREACH(a3, V_pf_altq_ifs_inactive, entries) { 921 if (strncmp(a3->ifname, a2->ifname, 922 IFNAMSIZ) == 0) { 923 a2->altq_disc = a3->altq_disc; 924 break; 925 } 926 } 927 error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2); 928 if (error) 929 break; 930 931 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, a2, entries); 932 } 933 934 out: 935 if (error != 0) 936 pf_rollback_altq(ticket); 937 else 938 pf_commit_altq(ticket); 939 } 940 #endif /* ALTQ */ 941 942 static int 943 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 944 { 945 struct pf_kruleset *rs; 946 struct pf_krule *rule; 947 948 PF_RULES_WASSERT(); 949 950 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 951 return (EINVAL); 952 rs = pf_find_or_create_kruleset(anchor); 953 if (rs == NULL) 954 return (EINVAL); 955 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 956 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 957 rs->rules[rs_num].inactive.rcount--; 958 } 959 *ticket = ++rs->rules[rs_num].inactive.ticket; 960 rs->rules[rs_num].inactive.open = 1; 961 return (0); 962 } 963 964 static int 965 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 966 { 967 struct pf_kruleset *rs; 968 struct pf_krule *rule; 969 970 PF_RULES_WASSERT(); 971 972 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 973 return (EINVAL); 974 rs = pf_find_kruleset(anchor); 975 if (rs == NULL || !rs->rules[rs_num].inactive.open || 976 rs->rules[rs_num].inactive.ticket != ticket) 977 return (0); 978 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 979 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 980 rs->rules[rs_num].inactive.rcount--; 981 } 982 rs->rules[rs_num].inactive.open = 0; 983 return (0); 984 } 985 986 #define PF_MD5_UPD(st, elm) \ 987 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 988 989 #define PF_MD5_UPD_STR(st, elm) \ 990 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 991 992 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 993 (stor) = htonl((st)->elm); \ 994 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 995 } while (0) 996 997 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 998 (stor) = htons((st)->elm); \ 999 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 1000 } while (0) 1001 1002 static void 1003 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 1004 { 1005 PF_MD5_UPD(pfr, addr.type); 1006 switch (pfr->addr.type) { 1007 case PF_ADDR_DYNIFTL: 1008 PF_MD5_UPD(pfr, addr.v.ifname); 1009 PF_MD5_UPD(pfr, addr.iflags); 1010 break; 1011 case PF_ADDR_TABLE: 1012 PF_MD5_UPD(pfr, addr.v.tblname); 1013 break; 1014 case PF_ADDR_ADDRMASK: 1015 /* XXX ignore af? */ 1016 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 1017 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 1018 break; 1019 } 1020 1021 PF_MD5_UPD(pfr, port[0]); 1022 PF_MD5_UPD(pfr, port[1]); 1023 PF_MD5_UPD(pfr, neg); 1024 PF_MD5_UPD(pfr, port_op); 1025 } 1026 1027 static void 1028 pf_hash_rule(MD5_CTX *ctx, struct pf_krule *rule) 1029 { 1030 u_int16_t x; 1031 u_int32_t y; 1032 1033 pf_hash_rule_addr(ctx, &rule->src); 1034 pf_hash_rule_addr(ctx, &rule->dst); 1035 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 1036 PF_MD5_UPD_STR(rule, label[i]); 1037 PF_MD5_UPD_STR(rule, ifname); 1038 PF_MD5_UPD_STR(rule, match_tagname); 1039 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 1040 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 1041 PF_MD5_UPD_HTONL(rule, prob, y); 1042 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 1043 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 1044 PF_MD5_UPD(rule, uid.op); 1045 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 1046 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 1047 PF_MD5_UPD(rule, gid.op); 1048 PF_MD5_UPD_HTONL(rule, rule_flag, y); 1049 PF_MD5_UPD(rule, action); 1050 PF_MD5_UPD(rule, direction); 1051 PF_MD5_UPD(rule, af); 1052 PF_MD5_UPD(rule, quick); 1053 PF_MD5_UPD(rule, ifnot); 1054 PF_MD5_UPD(rule, match_tag_not); 1055 PF_MD5_UPD(rule, natpass); 1056 PF_MD5_UPD(rule, keep_state); 1057 PF_MD5_UPD(rule, proto); 1058 PF_MD5_UPD(rule, type); 1059 PF_MD5_UPD(rule, code); 1060 PF_MD5_UPD(rule, flags); 1061 PF_MD5_UPD(rule, flagset); 1062 PF_MD5_UPD(rule, allow_opts); 1063 PF_MD5_UPD(rule, rt); 1064 PF_MD5_UPD(rule, tos); 1065 } 1066 1067 static bool 1068 pf_krule_compare(struct pf_krule *a, struct pf_krule *b) 1069 { 1070 MD5_CTX ctx[2]; 1071 u_int8_t digest[2][PF_MD5_DIGEST_LENGTH]; 1072 1073 MD5Init(&ctx[0]); 1074 MD5Init(&ctx[1]); 1075 pf_hash_rule(&ctx[0], a); 1076 pf_hash_rule(&ctx[1], b); 1077 MD5Final(digest[0], &ctx[0]); 1078 MD5Final(digest[1], &ctx[1]); 1079 1080 return (memcmp(digest[0], digest[1], PF_MD5_DIGEST_LENGTH) == 0); 1081 } 1082 1083 static int 1084 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 1085 { 1086 struct pf_kruleset *rs; 1087 struct pf_krule *rule, **old_array, *tail; 1088 struct pf_krulequeue *old_rules; 1089 int error; 1090 u_int32_t old_rcount; 1091 1092 PF_RULES_WASSERT(); 1093 1094 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 1095 return (EINVAL); 1096 rs = pf_find_kruleset(anchor); 1097 if (rs == NULL || !rs->rules[rs_num].inactive.open || 1098 ticket != rs->rules[rs_num].inactive.ticket) 1099 return (EBUSY); 1100 1101 /* Calculate checksum for the main ruleset */ 1102 if (rs == &pf_main_ruleset) { 1103 error = pf_setup_pfsync_matching(rs); 1104 if (error != 0) 1105 return (error); 1106 } 1107 1108 /* Swap rules, keep the old. */ 1109 old_rules = rs->rules[rs_num].active.ptr; 1110 old_rcount = rs->rules[rs_num].active.rcount; 1111 old_array = rs->rules[rs_num].active.ptr_array; 1112 1113 rs->rules[rs_num].active.ptr = 1114 rs->rules[rs_num].inactive.ptr; 1115 rs->rules[rs_num].active.ptr_array = 1116 rs->rules[rs_num].inactive.ptr_array; 1117 rs->rules[rs_num].active.rcount = 1118 rs->rules[rs_num].inactive.rcount; 1119 1120 /* Attempt to preserve counter information. */ 1121 if (V_pf_status.keep_counters) { 1122 TAILQ_FOREACH(rule, rs->rules[rs_num].active.ptr, 1123 entries) { 1124 tail = TAILQ_FIRST(old_rules); 1125 while ((tail != NULL) && ! pf_krule_compare(tail, rule)) 1126 tail = TAILQ_NEXT(tail, entries); 1127 if (tail != NULL) { 1128 pf_counter_u64_critical_enter(); 1129 pf_counter_u64_add_protected(&rule->evaluations, 1130 pf_counter_u64_fetch(&tail->evaluations)); 1131 pf_counter_u64_add_protected(&rule->packets[0], 1132 pf_counter_u64_fetch(&tail->packets[0])); 1133 pf_counter_u64_add_protected(&rule->packets[1], 1134 pf_counter_u64_fetch(&tail->packets[1])); 1135 pf_counter_u64_add_protected(&rule->bytes[0], 1136 pf_counter_u64_fetch(&tail->bytes[0])); 1137 pf_counter_u64_add_protected(&rule->bytes[1], 1138 pf_counter_u64_fetch(&tail->bytes[1])); 1139 pf_counter_u64_critical_exit(); 1140 } 1141 } 1142 } 1143 1144 rs->rules[rs_num].inactive.ptr = old_rules; 1145 rs->rules[rs_num].inactive.ptr_array = old_array; 1146 rs->rules[rs_num].inactive.rcount = old_rcount; 1147 1148 rs->rules[rs_num].active.ticket = 1149 rs->rules[rs_num].inactive.ticket; 1150 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 1151 1152 /* Purge the old rule list. */ 1153 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 1154 pf_unlink_rule(old_rules, rule); 1155 if (rs->rules[rs_num].inactive.ptr_array) 1156 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 1157 rs->rules[rs_num].inactive.ptr_array = NULL; 1158 rs->rules[rs_num].inactive.rcount = 0; 1159 rs->rules[rs_num].inactive.open = 0; 1160 pf_remove_if_empty_kruleset(rs); 1161 1162 return (0); 1163 } 1164 1165 static int 1166 pf_setup_pfsync_matching(struct pf_kruleset *rs) 1167 { 1168 MD5_CTX ctx; 1169 struct pf_krule *rule; 1170 int rs_cnt; 1171 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 1172 1173 MD5Init(&ctx); 1174 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 1175 /* XXX PF_RULESET_SCRUB as well? */ 1176 if (rs_cnt == PF_RULESET_SCRUB) 1177 continue; 1178 1179 if (rs->rules[rs_cnt].inactive.ptr_array) 1180 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 1181 rs->rules[rs_cnt].inactive.ptr_array = NULL; 1182 1183 if (rs->rules[rs_cnt].inactive.rcount) { 1184 rs->rules[rs_cnt].inactive.ptr_array = 1185 malloc(sizeof(caddr_t) * 1186 rs->rules[rs_cnt].inactive.rcount, 1187 M_TEMP, M_NOWAIT); 1188 1189 if (!rs->rules[rs_cnt].inactive.ptr_array) 1190 return (ENOMEM); 1191 } 1192 1193 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 1194 entries) { 1195 pf_hash_rule(&ctx, rule); 1196 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 1197 } 1198 } 1199 1200 MD5Final(digest, &ctx); 1201 memcpy(V_pf_status.pf_chksum, digest, sizeof(V_pf_status.pf_chksum)); 1202 return (0); 1203 } 1204 1205 static int 1206 pf_addr_setup(struct pf_kruleset *ruleset, struct pf_addr_wrap *addr, 1207 sa_family_t af) 1208 { 1209 int error = 0; 1210 1211 switch (addr->type) { 1212 case PF_ADDR_TABLE: 1213 addr->p.tbl = pfr_attach_table(ruleset, addr->v.tblname); 1214 if (addr->p.tbl == NULL) 1215 error = ENOMEM; 1216 break; 1217 case PF_ADDR_DYNIFTL: 1218 error = pfi_dynaddr_setup(addr, af); 1219 break; 1220 } 1221 1222 return (error); 1223 } 1224 1225 static void 1226 pf_addr_copyout(struct pf_addr_wrap *addr) 1227 { 1228 1229 switch (addr->type) { 1230 case PF_ADDR_DYNIFTL: 1231 pfi_dynaddr_copyout(addr); 1232 break; 1233 case PF_ADDR_TABLE: 1234 pf_tbladdr_copyout(addr); 1235 break; 1236 } 1237 } 1238 1239 static void 1240 pf_src_node_copy(const struct pf_ksrc_node *in, struct pf_src_node *out) 1241 { 1242 int secs = time_uptime, diff; 1243 1244 bzero(out, sizeof(struct pf_src_node)); 1245 1246 bcopy(&in->addr, &out->addr, sizeof(struct pf_addr)); 1247 bcopy(&in->raddr, &out->raddr, sizeof(struct pf_addr)); 1248 1249 if (in->rule.ptr != NULL) 1250 out->rule.nr = in->rule.ptr->nr; 1251 1252 for (int i = 0; i < 2; i++) { 1253 out->bytes[i] = counter_u64_fetch(in->bytes[i]); 1254 out->packets[i] = counter_u64_fetch(in->packets[i]); 1255 } 1256 1257 out->states = in->states; 1258 out->conn = in->conn; 1259 out->af = in->af; 1260 out->ruletype = in->ruletype; 1261 1262 out->creation = secs - in->creation; 1263 if (out->expire > secs) 1264 out->expire -= secs; 1265 else 1266 out->expire = 0; 1267 1268 /* Adjust the connection rate estimate. */ 1269 diff = secs - in->conn_rate.last; 1270 if (diff >= in->conn_rate.seconds) 1271 out->conn_rate.count = 0; 1272 else 1273 out->conn_rate.count -= 1274 in->conn_rate.count * diff / 1275 in->conn_rate.seconds; 1276 } 1277 1278 #ifdef ALTQ 1279 /* 1280 * Handle export of struct pf_kaltq to user binaries that may be using any 1281 * version of struct pf_altq. 1282 */ 1283 static int 1284 pf_export_kaltq(struct pf_altq *q, struct pfioc_altq_v1 *pa, size_t ioc_size) 1285 { 1286 u_int32_t version; 1287 1288 if (ioc_size == sizeof(struct pfioc_altq_v0)) 1289 version = 0; 1290 else 1291 version = pa->version; 1292 1293 if (version > PFIOC_ALTQ_VERSION) 1294 return (EINVAL); 1295 1296 #define ASSIGN(x) exported_q->x = q->x 1297 #define COPY(x) \ 1298 bcopy(&q->x, &exported_q->x, min(sizeof(q->x), sizeof(exported_q->x))) 1299 #define SATU16(x) (u_int32_t)uqmin((x), USHRT_MAX) 1300 #define SATU32(x) (u_int32_t)uqmin((x), UINT_MAX) 1301 1302 switch (version) { 1303 case 0: { 1304 struct pf_altq_v0 *exported_q = 1305 &((struct pfioc_altq_v0 *)pa)->altq; 1306 1307 COPY(ifname); 1308 1309 ASSIGN(scheduler); 1310 ASSIGN(tbrsize); 1311 exported_q->tbrsize = SATU16(q->tbrsize); 1312 exported_q->ifbandwidth = SATU32(q->ifbandwidth); 1313 1314 COPY(qname); 1315 COPY(parent); 1316 ASSIGN(parent_qid); 1317 exported_q->bandwidth = SATU32(q->bandwidth); 1318 ASSIGN(priority); 1319 ASSIGN(local_flags); 1320 1321 ASSIGN(qlimit); 1322 ASSIGN(flags); 1323 1324 if (q->scheduler == ALTQT_HFSC) { 1325 #define ASSIGN_OPT(x) exported_q->pq_u.hfsc_opts.x = q->pq_u.hfsc_opts.x 1326 #define ASSIGN_OPT_SATU32(x) exported_q->pq_u.hfsc_opts.x = \ 1327 SATU32(q->pq_u.hfsc_opts.x) 1328 1329 ASSIGN_OPT_SATU32(rtsc_m1); 1330 ASSIGN_OPT(rtsc_d); 1331 ASSIGN_OPT_SATU32(rtsc_m2); 1332 1333 ASSIGN_OPT_SATU32(lssc_m1); 1334 ASSIGN_OPT(lssc_d); 1335 ASSIGN_OPT_SATU32(lssc_m2); 1336 1337 ASSIGN_OPT_SATU32(ulsc_m1); 1338 ASSIGN_OPT(ulsc_d); 1339 ASSIGN_OPT_SATU32(ulsc_m2); 1340 1341 ASSIGN_OPT(flags); 1342 1343 #undef ASSIGN_OPT 1344 #undef ASSIGN_OPT_SATU32 1345 } else 1346 COPY(pq_u); 1347 1348 ASSIGN(qid); 1349 break; 1350 } 1351 case 1: { 1352 struct pf_altq_v1 *exported_q = 1353 &((struct pfioc_altq_v1 *)pa)->altq; 1354 1355 COPY(ifname); 1356 1357 ASSIGN(scheduler); 1358 ASSIGN(tbrsize); 1359 ASSIGN(ifbandwidth); 1360 1361 COPY(qname); 1362 COPY(parent); 1363 ASSIGN(parent_qid); 1364 ASSIGN(bandwidth); 1365 ASSIGN(priority); 1366 ASSIGN(local_flags); 1367 1368 ASSIGN(qlimit); 1369 ASSIGN(flags); 1370 COPY(pq_u); 1371 1372 ASSIGN(qid); 1373 break; 1374 } 1375 default: 1376 panic("%s: unhandled struct pfioc_altq version", __func__); 1377 break; 1378 } 1379 1380 #undef ASSIGN 1381 #undef COPY 1382 #undef SATU16 1383 #undef SATU32 1384 1385 return (0); 1386 } 1387 1388 /* 1389 * Handle import to struct pf_kaltq of struct pf_altq from user binaries 1390 * that may be using any version of it. 1391 */ 1392 static int 1393 pf_import_kaltq(struct pfioc_altq_v1 *pa, struct pf_altq *q, size_t ioc_size) 1394 { 1395 u_int32_t version; 1396 1397 if (ioc_size == sizeof(struct pfioc_altq_v0)) 1398 version = 0; 1399 else 1400 version = pa->version; 1401 1402 if (version > PFIOC_ALTQ_VERSION) 1403 return (EINVAL); 1404 1405 #define ASSIGN(x) q->x = imported_q->x 1406 #define COPY(x) \ 1407 bcopy(&imported_q->x, &q->x, min(sizeof(imported_q->x), sizeof(q->x))) 1408 1409 switch (version) { 1410 case 0: { 1411 struct pf_altq_v0 *imported_q = 1412 &((struct pfioc_altq_v0 *)pa)->altq; 1413 1414 COPY(ifname); 1415 1416 ASSIGN(scheduler); 1417 ASSIGN(tbrsize); /* 16-bit -> 32-bit */ 1418 ASSIGN(ifbandwidth); /* 32-bit -> 64-bit */ 1419 1420 COPY(qname); 1421 COPY(parent); 1422 ASSIGN(parent_qid); 1423 ASSIGN(bandwidth); /* 32-bit -> 64-bit */ 1424 ASSIGN(priority); 1425 ASSIGN(local_flags); 1426 1427 ASSIGN(qlimit); 1428 ASSIGN(flags); 1429 1430 if (imported_q->scheduler == ALTQT_HFSC) { 1431 #define ASSIGN_OPT(x) q->pq_u.hfsc_opts.x = imported_q->pq_u.hfsc_opts.x 1432 1433 /* 1434 * The m1 and m2 parameters are being copied from 1435 * 32-bit to 64-bit. 1436 */ 1437 ASSIGN_OPT(rtsc_m1); 1438 ASSIGN_OPT(rtsc_d); 1439 ASSIGN_OPT(rtsc_m2); 1440 1441 ASSIGN_OPT(lssc_m1); 1442 ASSIGN_OPT(lssc_d); 1443 ASSIGN_OPT(lssc_m2); 1444 1445 ASSIGN_OPT(ulsc_m1); 1446 ASSIGN_OPT(ulsc_d); 1447 ASSIGN_OPT(ulsc_m2); 1448 1449 ASSIGN_OPT(flags); 1450 1451 #undef ASSIGN_OPT 1452 } else 1453 COPY(pq_u); 1454 1455 ASSIGN(qid); 1456 break; 1457 } 1458 case 1: { 1459 struct pf_altq_v1 *imported_q = 1460 &((struct pfioc_altq_v1 *)pa)->altq; 1461 1462 COPY(ifname); 1463 1464 ASSIGN(scheduler); 1465 ASSIGN(tbrsize); 1466 ASSIGN(ifbandwidth); 1467 1468 COPY(qname); 1469 COPY(parent); 1470 ASSIGN(parent_qid); 1471 ASSIGN(bandwidth); 1472 ASSIGN(priority); 1473 ASSIGN(local_flags); 1474 1475 ASSIGN(qlimit); 1476 ASSIGN(flags); 1477 COPY(pq_u); 1478 1479 ASSIGN(qid); 1480 break; 1481 } 1482 default: 1483 panic("%s: unhandled struct pfioc_altq version", __func__); 1484 break; 1485 } 1486 1487 #undef ASSIGN 1488 #undef COPY 1489 1490 return (0); 1491 } 1492 1493 static struct pf_altq * 1494 pf_altq_get_nth_active(u_int32_t n) 1495 { 1496 struct pf_altq *altq; 1497 u_int32_t nr; 1498 1499 nr = 0; 1500 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 1501 if (nr == n) 1502 return (altq); 1503 nr++; 1504 } 1505 1506 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 1507 if (nr == n) 1508 return (altq); 1509 nr++; 1510 } 1511 1512 return (NULL); 1513 } 1514 #endif /* ALTQ */ 1515 1516 void 1517 pf_krule_free(struct pf_krule *rule) 1518 { 1519 #ifdef PF_WANT_32_TO_64_COUNTER 1520 bool wowned; 1521 #endif 1522 1523 if (rule == NULL) 1524 return; 1525 1526 #ifdef PF_WANT_32_TO_64_COUNTER 1527 if (rule->allrulelinked) { 1528 wowned = PF_RULES_WOWNED(); 1529 if (!wowned) 1530 PF_RULES_WLOCK(); 1531 LIST_REMOVE(rule, allrulelist); 1532 V_pf_allrulecount--; 1533 if (!wowned) 1534 PF_RULES_WUNLOCK(); 1535 } 1536 #endif 1537 1538 pf_counter_u64_deinit(&rule->evaluations); 1539 for (int i = 0; i < 2; i++) { 1540 pf_counter_u64_deinit(&rule->packets[i]); 1541 pf_counter_u64_deinit(&rule->bytes[i]); 1542 } 1543 counter_u64_free(rule->states_cur); 1544 counter_u64_free(rule->states_tot); 1545 counter_u64_free(rule->src_nodes); 1546 free(rule, M_PFRULE); 1547 } 1548 1549 static void 1550 pf_kpooladdr_to_pooladdr(const struct pf_kpooladdr *kpool, 1551 struct pf_pooladdr *pool) 1552 { 1553 1554 bzero(pool, sizeof(*pool)); 1555 bcopy(&kpool->addr, &pool->addr, sizeof(pool->addr)); 1556 strlcpy(pool->ifname, kpool->ifname, sizeof(pool->ifname)); 1557 } 1558 1559 static int 1560 pf_pooladdr_to_kpooladdr(const struct pf_pooladdr *pool, 1561 struct pf_kpooladdr *kpool) 1562 { 1563 int ret; 1564 1565 bzero(kpool, sizeof(*kpool)); 1566 bcopy(&pool->addr, &kpool->addr, sizeof(kpool->addr)); 1567 ret = pf_user_strcpy(kpool->ifname, pool->ifname, 1568 sizeof(kpool->ifname)); 1569 return (ret); 1570 } 1571 1572 static void 1573 pf_kpool_to_pool(const struct pf_kpool *kpool, struct pf_pool *pool) 1574 { 1575 bzero(pool, sizeof(*pool)); 1576 1577 bcopy(&kpool->key, &pool->key, sizeof(pool->key)); 1578 bcopy(&kpool->counter, &pool->counter, sizeof(pool->counter)); 1579 1580 pool->tblidx = kpool->tblidx; 1581 pool->proxy_port[0] = kpool->proxy_port[0]; 1582 pool->proxy_port[1] = kpool->proxy_port[1]; 1583 pool->opts = kpool->opts; 1584 } 1585 1586 static int 1587 pf_pool_to_kpool(const struct pf_pool *pool, struct pf_kpool *kpool) 1588 { 1589 _Static_assert(sizeof(pool->key) == sizeof(kpool->key), ""); 1590 _Static_assert(sizeof(pool->counter) == sizeof(kpool->counter), ""); 1591 1592 bzero(kpool, sizeof(*kpool)); 1593 1594 bcopy(&pool->key, &kpool->key, sizeof(kpool->key)); 1595 bcopy(&pool->counter, &kpool->counter, sizeof(kpool->counter)); 1596 1597 kpool->tblidx = pool->tblidx; 1598 kpool->proxy_port[0] = pool->proxy_port[0]; 1599 kpool->proxy_port[1] = pool->proxy_port[1]; 1600 kpool->opts = pool->opts; 1601 1602 return (0); 1603 } 1604 1605 static void 1606 pf_krule_to_rule(struct pf_krule *krule, struct pf_rule *rule) 1607 { 1608 1609 bzero(rule, sizeof(*rule)); 1610 1611 bcopy(&krule->src, &rule->src, sizeof(rule->src)); 1612 bcopy(&krule->dst, &rule->dst, sizeof(rule->dst)); 1613 1614 for (int i = 0; i < PF_SKIP_COUNT; ++i) { 1615 if (rule->skip[i].ptr == NULL) 1616 rule->skip[i].nr = -1; 1617 else 1618 rule->skip[i].nr = krule->skip[i].ptr->nr; 1619 } 1620 1621 strlcpy(rule->label, krule->label[0], sizeof(rule->label)); 1622 strlcpy(rule->ifname, krule->ifname, sizeof(rule->ifname)); 1623 strlcpy(rule->qname, krule->qname, sizeof(rule->qname)); 1624 strlcpy(rule->pqname, krule->pqname, sizeof(rule->pqname)); 1625 strlcpy(rule->tagname, krule->tagname, sizeof(rule->tagname)); 1626 strlcpy(rule->match_tagname, krule->match_tagname, 1627 sizeof(rule->match_tagname)); 1628 strlcpy(rule->overload_tblname, krule->overload_tblname, 1629 sizeof(rule->overload_tblname)); 1630 1631 pf_kpool_to_pool(&krule->rpool, &rule->rpool); 1632 1633 rule->evaluations = pf_counter_u64_fetch(&krule->evaluations); 1634 for (int i = 0; i < 2; i++) { 1635 rule->packets[i] = pf_counter_u64_fetch(&krule->packets[i]); 1636 rule->bytes[i] = pf_counter_u64_fetch(&krule->bytes[i]); 1637 } 1638 1639 /* kif, anchor, overload_tbl are not copied over. */ 1640 1641 rule->os_fingerprint = krule->os_fingerprint; 1642 1643 rule->rtableid = krule->rtableid; 1644 bcopy(krule->timeout, rule->timeout, sizeof(krule->timeout)); 1645 rule->max_states = krule->max_states; 1646 rule->max_src_nodes = krule->max_src_nodes; 1647 rule->max_src_states = krule->max_src_states; 1648 rule->max_src_conn = krule->max_src_conn; 1649 rule->max_src_conn_rate.limit = krule->max_src_conn_rate.limit; 1650 rule->max_src_conn_rate.seconds = krule->max_src_conn_rate.seconds; 1651 rule->qid = krule->qid; 1652 rule->pqid = krule->pqid; 1653 rule->nr = krule->nr; 1654 rule->prob = krule->prob; 1655 rule->cuid = krule->cuid; 1656 rule->cpid = krule->cpid; 1657 1658 rule->return_icmp = krule->return_icmp; 1659 rule->return_icmp6 = krule->return_icmp6; 1660 rule->max_mss = krule->max_mss; 1661 rule->tag = krule->tag; 1662 rule->match_tag = krule->match_tag; 1663 rule->scrub_flags = krule->scrub_flags; 1664 1665 bcopy(&krule->uid, &rule->uid, sizeof(krule->uid)); 1666 bcopy(&krule->gid, &rule->gid, sizeof(krule->gid)); 1667 1668 rule->rule_flag = krule->rule_flag; 1669 rule->action = krule->action; 1670 rule->direction = krule->direction; 1671 rule->log = krule->log; 1672 rule->logif = krule->logif; 1673 rule->quick = krule->quick; 1674 rule->ifnot = krule->ifnot; 1675 rule->match_tag_not = krule->match_tag_not; 1676 rule->natpass = krule->natpass; 1677 1678 rule->keep_state = krule->keep_state; 1679 rule->af = krule->af; 1680 rule->proto = krule->proto; 1681 rule->type = krule->type; 1682 rule->code = krule->code; 1683 rule->flags = krule->flags; 1684 rule->flagset = krule->flagset; 1685 rule->min_ttl = krule->min_ttl; 1686 rule->allow_opts = krule->allow_opts; 1687 rule->rt = krule->rt; 1688 rule->return_ttl = krule->return_ttl; 1689 rule->tos = krule->tos; 1690 rule->set_tos = krule->set_tos; 1691 rule->anchor_relative = krule->anchor_relative; 1692 rule->anchor_wildcard = krule->anchor_wildcard; 1693 1694 rule->flush = krule->flush; 1695 rule->prio = krule->prio; 1696 rule->set_prio[0] = krule->set_prio[0]; 1697 rule->set_prio[1] = krule->set_prio[1]; 1698 1699 bcopy(&krule->divert, &rule->divert, sizeof(krule->divert)); 1700 1701 rule->u_states_cur = counter_u64_fetch(krule->states_cur); 1702 rule->u_states_tot = counter_u64_fetch(krule->states_tot); 1703 rule->u_src_nodes = counter_u64_fetch(krule->src_nodes); 1704 } 1705 1706 static int 1707 pf_rule_to_krule(const struct pf_rule *rule, struct pf_krule *krule) 1708 { 1709 int ret; 1710 1711 #ifndef INET 1712 if (rule->af == AF_INET) { 1713 return (EAFNOSUPPORT); 1714 } 1715 #endif /* INET */ 1716 #ifndef INET6 1717 if (rule->af == AF_INET6) { 1718 return (EAFNOSUPPORT); 1719 } 1720 #endif /* INET6 */ 1721 1722 ret = pf_check_rule_addr(&rule->src); 1723 if (ret != 0) 1724 return (ret); 1725 ret = pf_check_rule_addr(&rule->dst); 1726 if (ret != 0) 1727 return (ret); 1728 1729 bzero(krule, sizeof(*krule)); 1730 1731 bcopy(&rule->src, &krule->src, sizeof(rule->src)); 1732 bcopy(&rule->dst, &krule->dst, sizeof(rule->dst)); 1733 1734 ret = pf_user_strcpy(krule->label[0], rule->label, sizeof(rule->label)); 1735 if (ret != 0) 1736 return (ret); 1737 ret = pf_user_strcpy(krule->ifname, rule->ifname, sizeof(rule->ifname)); 1738 if (ret != 0) 1739 return (ret); 1740 ret = pf_user_strcpy(krule->qname, rule->qname, sizeof(rule->qname)); 1741 if (ret != 0) 1742 return (ret); 1743 ret = pf_user_strcpy(krule->pqname, rule->pqname, sizeof(rule->pqname)); 1744 if (ret != 0) 1745 return (ret); 1746 ret = pf_user_strcpy(krule->tagname, rule->tagname, 1747 sizeof(rule->tagname)); 1748 if (ret != 0) 1749 return (ret); 1750 ret = pf_user_strcpy(krule->match_tagname, rule->match_tagname, 1751 sizeof(rule->match_tagname)); 1752 if (ret != 0) 1753 return (ret); 1754 ret = pf_user_strcpy(krule->overload_tblname, rule->overload_tblname, 1755 sizeof(rule->overload_tblname)); 1756 if (ret != 0) 1757 return (ret); 1758 1759 ret = pf_pool_to_kpool(&rule->rpool, &krule->rpool); 1760 if (ret != 0) 1761 return (ret); 1762 1763 /* Don't allow userspace to set evaulations, packets or bytes. */ 1764 /* kif, anchor, overload_tbl are not copied over. */ 1765 1766 krule->os_fingerprint = rule->os_fingerprint; 1767 1768 krule->rtableid = rule->rtableid; 1769 bcopy(rule->timeout, krule->timeout, sizeof(krule->timeout)); 1770 krule->max_states = rule->max_states; 1771 krule->max_src_nodes = rule->max_src_nodes; 1772 krule->max_src_states = rule->max_src_states; 1773 krule->max_src_conn = rule->max_src_conn; 1774 krule->max_src_conn_rate.limit = rule->max_src_conn_rate.limit; 1775 krule->max_src_conn_rate.seconds = rule->max_src_conn_rate.seconds; 1776 krule->qid = rule->qid; 1777 krule->pqid = rule->pqid; 1778 krule->nr = rule->nr; 1779 krule->prob = rule->prob; 1780 krule->cuid = rule->cuid; 1781 krule->cpid = rule->cpid; 1782 1783 krule->return_icmp = rule->return_icmp; 1784 krule->return_icmp6 = rule->return_icmp6; 1785 krule->max_mss = rule->max_mss; 1786 krule->tag = rule->tag; 1787 krule->match_tag = rule->match_tag; 1788 krule->scrub_flags = rule->scrub_flags; 1789 1790 bcopy(&rule->uid, &krule->uid, sizeof(krule->uid)); 1791 bcopy(&rule->gid, &krule->gid, sizeof(krule->gid)); 1792 1793 krule->rule_flag = rule->rule_flag; 1794 krule->action = rule->action; 1795 krule->direction = rule->direction; 1796 krule->log = rule->log; 1797 krule->logif = rule->logif; 1798 krule->quick = rule->quick; 1799 krule->ifnot = rule->ifnot; 1800 krule->match_tag_not = rule->match_tag_not; 1801 krule->natpass = rule->natpass; 1802 1803 krule->keep_state = rule->keep_state; 1804 krule->af = rule->af; 1805 krule->proto = rule->proto; 1806 krule->type = rule->type; 1807 krule->code = rule->code; 1808 krule->flags = rule->flags; 1809 krule->flagset = rule->flagset; 1810 krule->min_ttl = rule->min_ttl; 1811 krule->allow_opts = rule->allow_opts; 1812 krule->rt = rule->rt; 1813 krule->return_ttl = rule->return_ttl; 1814 krule->tos = rule->tos; 1815 krule->set_tos = rule->set_tos; 1816 krule->anchor_relative = rule->anchor_relative; 1817 krule->anchor_wildcard = rule->anchor_wildcard; 1818 1819 krule->flush = rule->flush; 1820 krule->prio = rule->prio; 1821 krule->set_prio[0] = rule->set_prio[0]; 1822 krule->set_prio[1] = rule->set_prio[1]; 1823 1824 bcopy(&rule->divert, &krule->divert, sizeof(krule->divert)); 1825 1826 return (0); 1827 } 1828 1829 static int 1830 pf_state_kill_to_kstate_kill(const struct pfioc_state_kill *psk, 1831 struct pf_kstate_kill *kill) 1832 { 1833 int ret; 1834 1835 bzero(kill, sizeof(*kill)); 1836 1837 bcopy(&psk->psk_pfcmp, &kill->psk_pfcmp, sizeof(kill->psk_pfcmp)); 1838 kill->psk_af = psk->psk_af; 1839 kill->psk_proto = psk->psk_proto; 1840 bcopy(&psk->psk_src, &kill->psk_src, sizeof(kill->psk_src)); 1841 bcopy(&psk->psk_dst, &kill->psk_dst, sizeof(kill->psk_dst)); 1842 ret = pf_user_strcpy(kill->psk_ifname, psk->psk_ifname, 1843 sizeof(kill->psk_ifname)); 1844 if (ret != 0) 1845 return (ret); 1846 ret = pf_user_strcpy(kill->psk_label, psk->psk_label, 1847 sizeof(kill->psk_label)); 1848 if (ret != 0) 1849 return (ret); 1850 1851 return (0); 1852 } 1853 1854 static int 1855 pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket, 1856 uint32_t pool_ticket, const char *anchor, const char *anchor_call, 1857 struct thread *td) 1858 { 1859 struct pf_kruleset *ruleset; 1860 struct pf_krule *tail; 1861 struct pf_kpooladdr *pa; 1862 struct pfi_kkif *kif = NULL; 1863 int rs_num; 1864 int error = 0; 1865 1866 if ((rule->return_icmp >> 8) > ICMP_MAXTYPE) { 1867 error = EINVAL; 1868 goto errout_unlocked; 1869 } 1870 1871 #define ERROUT(x) ERROUT_FUNCTION(errout, x) 1872 1873 if (rule->ifname[0]) 1874 kif = pf_kkif_create(M_WAITOK); 1875 pf_counter_u64_init(&rule->evaluations, M_WAITOK); 1876 for (int i = 0; i < 2; i++) { 1877 pf_counter_u64_init(&rule->packets[i], M_WAITOK); 1878 pf_counter_u64_init(&rule->bytes[i], M_WAITOK); 1879 } 1880 rule->states_cur = counter_u64_alloc(M_WAITOK); 1881 rule->states_tot = counter_u64_alloc(M_WAITOK); 1882 rule->src_nodes = counter_u64_alloc(M_WAITOK); 1883 rule->cuid = td->td_ucred->cr_ruid; 1884 rule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 1885 TAILQ_INIT(&rule->rpool.list); 1886 1887 PF_RULES_WLOCK(); 1888 #ifdef PF_WANT_32_TO_64_COUNTER 1889 LIST_INSERT_HEAD(&V_pf_allrulelist, rule, allrulelist); 1890 MPASS(!rule->allrulelinked); 1891 rule->allrulelinked = true; 1892 V_pf_allrulecount++; 1893 #endif 1894 ruleset = pf_find_kruleset(anchor); 1895 if (ruleset == NULL) 1896 ERROUT(EINVAL); 1897 rs_num = pf_get_ruleset_number(rule->action); 1898 if (rs_num >= PF_RULESET_MAX) 1899 ERROUT(EINVAL); 1900 if (ticket != ruleset->rules[rs_num].inactive.ticket) { 1901 DPFPRINTF(PF_DEBUG_MISC, 1902 ("ticket: %d != [%d]%d\n", ticket, rs_num, 1903 ruleset->rules[rs_num].inactive.ticket)); 1904 ERROUT(EBUSY); 1905 } 1906 if (pool_ticket != V_ticket_pabuf) { 1907 DPFPRINTF(PF_DEBUG_MISC, 1908 ("pool_ticket: %d != %d\n", pool_ticket, 1909 V_ticket_pabuf)); 1910 ERROUT(EBUSY); 1911 } 1912 1913 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1914 pf_krulequeue); 1915 if (tail) 1916 rule->nr = tail->nr + 1; 1917 else 1918 rule->nr = 0; 1919 if (rule->ifname[0]) { 1920 rule->kif = pfi_kkif_attach(kif, rule->ifname); 1921 kif = NULL; 1922 pfi_kkif_ref(rule->kif); 1923 } else 1924 rule->kif = NULL; 1925 1926 if (rule->rtableid > 0 && rule->rtableid >= rt_numfibs) 1927 error = EBUSY; 1928 1929 #ifdef ALTQ 1930 /* set queue IDs */ 1931 if (rule->qname[0] != 0) { 1932 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1933 error = EBUSY; 1934 else if (rule->pqname[0] != 0) { 1935 if ((rule->pqid = 1936 pf_qname2qid(rule->pqname)) == 0) 1937 error = EBUSY; 1938 } else 1939 rule->pqid = rule->qid; 1940 } 1941 #endif 1942 if (rule->tagname[0]) 1943 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1944 error = EBUSY; 1945 if (rule->match_tagname[0]) 1946 if ((rule->match_tag = 1947 pf_tagname2tag(rule->match_tagname)) == 0) 1948 error = EBUSY; 1949 if (rule->rt && !rule->direction) 1950 error = EINVAL; 1951 if (!rule->log) 1952 rule->logif = 0; 1953 if (rule->logif >= PFLOGIFS_MAX) 1954 error = EINVAL; 1955 if (pf_addr_setup(ruleset, &rule->src.addr, rule->af)) 1956 error = ENOMEM; 1957 if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af)) 1958 error = ENOMEM; 1959 if (pf_kanchor_setup(rule, ruleset, anchor_call)) 1960 error = EINVAL; 1961 if (rule->scrub_flags & PFSTATE_SETPRIO && 1962 (rule->set_prio[0] > PF_PRIO_MAX || 1963 rule->set_prio[1] > PF_PRIO_MAX)) 1964 error = EINVAL; 1965 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 1966 if (pa->addr.type == PF_ADDR_TABLE) { 1967 pa->addr.p.tbl = pfr_attach_table(ruleset, 1968 pa->addr.v.tblname); 1969 if (pa->addr.p.tbl == NULL) 1970 error = ENOMEM; 1971 } 1972 1973 rule->overload_tbl = NULL; 1974 if (rule->overload_tblname[0]) { 1975 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1976 rule->overload_tblname)) == NULL) 1977 error = EINVAL; 1978 else 1979 rule->overload_tbl->pfrkt_flags |= 1980 PFR_TFLAG_ACTIVE; 1981 } 1982 1983 pf_mv_kpool(&V_pf_pabuf, &rule->rpool.list); 1984 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1985 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1986 (rule->rt > PF_NOPFROUTE)) && 1987 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1988 error = EINVAL; 1989 1990 if (error) { 1991 pf_free_rule(rule); 1992 rule = NULL; 1993 ERROUT(error); 1994 } 1995 1996 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1997 pf_counter_u64_zero(&rule->evaluations); 1998 for (int i = 0; i < 2; i++) { 1999 pf_counter_u64_zero(&rule->packets[i]); 2000 pf_counter_u64_zero(&rule->bytes[i]); 2001 } 2002 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 2003 rule, entries); 2004 ruleset->rules[rs_num].inactive.rcount++; 2005 PF_RULES_WUNLOCK(); 2006 2007 return (0); 2008 2009 #undef ERROUT 2010 errout: 2011 PF_RULES_WUNLOCK(); 2012 errout_unlocked: 2013 pf_kkif_free(kif); 2014 pf_krule_free(rule); 2015 return (error); 2016 } 2017 2018 static bool 2019 pf_label_match(const struct pf_krule *rule, const char *label) 2020 { 2021 int i = 0; 2022 2023 while (*rule->label[i]) { 2024 if (strcmp(rule->label[i], label) == 0) 2025 return (true); 2026 i++; 2027 } 2028 2029 return (false); 2030 } 2031 2032 static unsigned int 2033 pf_kill_matching_state(struct pf_state_key_cmp *key, int dir) 2034 { 2035 struct pf_kstate *match; 2036 int more = 0; 2037 unsigned int killed = 0; 2038 2039 /* Call with unlocked hashrow */ 2040 2041 match = pf_find_state_all(key, dir, &more); 2042 if (match && !more) { 2043 pf_unlink_state(match, 0); 2044 killed++; 2045 } 2046 2047 return (killed); 2048 } 2049 2050 static int 2051 pf_killstates_row(struct pf_kstate_kill *psk, struct pf_idhash *ih) 2052 { 2053 struct pf_kstate *s; 2054 struct pf_state_key *sk; 2055 struct pf_addr *srcaddr, *dstaddr; 2056 struct pf_state_key_cmp match_key; 2057 int idx, killed = 0; 2058 unsigned int dir; 2059 u_int16_t srcport, dstport; 2060 struct pfi_kkif *kif; 2061 2062 relock_DIOCKILLSTATES: 2063 PF_HASHROW_LOCK(ih); 2064 LIST_FOREACH(s, &ih->states, entry) { 2065 /* For floating states look at the original kif. */ 2066 kif = s->kif == V_pfi_all ? s->orig_kif : s->kif; 2067 2068 sk = s->key[PF_SK_WIRE]; 2069 if (s->direction == PF_OUT) { 2070 srcaddr = &sk->addr[1]; 2071 dstaddr = &sk->addr[0]; 2072 srcport = sk->port[1]; 2073 dstport = sk->port[0]; 2074 } else { 2075 srcaddr = &sk->addr[0]; 2076 dstaddr = &sk->addr[1]; 2077 srcport = sk->port[0]; 2078 dstport = sk->port[1]; 2079 } 2080 2081 if (psk->psk_af && sk->af != psk->psk_af) 2082 continue; 2083 2084 if (psk->psk_proto && psk->psk_proto != sk->proto) 2085 continue; 2086 2087 if (! PF_MATCHA(psk->psk_src.neg, &psk->psk_src.addr.v.a.addr, 2088 &psk->psk_src.addr.v.a.mask, srcaddr, sk->af)) 2089 continue; 2090 2091 if (! PF_MATCHA(psk->psk_dst.neg, &psk->psk_dst.addr.v.a.addr, 2092 &psk->psk_dst.addr.v.a.mask, dstaddr, sk->af)) 2093 continue; 2094 2095 if (! PF_MATCHA(psk->psk_rt_addr.neg, 2096 &psk->psk_rt_addr.addr.v.a.addr, 2097 &psk->psk_rt_addr.addr.v.a.mask, 2098 &s->rt_addr, sk->af)) 2099 continue; 2100 2101 if (psk->psk_src.port_op != 0 && 2102 ! pf_match_port(psk->psk_src.port_op, 2103 psk->psk_src.port[0], psk->psk_src.port[1], srcport)) 2104 continue; 2105 2106 if (psk->psk_dst.port_op != 0 && 2107 ! pf_match_port(psk->psk_dst.port_op, 2108 psk->psk_dst.port[0], psk->psk_dst.port[1], dstport)) 2109 continue; 2110 2111 if (psk->psk_label[0] && 2112 ! pf_label_match(s->rule.ptr, psk->psk_label)) 2113 continue; 2114 2115 if (psk->psk_ifname[0] && strcmp(psk->psk_ifname, 2116 kif->pfik_name)) 2117 continue; 2118 2119 if (psk->psk_kill_match) { 2120 /* Create the key to find matching states, with lock 2121 * held. */ 2122 2123 bzero(&match_key, sizeof(match_key)); 2124 2125 if (s->direction == PF_OUT) { 2126 dir = PF_IN; 2127 idx = PF_SK_STACK; 2128 } else { 2129 dir = PF_OUT; 2130 idx = PF_SK_WIRE; 2131 } 2132 2133 match_key.af = s->key[idx]->af; 2134 match_key.proto = s->key[idx]->proto; 2135 PF_ACPY(&match_key.addr[0], 2136 &s->key[idx]->addr[1], match_key.af); 2137 match_key.port[0] = s->key[idx]->port[1]; 2138 PF_ACPY(&match_key.addr[1], 2139 &s->key[idx]->addr[0], match_key.af); 2140 match_key.port[1] = s->key[idx]->port[0]; 2141 } 2142 2143 pf_unlink_state(s, PF_ENTER_LOCKED); 2144 killed++; 2145 2146 if (psk->psk_kill_match) 2147 killed += pf_kill_matching_state(&match_key, dir); 2148 2149 goto relock_DIOCKILLSTATES; 2150 } 2151 PF_HASHROW_UNLOCK(ih); 2152 2153 return (killed); 2154 } 2155 2156 static int 2157 pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) 2158 { 2159 int error = 0; 2160 PF_RULES_RLOCK_TRACKER; 2161 2162 #define ERROUT_IOCTL(target, x) \ 2163 do { \ 2164 error = (x); \ 2165 SDT_PROBE3(pf, ioctl, ioctl, error, cmd, error, __LINE__); \ 2166 goto target; \ 2167 } while (0) 2168 2169 2170 /* XXX keep in sync with switch() below */ 2171 if (securelevel_gt(td->td_ucred, 2)) 2172 switch (cmd) { 2173 case DIOCGETRULES: 2174 case DIOCGETRULE: 2175 case DIOCGETRULENV: 2176 case DIOCGETADDRS: 2177 case DIOCGETADDR: 2178 case DIOCGETSTATE: 2179 case DIOCGETSTATENV: 2180 case DIOCSETSTATUSIF: 2181 case DIOCGETSTATUS: 2182 case DIOCCLRSTATUS: 2183 case DIOCNATLOOK: 2184 case DIOCSETDEBUG: 2185 case DIOCGETSTATES: 2186 case DIOCGETSTATESV2: 2187 case DIOCGETTIMEOUT: 2188 case DIOCCLRRULECTRS: 2189 case DIOCGETLIMIT: 2190 case DIOCGETALTQSV0: 2191 case DIOCGETALTQSV1: 2192 case DIOCGETALTQV0: 2193 case DIOCGETALTQV1: 2194 case DIOCGETQSTATSV0: 2195 case DIOCGETQSTATSV1: 2196 case DIOCGETRULESETS: 2197 case DIOCGETRULESET: 2198 case DIOCRGETTABLES: 2199 case DIOCRGETTSTATS: 2200 case DIOCRCLRTSTATS: 2201 case DIOCRCLRADDRS: 2202 case DIOCRADDADDRS: 2203 case DIOCRDELADDRS: 2204 case DIOCRSETADDRS: 2205 case DIOCRGETADDRS: 2206 case DIOCRGETASTATS: 2207 case DIOCRCLRASTATS: 2208 case DIOCRTSTADDRS: 2209 case DIOCOSFPGET: 2210 case DIOCGETSRCNODES: 2211 case DIOCCLRSRCNODES: 2212 case DIOCGETSYNCOOKIES: 2213 case DIOCIGETIFACES: 2214 case DIOCGIFSPEEDV0: 2215 case DIOCGIFSPEEDV1: 2216 case DIOCSETIFFLAG: 2217 case DIOCCLRIFFLAG: 2218 break; 2219 case DIOCRCLRTABLES: 2220 case DIOCRADDTABLES: 2221 case DIOCRDELTABLES: 2222 case DIOCRSETTFLAGS: 2223 if (((struct pfioc_table *)addr)->pfrio_flags & 2224 PFR_FLAG_DUMMY) 2225 break; /* dummy operation ok */ 2226 return (EPERM); 2227 default: 2228 return (EPERM); 2229 } 2230 2231 if (!(flags & FWRITE)) 2232 switch (cmd) { 2233 case DIOCGETRULES: 2234 case DIOCGETADDRS: 2235 case DIOCGETADDR: 2236 case DIOCGETSTATE: 2237 case DIOCGETSTATENV: 2238 case DIOCGETSTATUS: 2239 case DIOCGETSTATES: 2240 case DIOCGETSTATESV2: 2241 case DIOCGETTIMEOUT: 2242 case DIOCGETLIMIT: 2243 case DIOCGETALTQSV0: 2244 case DIOCGETALTQSV1: 2245 case DIOCGETALTQV0: 2246 case DIOCGETALTQV1: 2247 case DIOCGETQSTATSV0: 2248 case DIOCGETQSTATSV1: 2249 case DIOCGETRULESETS: 2250 case DIOCGETRULESET: 2251 case DIOCNATLOOK: 2252 case DIOCRGETTABLES: 2253 case DIOCRGETTSTATS: 2254 case DIOCRGETADDRS: 2255 case DIOCRGETASTATS: 2256 case DIOCRTSTADDRS: 2257 case DIOCOSFPGET: 2258 case DIOCGETSRCNODES: 2259 case DIOCGETSYNCOOKIES: 2260 case DIOCIGETIFACES: 2261 case DIOCGIFSPEEDV1: 2262 case DIOCGIFSPEEDV0: 2263 case DIOCGETRULENV: 2264 break; 2265 case DIOCRCLRTABLES: 2266 case DIOCRADDTABLES: 2267 case DIOCRDELTABLES: 2268 case DIOCRCLRTSTATS: 2269 case DIOCRCLRADDRS: 2270 case DIOCRADDADDRS: 2271 case DIOCRDELADDRS: 2272 case DIOCRSETADDRS: 2273 case DIOCRSETTFLAGS: 2274 if (((struct pfioc_table *)addr)->pfrio_flags & 2275 PFR_FLAG_DUMMY) { 2276 flags |= FWRITE; /* need write lock for dummy */ 2277 break; /* dummy operation ok */ 2278 } 2279 return (EACCES); 2280 case DIOCGETRULE: 2281 if (((struct pfioc_rule *)addr)->action == 2282 PF_GET_CLR_CNTR) 2283 return (EACCES); 2284 break; 2285 default: 2286 return (EACCES); 2287 } 2288 2289 CURVNET_SET(TD_TO_VNET(td)); 2290 2291 switch (cmd) { 2292 case DIOCSTART: 2293 sx_xlock(&pf_ioctl_lock); 2294 if (V_pf_status.running) 2295 error = EEXIST; 2296 else { 2297 int cpu; 2298 2299 hook_pf(); 2300 V_pf_status.running = 1; 2301 V_pf_status.since = time_second; 2302 2303 CPU_FOREACH(cpu) 2304 V_pf_stateid[cpu] = time_second; 2305 2306 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 2307 } 2308 break; 2309 2310 case DIOCSTOP: 2311 sx_xlock(&pf_ioctl_lock); 2312 if (!V_pf_status.running) 2313 error = ENOENT; 2314 else { 2315 V_pf_status.running = 0; 2316 dehook_pf(); 2317 V_pf_status.since = time_second; 2318 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 2319 } 2320 break; 2321 2322 case DIOCADDRULENV: { 2323 struct pfioc_nv *nv = (struct pfioc_nv *)addr; 2324 nvlist_t *nvl = NULL; 2325 void *nvlpacked = NULL; 2326 struct pf_krule *rule = NULL; 2327 const char *anchor = "", *anchor_call = ""; 2328 uint32_t ticket = 0, pool_ticket = 0; 2329 2330 #define ERROUT(x) ERROUT_IOCTL(DIOCADDRULENV_error, x) 2331 2332 if (nv->len > pf_ioctl_maxcount) 2333 ERROUT(ENOMEM); 2334 2335 nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK); 2336 error = copyin(nv->data, nvlpacked, nv->len); 2337 if (error) 2338 ERROUT(error); 2339 2340 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 2341 if (nvl == NULL) 2342 ERROUT(EBADMSG); 2343 2344 if (! nvlist_exists_number(nvl, "ticket")) 2345 ERROUT(EINVAL); 2346 ticket = nvlist_get_number(nvl, "ticket"); 2347 2348 if (! nvlist_exists_number(nvl, "pool_ticket")) 2349 ERROUT(EINVAL); 2350 pool_ticket = nvlist_get_number(nvl, "pool_ticket"); 2351 2352 if (! nvlist_exists_nvlist(nvl, "rule")) 2353 ERROUT(EINVAL); 2354 2355 rule = malloc(sizeof(*rule), M_PFRULE, M_WAITOK | M_ZERO); 2356 error = pf_nvrule_to_krule(nvlist_get_nvlist(nvl, "rule"), 2357 rule); 2358 if (error) 2359 ERROUT(error); 2360 2361 if (nvlist_exists_string(nvl, "anchor")) 2362 anchor = nvlist_get_string(nvl, "anchor"); 2363 if (nvlist_exists_string(nvl, "anchor_call")) 2364 anchor_call = nvlist_get_string(nvl, "anchor_call"); 2365 2366 if ((error = nvlist_error(nvl))) 2367 ERROUT(error); 2368 2369 /* Frees rule on error */ 2370 error = pf_ioctl_addrule(rule, ticket, pool_ticket, anchor, 2371 anchor_call, td); 2372 2373 nvlist_destroy(nvl); 2374 free(nvlpacked, M_TEMP); 2375 break; 2376 #undef ERROUT 2377 DIOCADDRULENV_error: 2378 pf_krule_free(rule); 2379 nvlist_destroy(nvl); 2380 free(nvlpacked, M_TEMP); 2381 2382 break; 2383 } 2384 case DIOCADDRULE: { 2385 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 2386 struct pf_krule *rule; 2387 2388 rule = malloc(sizeof(*rule), M_PFRULE, M_WAITOK | M_ZERO); 2389 error = pf_rule_to_krule(&pr->rule, rule); 2390 if (error != 0) { 2391 free(rule, M_PFRULE); 2392 break; 2393 } 2394 2395 pr->anchor[sizeof(pr->anchor) - 1] = 0; 2396 2397 /* Frees rule on error */ 2398 error = pf_ioctl_addrule(rule, pr->ticket, pr->pool_ticket, 2399 pr->anchor, pr->anchor_call, td); 2400 break; 2401 } 2402 2403 case DIOCGETRULES: { 2404 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 2405 struct pf_kruleset *ruleset; 2406 struct pf_krule *tail; 2407 int rs_num; 2408 2409 pr->anchor[sizeof(pr->anchor) - 1] = 0; 2410 2411 PF_RULES_WLOCK(); 2412 ruleset = pf_find_kruleset(pr->anchor); 2413 if (ruleset == NULL) { 2414 PF_RULES_WUNLOCK(); 2415 error = EINVAL; 2416 break; 2417 } 2418 rs_num = pf_get_ruleset_number(pr->rule.action); 2419 if (rs_num >= PF_RULESET_MAX) { 2420 PF_RULES_WUNLOCK(); 2421 error = EINVAL; 2422 break; 2423 } 2424 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 2425 pf_krulequeue); 2426 if (tail) 2427 pr->nr = tail->nr + 1; 2428 else 2429 pr->nr = 0; 2430 pr->ticket = ruleset->rules[rs_num].active.ticket; 2431 PF_RULES_WUNLOCK(); 2432 break; 2433 } 2434 2435 case DIOCGETRULE: { 2436 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 2437 struct pf_kruleset *ruleset; 2438 struct pf_krule *rule; 2439 int rs_num; 2440 2441 pr->anchor[sizeof(pr->anchor) - 1] = 0; 2442 2443 PF_RULES_WLOCK(); 2444 ruleset = pf_find_kruleset(pr->anchor); 2445 if (ruleset == NULL) { 2446 PF_RULES_WUNLOCK(); 2447 error = EINVAL; 2448 break; 2449 } 2450 rs_num = pf_get_ruleset_number(pr->rule.action); 2451 if (rs_num >= PF_RULESET_MAX) { 2452 PF_RULES_WUNLOCK(); 2453 error = EINVAL; 2454 break; 2455 } 2456 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 2457 PF_RULES_WUNLOCK(); 2458 error = EBUSY; 2459 break; 2460 } 2461 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 2462 while ((rule != NULL) && (rule->nr != pr->nr)) 2463 rule = TAILQ_NEXT(rule, entries); 2464 if (rule == NULL) { 2465 PF_RULES_WUNLOCK(); 2466 error = EBUSY; 2467 break; 2468 } 2469 2470 pf_krule_to_rule(rule, &pr->rule); 2471 2472 if (pf_kanchor_copyout(ruleset, rule, pr)) { 2473 PF_RULES_WUNLOCK(); 2474 error = EBUSY; 2475 break; 2476 } 2477 pf_addr_copyout(&pr->rule.src.addr); 2478 pf_addr_copyout(&pr->rule.dst.addr); 2479 2480 if (pr->action == PF_GET_CLR_CNTR) { 2481 pf_counter_u64_zero(&rule->evaluations); 2482 for (int i = 0; i < 2; i++) { 2483 pf_counter_u64_zero(&rule->packets[i]); 2484 pf_counter_u64_zero(&rule->bytes[i]); 2485 } 2486 counter_u64_zero(rule->states_tot); 2487 } 2488 PF_RULES_WUNLOCK(); 2489 break; 2490 } 2491 2492 case DIOCGETRULENV: { 2493 struct pfioc_nv *nv = (struct pfioc_nv *)addr; 2494 nvlist_t *nvrule = NULL; 2495 nvlist_t *nvl = NULL; 2496 struct pf_kruleset *ruleset; 2497 struct pf_krule *rule; 2498 void *nvlpacked = NULL; 2499 int rs_num, nr; 2500 bool clear_counter = false; 2501 2502 #define ERROUT(x) ERROUT_IOCTL(DIOCGETRULENV_error, x) 2503 2504 if (nv->len > pf_ioctl_maxcount) 2505 ERROUT(ENOMEM); 2506 2507 /* Copy the request in */ 2508 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 2509 if (nvlpacked == NULL) 2510 ERROUT(ENOMEM); 2511 2512 error = copyin(nv->data, nvlpacked, nv->len); 2513 if (error) 2514 ERROUT(error); 2515 2516 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 2517 if (nvl == NULL) 2518 ERROUT(EBADMSG); 2519 2520 if (! nvlist_exists_string(nvl, "anchor")) 2521 ERROUT(EBADMSG); 2522 if (! nvlist_exists_number(nvl, "ruleset")) 2523 ERROUT(EBADMSG); 2524 if (! nvlist_exists_number(nvl, "ticket")) 2525 ERROUT(EBADMSG); 2526 if (! nvlist_exists_number(nvl, "nr")) 2527 ERROUT(EBADMSG); 2528 2529 if (nvlist_exists_bool(nvl, "clear_counter")) 2530 clear_counter = nvlist_get_bool(nvl, "clear_counter"); 2531 2532 if (clear_counter && !(flags & FWRITE)) 2533 ERROUT(EACCES); 2534 2535 nr = nvlist_get_number(nvl, "nr"); 2536 2537 PF_RULES_WLOCK(); 2538 ruleset = pf_find_kruleset(nvlist_get_string(nvl, "anchor")); 2539 if (ruleset == NULL) { 2540 PF_RULES_WUNLOCK(); 2541 ERROUT(ENOENT); 2542 } 2543 2544 rs_num = pf_get_ruleset_number(nvlist_get_number(nvl, "ruleset")); 2545 if (rs_num >= PF_RULESET_MAX) { 2546 PF_RULES_WUNLOCK(); 2547 ERROUT(EINVAL); 2548 } 2549 2550 if (nvlist_get_number(nvl, "ticket") != 2551 ruleset->rules[rs_num].active.ticket) { 2552 PF_RULES_WUNLOCK(); 2553 ERROUT(EBUSY); 2554 } 2555 2556 if ((error = nvlist_error(nvl))) { 2557 PF_RULES_WUNLOCK(); 2558 ERROUT(error); 2559 } 2560 2561 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 2562 while ((rule != NULL) && (rule->nr != nr)) 2563 rule = TAILQ_NEXT(rule, entries); 2564 if (rule == NULL) { 2565 PF_RULES_WUNLOCK(); 2566 ERROUT(EBUSY); 2567 } 2568 2569 nvrule = pf_krule_to_nvrule(rule); 2570 2571 nvlist_destroy(nvl); 2572 nvl = nvlist_create(0); 2573 if (nvl == NULL) { 2574 PF_RULES_WUNLOCK(); 2575 ERROUT(ENOMEM); 2576 } 2577 nvlist_add_number(nvl, "nr", nr); 2578 nvlist_add_nvlist(nvl, "rule", nvrule); 2579 nvlist_destroy(nvrule); 2580 nvrule = NULL; 2581 if (pf_kanchor_nvcopyout(ruleset, rule, nvl)) { 2582 PF_RULES_WUNLOCK(); 2583 ERROUT(EBUSY); 2584 } 2585 2586 free(nvlpacked, M_NVLIST); 2587 nvlpacked = nvlist_pack(nvl, &nv->len); 2588 if (nvlpacked == NULL) { 2589 PF_RULES_WUNLOCK(); 2590 ERROUT(ENOMEM); 2591 } 2592 2593 if (nv->size == 0) { 2594 PF_RULES_WUNLOCK(); 2595 ERROUT(0); 2596 } 2597 else if (nv->size < nv->len) { 2598 PF_RULES_WUNLOCK(); 2599 ERROUT(ENOSPC); 2600 } 2601 2602 if (clear_counter) { 2603 pf_counter_u64_zero(&rule->evaluations); 2604 for (int i = 0; i < 2; i++) { 2605 pf_counter_u64_zero(&rule->packets[i]); 2606 pf_counter_u64_zero(&rule->bytes[i]); 2607 } 2608 counter_u64_zero(rule->states_tot); 2609 } 2610 PF_RULES_WUNLOCK(); 2611 2612 error = copyout(nvlpacked, nv->data, nv->len); 2613 2614 #undef ERROUT 2615 DIOCGETRULENV_error: 2616 free(nvlpacked, M_NVLIST); 2617 nvlist_destroy(nvrule); 2618 nvlist_destroy(nvl); 2619 2620 break; 2621 } 2622 2623 case DIOCCHANGERULE: { 2624 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 2625 struct pf_kruleset *ruleset; 2626 struct pf_krule *oldrule = NULL, *newrule = NULL; 2627 struct pfi_kkif *kif = NULL; 2628 struct pf_kpooladdr *pa; 2629 u_int32_t nr = 0; 2630 int rs_num; 2631 2632 pcr->anchor[sizeof(pcr->anchor) - 1] = 0; 2633 2634 if (pcr->action < PF_CHANGE_ADD_HEAD || 2635 pcr->action > PF_CHANGE_GET_TICKET) { 2636 error = EINVAL; 2637 break; 2638 } 2639 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 2640 error = EINVAL; 2641 break; 2642 } 2643 2644 if (pcr->action != PF_CHANGE_REMOVE) { 2645 newrule = malloc(sizeof(*newrule), M_PFRULE, M_WAITOK | M_ZERO); 2646 error = pf_rule_to_krule(&pcr->rule, newrule); 2647 if (error != 0) { 2648 free(newrule, M_PFRULE); 2649 break; 2650 } 2651 2652 if (newrule->ifname[0]) 2653 kif = pf_kkif_create(M_WAITOK); 2654 pf_counter_u64_init(&newrule->evaluations, M_WAITOK); 2655 for (int i = 0; i < 2; i++) { 2656 pf_counter_u64_init(&newrule->packets[i], M_WAITOK); 2657 pf_counter_u64_init(&newrule->bytes[i], M_WAITOK); 2658 } 2659 newrule->states_cur = counter_u64_alloc(M_WAITOK); 2660 newrule->states_tot = counter_u64_alloc(M_WAITOK); 2661 newrule->src_nodes = counter_u64_alloc(M_WAITOK); 2662 newrule->cuid = td->td_ucred->cr_ruid; 2663 newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 2664 TAILQ_INIT(&newrule->rpool.list); 2665 } 2666 #define ERROUT(x) { error = (x); goto DIOCCHANGERULE_error; } 2667 2668 PF_RULES_WLOCK(); 2669 #ifdef PF_WANT_32_TO_64_COUNTER 2670 if (newrule != NULL) { 2671 LIST_INSERT_HEAD(&V_pf_allrulelist, newrule, allrulelist); 2672 newrule->allrulelinked = true; 2673 V_pf_allrulecount++; 2674 } 2675 #endif 2676 2677 if (!(pcr->action == PF_CHANGE_REMOVE || 2678 pcr->action == PF_CHANGE_GET_TICKET) && 2679 pcr->pool_ticket != V_ticket_pabuf) 2680 ERROUT(EBUSY); 2681 2682 ruleset = pf_find_kruleset(pcr->anchor); 2683 if (ruleset == NULL) 2684 ERROUT(EINVAL); 2685 2686 rs_num = pf_get_ruleset_number(pcr->rule.action); 2687 if (rs_num >= PF_RULESET_MAX) 2688 ERROUT(EINVAL); 2689 2690 if (pcr->action == PF_CHANGE_GET_TICKET) { 2691 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 2692 ERROUT(0); 2693 } else if (pcr->ticket != 2694 ruleset->rules[rs_num].active.ticket) 2695 ERROUT(EINVAL); 2696 2697 if (pcr->action != PF_CHANGE_REMOVE) { 2698 if (newrule->ifname[0]) { 2699 newrule->kif = pfi_kkif_attach(kif, 2700 newrule->ifname); 2701 kif = NULL; 2702 pfi_kkif_ref(newrule->kif); 2703 } else 2704 newrule->kif = NULL; 2705 2706 if (newrule->rtableid > 0 && 2707 newrule->rtableid >= rt_numfibs) 2708 error = EBUSY; 2709 2710 #ifdef ALTQ 2711 /* set queue IDs */ 2712 if (newrule->qname[0] != 0) { 2713 if ((newrule->qid = 2714 pf_qname2qid(newrule->qname)) == 0) 2715 error = EBUSY; 2716 else if (newrule->pqname[0] != 0) { 2717 if ((newrule->pqid = 2718 pf_qname2qid(newrule->pqname)) == 0) 2719 error = EBUSY; 2720 } else 2721 newrule->pqid = newrule->qid; 2722 } 2723 #endif /* ALTQ */ 2724 if (newrule->tagname[0]) 2725 if ((newrule->tag = 2726 pf_tagname2tag(newrule->tagname)) == 0) 2727 error = EBUSY; 2728 if (newrule->match_tagname[0]) 2729 if ((newrule->match_tag = pf_tagname2tag( 2730 newrule->match_tagname)) == 0) 2731 error = EBUSY; 2732 if (newrule->rt && !newrule->direction) 2733 error = EINVAL; 2734 if (!newrule->log) 2735 newrule->logif = 0; 2736 if (newrule->logif >= PFLOGIFS_MAX) 2737 error = EINVAL; 2738 if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af)) 2739 error = ENOMEM; 2740 if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af)) 2741 error = ENOMEM; 2742 if (pf_kanchor_setup(newrule, ruleset, pcr->anchor_call)) 2743 error = EINVAL; 2744 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 2745 if (pa->addr.type == PF_ADDR_TABLE) { 2746 pa->addr.p.tbl = 2747 pfr_attach_table(ruleset, 2748 pa->addr.v.tblname); 2749 if (pa->addr.p.tbl == NULL) 2750 error = ENOMEM; 2751 } 2752 2753 newrule->overload_tbl = NULL; 2754 if (newrule->overload_tblname[0]) { 2755 if ((newrule->overload_tbl = pfr_attach_table( 2756 ruleset, newrule->overload_tblname)) == 2757 NULL) 2758 error = EINVAL; 2759 else 2760 newrule->overload_tbl->pfrkt_flags |= 2761 PFR_TFLAG_ACTIVE; 2762 } 2763 2764 pf_mv_kpool(&V_pf_pabuf, &newrule->rpool.list); 2765 if (((((newrule->action == PF_NAT) || 2766 (newrule->action == PF_RDR) || 2767 (newrule->action == PF_BINAT) || 2768 (newrule->rt > PF_NOPFROUTE)) && 2769 !newrule->anchor)) && 2770 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 2771 error = EINVAL; 2772 2773 if (error) { 2774 pf_free_rule(newrule); 2775 PF_RULES_WUNLOCK(); 2776 break; 2777 } 2778 2779 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 2780 } 2781 pf_empty_kpool(&V_pf_pabuf); 2782 2783 if (pcr->action == PF_CHANGE_ADD_HEAD) 2784 oldrule = TAILQ_FIRST( 2785 ruleset->rules[rs_num].active.ptr); 2786 else if (pcr->action == PF_CHANGE_ADD_TAIL) 2787 oldrule = TAILQ_LAST( 2788 ruleset->rules[rs_num].active.ptr, pf_krulequeue); 2789 else { 2790 oldrule = TAILQ_FIRST( 2791 ruleset->rules[rs_num].active.ptr); 2792 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 2793 oldrule = TAILQ_NEXT(oldrule, entries); 2794 if (oldrule == NULL) { 2795 if (newrule != NULL) 2796 pf_free_rule(newrule); 2797 PF_RULES_WUNLOCK(); 2798 error = EINVAL; 2799 break; 2800 } 2801 } 2802 2803 if (pcr->action == PF_CHANGE_REMOVE) { 2804 pf_unlink_rule(ruleset->rules[rs_num].active.ptr, 2805 oldrule); 2806 ruleset->rules[rs_num].active.rcount--; 2807 } else { 2808 if (oldrule == NULL) 2809 TAILQ_INSERT_TAIL( 2810 ruleset->rules[rs_num].active.ptr, 2811 newrule, entries); 2812 else if (pcr->action == PF_CHANGE_ADD_HEAD || 2813 pcr->action == PF_CHANGE_ADD_BEFORE) 2814 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 2815 else 2816 TAILQ_INSERT_AFTER( 2817 ruleset->rules[rs_num].active.ptr, 2818 oldrule, newrule, entries); 2819 ruleset->rules[rs_num].active.rcount++; 2820 } 2821 2822 nr = 0; 2823 TAILQ_FOREACH(oldrule, 2824 ruleset->rules[rs_num].active.ptr, entries) 2825 oldrule->nr = nr++; 2826 2827 ruleset->rules[rs_num].active.ticket++; 2828 2829 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 2830 pf_remove_if_empty_kruleset(ruleset); 2831 2832 PF_RULES_WUNLOCK(); 2833 break; 2834 2835 #undef ERROUT 2836 DIOCCHANGERULE_error: 2837 PF_RULES_WUNLOCK(); 2838 pf_krule_free(newrule); 2839 pf_kkif_free(kif); 2840 break; 2841 } 2842 2843 case DIOCCLRSTATES: { 2844 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 2845 struct pf_kstate_kill kill; 2846 2847 error = pf_state_kill_to_kstate_kill(psk, &kill); 2848 if (error) 2849 break; 2850 2851 psk->psk_killed = pf_clear_states(&kill); 2852 break; 2853 } 2854 2855 case DIOCCLRSTATESNV: { 2856 error = pf_clearstates_nv((struct pfioc_nv *)addr); 2857 break; 2858 } 2859 2860 case DIOCKILLSTATES: { 2861 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 2862 struct pf_kstate_kill kill; 2863 2864 error = pf_state_kill_to_kstate_kill(psk, &kill); 2865 if (error) 2866 break; 2867 2868 psk->psk_killed = 0; 2869 pf_killstates(&kill, &psk->psk_killed); 2870 break; 2871 } 2872 2873 case DIOCKILLSTATESNV: { 2874 error = pf_killstates_nv((struct pfioc_nv *)addr); 2875 break; 2876 } 2877 2878 case DIOCADDSTATE: { 2879 struct pfioc_state *ps = (struct pfioc_state *)addr; 2880 struct pfsync_state *sp = &ps->state; 2881 2882 if (sp->timeout >= PFTM_MAX) { 2883 error = EINVAL; 2884 break; 2885 } 2886 if (V_pfsync_state_import_ptr != NULL) { 2887 PF_RULES_RLOCK(); 2888 error = V_pfsync_state_import_ptr(sp, PFSYNC_SI_IOCTL); 2889 PF_RULES_RUNLOCK(); 2890 } else 2891 error = EOPNOTSUPP; 2892 break; 2893 } 2894 2895 case DIOCGETSTATE: { 2896 struct pfioc_state *ps = (struct pfioc_state *)addr; 2897 struct pf_kstate *s; 2898 2899 s = pf_find_state_byid(ps->state.id, ps->state.creatorid); 2900 if (s == NULL) { 2901 error = ENOENT; 2902 break; 2903 } 2904 2905 pfsync_state_export(&ps->state, s); 2906 PF_STATE_UNLOCK(s); 2907 break; 2908 } 2909 2910 case DIOCGETSTATENV: { 2911 error = pf_getstate((struct pfioc_nv *)addr); 2912 break; 2913 } 2914 2915 case DIOCGETSTATES: { 2916 struct pfioc_states *ps = (struct pfioc_states *)addr; 2917 struct pf_kstate *s; 2918 struct pfsync_state *pstore, *p; 2919 int i, nr; 2920 size_t slice_count = 16, count; 2921 void *out; 2922 2923 if (ps->ps_len <= 0) { 2924 nr = uma_zone_get_cur(V_pf_state_z); 2925 ps->ps_len = sizeof(struct pfsync_state) * nr; 2926 break; 2927 } 2928 2929 out = ps->ps_states; 2930 pstore = mallocarray(slice_count, 2931 sizeof(struct pfsync_state), M_TEMP, M_WAITOK | M_ZERO); 2932 nr = 0; 2933 2934 for (i = 0; i <= pf_hashmask; i++) { 2935 struct pf_idhash *ih = &V_pf_idhash[i]; 2936 2937 DIOCGETSTATES_retry: 2938 p = pstore; 2939 2940 if (LIST_EMPTY(&ih->states)) 2941 continue; 2942 2943 PF_HASHROW_LOCK(ih); 2944 count = 0; 2945 LIST_FOREACH(s, &ih->states, entry) { 2946 if (s->timeout == PFTM_UNLINKED) 2947 continue; 2948 count++; 2949 } 2950 2951 if (count > slice_count) { 2952 PF_HASHROW_UNLOCK(ih); 2953 free(pstore, M_TEMP); 2954 slice_count = count * 2; 2955 pstore = mallocarray(slice_count, 2956 sizeof(struct pfsync_state), M_TEMP, 2957 M_WAITOK | M_ZERO); 2958 goto DIOCGETSTATES_retry; 2959 } 2960 2961 if ((nr+count) * sizeof(*p) > ps->ps_len) { 2962 PF_HASHROW_UNLOCK(ih); 2963 goto DIOCGETSTATES_full; 2964 } 2965 2966 LIST_FOREACH(s, &ih->states, entry) { 2967 if (s->timeout == PFTM_UNLINKED) 2968 continue; 2969 2970 pfsync_state_export(p, s); 2971 p++; 2972 nr++; 2973 } 2974 PF_HASHROW_UNLOCK(ih); 2975 error = copyout(pstore, out, 2976 sizeof(struct pfsync_state) * count); 2977 if (error) 2978 break; 2979 out = ps->ps_states + nr; 2980 } 2981 DIOCGETSTATES_full: 2982 ps->ps_len = sizeof(struct pfsync_state) * nr; 2983 free(pstore, M_TEMP); 2984 2985 break; 2986 } 2987 2988 case DIOCGETSTATESV2: { 2989 struct pfioc_states_v2 *ps = (struct pfioc_states_v2 *)addr; 2990 struct pf_kstate *s; 2991 struct pf_state_export *pstore, *p; 2992 int i, nr; 2993 size_t slice_count = 16, count; 2994 void *out; 2995 2996 if (ps->ps_req_version > PF_STATE_VERSION) { 2997 error = ENOTSUP; 2998 break; 2999 } 3000 3001 if (ps->ps_len <= 0) { 3002 nr = uma_zone_get_cur(V_pf_state_z); 3003 ps->ps_len = sizeof(struct pf_state_export) * nr; 3004 break; 3005 } 3006 3007 out = ps->ps_states; 3008 pstore = mallocarray(slice_count, 3009 sizeof(struct pf_state_export), M_TEMP, M_WAITOK | M_ZERO); 3010 nr = 0; 3011 3012 for (i = 0; i <= pf_hashmask; i++) { 3013 struct pf_idhash *ih = &V_pf_idhash[i]; 3014 3015 DIOCGETSTATESV2_retry: 3016 p = pstore; 3017 3018 if (LIST_EMPTY(&ih->states)) 3019 continue; 3020 3021 PF_HASHROW_LOCK(ih); 3022 count = 0; 3023 LIST_FOREACH(s, &ih->states, entry) { 3024 if (s->timeout == PFTM_UNLINKED) 3025 continue; 3026 count++; 3027 } 3028 3029 if (count > slice_count) { 3030 PF_HASHROW_UNLOCK(ih); 3031 free(pstore, M_TEMP); 3032 slice_count = count * 2; 3033 pstore = mallocarray(slice_count, 3034 sizeof(struct pf_state_export), M_TEMP, 3035 M_WAITOK | M_ZERO); 3036 goto DIOCGETSTATESV2_retry; 3037 } 3038 3039 if ((nr+count) * sizeof(*p) > ps->ps_len) { 3040 PF_HASHROW_UNLOCK(ih); 3041 goto DIOCGETSTATESV2_full; 3042 } 3043 3044 LIST_FOREACH(s, &ih->states, entry) { 3045 if (s->timeout == PFTM_UNLINKED) 3046 continue; 3047 3048 pf_state_export(p, s); 3049 p++; 3050 nr++; 3051 } 3052 PF_HASHROW_UNLOCK(ih); 3053 error = copyout(pstore, out, 3054 sizeof(struct pf_state_export) * count); 3055 if (error) 3056 break; 3057 out = ps->ps_states + nr; 3058 } 3059 DIOCGETSTATESV2_full: 3060 ps->ps_len = nr * sizeof(struct pf_state_export); 3061 free(pstore, M_TEMP); 3062 3063 break; 3064 } 3065 3066 case DIOCGETSTATUS: { 3067 struct pf_status *s = (struct pf_status *)addr; 3068 3069 PF_RULES_RLOCK(); 3070 s->running = V_pf_status.running; 3071 s->since = V_pf_status.since; 3072 s->debug = V_pf_status.debug; 3073 s->hostid = V_pf_status.hostid; 3074 s->states = V_pf_status.states; 3075 s->src_nodes = V_pf_status.src_nodes; 3076 3077 for (int i = 0; i < PFRES_MAX; i++) 3078 s->counters[i] = 3079 counter_u64_fetch(V_pf_status.counters[i]); 3080 for (int i = 0; i < LCNT_MAX; i++) 3081 s->lcounters[i] = 3082 counter_u64_fetch(V_pf_status.lcounters[i]); 3083 for (int i = 0; i < FCNT_MAX; i++) 3084 s->fcounters[i] = 3085 pf_counter_u64_fetch(&V_pf_status.fcounters[i]); 3086 for (int i = 0; i < SCNT_MAX; i++) 3087 s->scounters[i] = 3088 counter_u64_fetch(V_pf_status.scounters[i]); 3089 3090 bcopy(V_pf_status.ifname, s->ifname, IFNAMSIZ); 3091 bcopy(V_pf_status.pf_chksum, s->pf_chksum, 3092 PF_MD5_DIGEST_LENGTH); 3093 3094 pfi_update_status(s->ifname, s); 3095 PF_RULES_RUNLOCK(); 3096 break; 3097 } 3098 3099 case DIOCSETSTATUSIF: { 3100 struct pfioc_if *pi = (struct pfioc_if *)addr; 3101 3102 if (pi->ifname[0] == 0) { 3103 bzero(V_pf_status.ifname, IFNAMSIZ); 3104 break; 3105 } 3106 PF_RULES_WLOCK(); 3107 error = pf_user_strcpy(V_pf_status.ifname, pi->ifname, IFNAMSIZ); 3108 PF_RULES_WUNLOCK(); 3109 break; 3110 } 3111 3112 case DIOCCLRSTATUS: { 3113 PF_RULES_WLOCK(); 3114 for (int i = 0; i < PFRES_MAX; i++) 3115 counter_u64_zero(V_pf_status.counters[i]); 3116 for (int i = 0; i < FCNT_MAX; i++) 3117 pf_counter_u64_zero(&V_pf_status.fcounters[i]); 3118 for (int i = 0; i < SCNT_MAX; i++) 3119 counter_u64_zero(V_pf_status.scounters[i]); 3120 for (int i = 0; i < LCNT_MAX; i++) 3121 counter_u64_zero(V_pf_status.lcounters[i]); 3122 V_pf_status.since = time_second; 3123 if (*V_pf_status.ifname) 3124 pfi_update_status(V_pf_status.ifname, NULL); 3125 PF_RULES_WUNLOCK(); 3126 break; 3127 } 3128 3129 case DIOCNATLOOK: { 3130 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 3131 struct pf_state_key *sk; 3132 struct pf_kstate *state; 3133 struct pf_state_key_cmp key; 3134 int m = 0, direction = pnl->direction; 3135 int sidx, didx; 3136 3137 /* NATLOOK src and dst are reversed, so reverse sidx/didx */ 3138 sidx = (direction == PF_IN) ? 1 : 0; 3139 didx = (direction == PF_IN) ? 0 : 1; 3140 3141 if (!pnl->proto || 3142 PF_AZERO(&pnl->saddr, pnl->af) || 3143 PF_AZERO(&pnl->daddr, pnl->af) || 3144 ((pnl->proto == IPPROTO_TCP || 3145 pnl->proto == IPPROTO_UDP) && 3146 (!pnl->dport || !pnl->sport))) 3147 error = EINVAL; 3148 else { 3149 bzero(&key, sizeof(key)); 3150 key.af = pnl->af; 3151 key.proto = pnl->proto; 3152 PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af); 3153 key.port[sidx] = pnl->sport; 3154 PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af); 3155 key.port[didx] = pnl->dport; 3156 3157 state = pf_find_state_all(&key, direction, &m); 3158 3159 if (m > 1) 3160 error = E2BIG; /* more than one state */ 3161 else if (state != NULL) { 3162 /* XXXGL: not locked read */ 3163 sk = state->key[sidx]; 3164 PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af); 3165 pnl->rsport = sk->port[sidx]; 3166 PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af); 3167 pnl->rdport = sk->port[didx]; 3168 } else 3169 error = ENOENT; 3170 } 3171 break; 3172 } 3173 3174 case DIOCSETTIMEOUT: { 3175 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 3176 int old; 3177 3178 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 3179 pt->seconds < 0) { 3180 error = EINVAL; 3181 break; 3182 } 3183 PF_RULES_WLOCK(); 3184 old = V_pf_default_rule.timeout[pt->timeout]; 3185 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 3186 pt->seconds = 1; 3187 V_pf_default_rule.timeout[pt->timeout] = pt->seconds; 3188 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 3189 wakeup(pf_purge_thread); 3190 pt->seconds = old; 3191 PF_RULES_WUNLOCK(); 3192 break; 3193 } 3194 3195 case DIOCGETTIMEOUT: { 3196 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 3197 3198 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 3199 error = EINVAL; 3200 break; 3201 } 3202 PF_RULES_RLOCK(); 3203 pt->seconds = V_pf_default_rule.timeout[pt->timeout]; 3204 PF_RULES_RUNLOCK(); 3205 break; 3206 } 3207 3208 case DIOCGETLIMIT: { 3209 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 3210 3211 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 3212 error = EINVAL; 3213 break; 3214 } 3215 PF_RULES_RLOCK(); 3216 pl->limit = V_pf_limits[pl->index].limit; 3217 PF_RULES_RUNLOCK(); 3218 break; 3219 } 3220 3221 case DIOCSETLIMIT: { 3222 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 3223 int old_limit; 3224 3225 PF_RULES_WLOCK(); 3226 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 3227 V_pf_limits[pl->index].zone == NULL) { 3228 PF_RULES_WUNLOCK(); 3229 error = EINVAL; 3230 break; 3231 } 3232 uma_zone_set_max(V_pf_limits[pl->index].zone, pl->limit); 3233 old_limit = V_pf_limits[pl->index].limit; 3234 V_pf_limits[pl->index].limit = pl->limit; 3235 pl->limit = old_limit; 3236 PF_RULES_WUNLOCK(); 3237 break; 3238 } 3239 3240 case DIOCSETDEBUG: { 3241 u_int32_t *level = (u_int32_t *)addr; 3242 3243 PF_RULES_WLOCK(); 3244 V_pf_status.debug = *level; 3245 PF_RULES_WUNLOCK(); 3246 break; 3247 } 3248 3249 case DIOCCLRRULECTRS: { 3250 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 3251 struct pf_kruleset *ruleset = &pf_main_ruleset; 3252 struct pf_krule *rule; 3253 3254 PF_RULES_WLOCK(); 3255 TAILQ_FOREACH(rule, 3256 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 3257 pf_counter_u64_zero(&rule->evaluations); 3258 for (int i = 0; i < 2; i++) { 3259 pf_counter_u64_zero(&rule->packets[i]); 3260 pf_counter_u64_zero(&rule->bytes[i]); 3261 } 3262 } 3263 PF_RULES_WUNLOCK(); 3264 break; 3265 } 3266 3267 case DIOCGIFSPEEDV0: 3268 case DIOCGIFSPEEDV1: { 3269 struct pf_ifspeed_v1 *psp = (struct pf_ifspeed_v1 *)addr; 3270 struct pf_ifspeed_v1 ps; 3271 struct ifnet *ifp; 3272 3273 if (psp->ifname[0] == '\0') { 3274 error = EINVAL; 3275 break; 3276 } 3277 3278 error = pf_user_strcpy(ps.ifname, psp->ifname, IFNAMSIZ); 3279 if (error != 0) 3280 break; 3281 ifp = ifunit(ps.ifname); 3282 if (ifp != NULL) { 3283 psp->baudrate32 = 3284 (u_int32_t)uqmin(ifp->if_baudrate, UINT_MAX); 3285 if (cmd == DIOCGIFSPEEDV1) 3286 psp->baudrate = ifp->if_baudrate; 3287 } else { 3288 error = EINVAL; 3289 } 3290 break; 3291 } 3292 3293 #ifdef ALTQ 3294 case DIOCSTARTALTQ: { 3295 struct pf_altq *altq; 3296 3297 PF_RULES_WLOCK(); 3298 /* enable all altq interfaces on active list */ 3299 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 3300 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 3301 error = pf_enable_altq(altq); 3302 if (error != 0) 3303 break; 3304 } 3305 } 3306 if (error == 0) 3307 V_pf_altq_running = 1; 3308 PF_RULES_WUNLOCK(); 3309 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 3310 break; 3311 } 3312 3313 case DIOCSTOPALTQ: { 3314 struct pf_altq *altq; 3315 3316 PF_RULES_WLOCK(); 3317 /* disable all altq interfaces on active list */ 3318 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 3319 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 3320 error = pf_disable_altq(altq); 3321 if (error != 0) 3322 break; 3323 } 3324 } 3325 if (error == 0) 3326 V_pf_altq_running = 0; 3327 PF_RULES_WUNLOCK(); 3328 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 3329 break; 3330 } 3331 3332 case DIOCADDALTQV0: 3333 case DIOCADDALTQV1: { 3334 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr; 3335 struct pf_altq *altq, *a; 3336 struct ifnet *ifp; 3337 3338 altq = malloc(sizeof(*altq), M_PFALTQ, M_WAITOK | M_ZERO); 3339 error = pf_import_kaltq(pa, altq, IOCPARM_LEN(cmd)); 3340 if (error) 3341 break; 3342 altq->local_flags = 0; 3343 3344 PF_RULES_WLOCK(); 3345 if (pa->ticket != V_ticket_altqs_inactive) { 3346 PF_RULES_WUNLOCK(); 3347 free(altq, M_PFALTQ); 3348 error = EBUSY; 3349 break; 3350 } 3351 3352 /* 3353 * if this is for a queue, find the discipline and 3354 * copy the necessary fields 3355 */ 3356 if (altq->qname[0] != 0) { 3357 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 3358 PF_RULES_WUNLOCK(); 3359 error = EBUSY; 3360 free(altq, M_PFALTQ); 3361 break; 3362 } 3363 altq->altq_disc = NULL; 3364 TAILQ_FOREACH(a, V_pf_altq_ifs_inactive, entries) { 3365 if (strncmp(a->ifname, altq->ifname, 3366 IFNAMSIZ) == 0) { 3367 altq->altq_disc = a->altq_disc; 3368 break; 3369 } 3370 } 3371 } 3372 3373 if ((ifp = ifunit(altq->ifname)) == NULL) 3374 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED; 3375 else 3376 error = altq_add(ifp, altq); 3377 3378 if (error) { 3379 PF_RULES_WUNLOCK(); 3380 free(altq, M_PFALTQ); 3381 break; 3382 } 3383 3384 if (altq->qname[0] != 0) 3385 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, altq, entries); 3386 else 3387 TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, altq, entries); 3388 /* version error check done on import above */ 3389 pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd)); 3390 PF_RULES_WUNLOCK(); 3391 break; 3392 } 3393 3394 case DIOCGETALTQSV0: 3395 case DIOCGETALTQSV1: { 3396 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr; 3397 struct pf_altq *altq; 3398 3399 PF_RULES_RLOCK(); 3400 pa->nr = 0; 3401 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) 3402 pa->nr++; 3403 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) 3404 pa->nr++; 3405 pa->ticket = V_ticket_altqs_active; 3406 PF_RULES_RUNLOCK(); 3407 break; 3408 } 3409 3410 case DIOCGETALTQV0: 3411 case DIOCGETALTQV1: { 3412 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr; 3413 struct pf_altq *altq; 3414 3415 PF_RULES_RLOCK(); 3416 if (pa->ticket != V_ticket_altqs_active) { 3417 PF_RULES_RUNLOCK(); 3418 error = EBUSY; 3419 break; 3420 } 3421 altq = pf_altq_get_nth_active(pa->nr); 3422 if (altq == NULL) { 3423 PF_RULES_RUNLOCK(); 3424 error = EBUSY; 3425 break; 3426 } 3427 pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd)); 3428 PF_RULES_RUNLOCK(); 3429 break; 3430 } 3431 3432 case DIOCCHANGEALTQV0: 3433 case DIOCCHANGEALTQV1: 3434 /* CHANGEALTQ not supported yet! */ 3435 error = ENODEV; 3436 break; 3437 3438 case DIOCGETQSTATSV0: 3439 case DIOCGETQSTATSV1: { 3440 struct pfioc_qstats_v1 *pq = (struct pfioc_qstats_v1 *)addr; 3441 struct pf_altq *altq; 3442 int nbytes; 3443 u_int32_t version; 3444 3445 PF_RULES_RLOCK(); 3446 if (pq->ticket != V_ticket_altqs_active) { 3447 PF_RULES_RUNLOCK(); 3448 error = EBUSY; 3449 break; 3450 } 3451 nbytes = pq->nbytes; 3452 altq = pf_altq_get_nth_active(pq->nr); 3453 if (altq == NULL) { 3454 PF_RULES_RUNLOCK(); 3455 error = EBUSY; 3456 break; 3457 } 3458 3459 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) != 0) { 3460 PF_RULES_RUNLOCK(); 3461 error = ENXIO; 3462 break; 3463 } 3464 PF_RULES_RUNLOCK(); 3465 if (cmd == DIOCGETQSTATSV0) 3466 version = 0; /* DIOCGETQSTATSV0 means stats struct v0 */ 3467 else 3468 version = pq->version; 3469 error = altq_getqstats(altq, pq->buf, &nbytes, version); 3470 if (error == 0) { 3471 pq->scheduler = altq->scheduler; 3472 pq->nbytes = nbytes; 3473 } 3474 break; 3475 } 3476 #endif /* ALTQ */ 3477 3478 case DIOCBEGINADDRS: { 3479 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3480 3481 PF_RULES_WLOCK(); 3482 pf_empty_kpool(&V_pf_pabuf); 3483 pp->ticket = ++V_ticket_pabuf; 3484 PF_RULES_WUNLOCK(); 3485 break; 3486 } 3487 3488 case DIOCADDADDR: { 3489 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3490 struct pf_kpooladdr *pa; 3491 struct pfi_kkif *kif = NULL; 3492 3493 #ifndef INET 3494 if (pp->af == AF_INET) { 3495 error = EAFNOSUPPORT; 3496 break; 3497 } 3498 #endif /* INET */ 3499 #ifndef INET6 3500 if (pp->af == AF_INET6) { 3501 error = EAFNOSUPPORT; 3502 break; 3503 } 3504 #endif /* INET6 */ 3505 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 3506 pp->addr.addr.type != PF_ADDR_DYNIFTL && 3507 pp->addr.addr.type != PF_ADDR_TABLE) { 3508 error = EINVAL; 3509 break; 3510 } 3511 if (pp->addr.addr.p.dyn != NULL) { 3512 error = EINVAL; 3513 break; 3514 } 3515 pa = malloc(sizeof(*pa), M_PFRULE, M_WAITOK); 3516 error = pf_pooladdr_to_kpooladdr(&pp->addr, pa); 3517 if (error != 0) 3518 break; 3519 if (pa->ifname[0]) 3520 kif = pf_kkif_create(M_WAITOK); 3521 PF_RULES_WLOCK(); 3522 if (pp->ticket != V_ticket_pabuf) { 3523 PF_RULES_WUNLOCK(); 3524 if (pa->ifname[0]) 3525 pf_kkif_free(kif); 3526 free(pa, M_PFRULE); 3527 error = EBUSY; 3528 break; 3529 } 3530 if (pa->ifname[0]) { 3531 pa->kif = pfi_kkif_attach(kif, pa->ifname); 3532 kif = NULL; 3533 pfi_kkif_ref(pa->kif); 3534 } else 3535 pa->kif = NULL; 3536 if (pa->addr.type == PF_ADDR_DYNIFTL && ((error = 3537 pfi_dynaddr_setup(&pa->addr, pp->af)) != 0)) { 3538 if (pa->ifname[0]) 3539 pfi_kkif_unref(pa->kif); 3540 PF_RULES_WUNLOCK(); 3541 free(pa, M_PFRULE); 3542 break; 3543 } 3544 TAILQ_INSERT_TAIL(&V_pf_pabuf, pa, entries); 3545 PF_RULES_WUNLOCK(); 3546 break; 3547 } 3548 3549 case DIOCGETADDRS: { 3550 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3551 struct pf_kpool *pool; 3552 struct pf_kpooladdr *pa; 3553 3554 pp->anchor[sizeof(pp->anchor) - 1] = 0; 3555 pp->nr = 0; 3556 3557 PF_RULES_RLOCK(); 3558 pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, 3559 pp->r_num, 0, 1, 0); 3560 if (pool == NULL) { 3561 PF_RULES_RUNLOCK(); 3562 error = EBUSY; 3563 break; 3564 } 3565 TAILQ_FOREACH(pa, &pool->list, entries) 3566 pp->nr++; 3567 PF_RULES_RUNLOCK(); 3568 break; 3569 } 3570 3571 case DIOCGETADDR: { 3572 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3573 struct pf_kpool *pool; 3574 struct pf_kpooladdr *pa; 3575 u_int32_t nr = 0; 3576 3577 pp->anchor[sizeof(pp->anchor) - 1] = 0; 3578 3579 PF_RULES_RLOCK(); 3580 pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, 3581 pp->r_num, 0, 1, 1); 3582 if (pool == NULL) { 3583 PF_RULES_RUNLOCK(); 3584 error = EBUSY; 3585 break; 3586 } 3587 pa = TAILQ_FIRST(&pool->list); 3588 while ((pa != NULL) && (nr < pp->nr)) { 3589 pa = TAILQ_NEXT(pa, entries); 3590 nr++; 3591 } 3592 if (pa == NULL) { 3593 PF_RULES_RUNLOCK(); 3594 error = EBUSY; 3595 break; 3596 } 3597 pf_kpooladdr_to_pooladdr(pa, &pp->addr); 3598 pf_addr_copyout(&pp->addr.addr); 3599 PF_RULES_RUNLOCK(); 3600 break; 3601 } 3602 3603 case DIOCCHANGEADDR: { 3604 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 3605 struct pf_kpool *pool; 3606 struct pf_kpooladdr *oldpa = NULL, *newpa = NULL; 3607 struct pf_kruleset *ruleset; 3608 struct pfi_kkif *kif = NULL; 3609 3610 pca->anchor[sizeof(pca->anchor) - 1] = 0; 3611 3612 if (pca->action < PF_CHANGE_ADD_HEAD || 3613 pca->action > PF_CHANGE_REMOVE) { 3614 error = EINVAL; 3615 break; 3616 } 3617 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 3618 pca->addr.addr.type != PF_ADDR_DYNIFTL && 3619 pca->addr.addr.type != PF_ADDR_TABLE) { 3620 error = EINVAL; 3621 break; 3622 } 3623 if (pca->addr.addr.p.dyn != NULL) { 3624 error = EINVAL; 3625 break; 3626 } 3627 3628 if (pca->action != PF_CHANGE_REMOVE) { 3629 #ifndef INET 3630 if (pca->af == AF_INET) { 3631 error = EAFNOSUPPORT; 3632 break; 3633 } 3634 #endif /* INET */ 3635 #ifndef INET6 3636 if (pca->af == AF_INET6) { 3637 error = EAFNOSUPPORT; 3638 break; 3639 } 3640 #endif /* INET6 */ 3641 newpa = malloc(sizeof(*newpa), M_PFRULE, M_WAITOK); 3642 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 3643 if (newpa->ifname[0]) 3644 kif = pf_kkif_create(M_WAITOK); 3645 newpa->kif = NULL; 3646 } 3647 #define ERROUT(x) ERROUT_IOCTL(DIOCCHANGEADDR_error, x) 3648 PF_RULES_WLOCK(); 3649 ruleset = pf_find_kruleset(pca->anchor); 3650 if (ruleset == NULL) 3651 ERROUT(EBUSY); 3652 3653 pool = pf_get_kpool(pca->anchor, pca->ticket, pca->r_action, 3654 pca->r_num, pca->r_last, 1, 1); 3655 if (pool == NULL) 3656 ERROUT(EBUSY); 3657 3658 if (pca->action != PF_CHANGE_REMOVE) { 3659 if (newpa->ifname[0]) { 3660 newpa->kif = pfi_kkif_attach(kif, newpa->ifname); 3661 pfi_kkif_ref(newpa->kif); 3662 kif = NULL; 3663 } 3664 3665 switch (newpa->addr.type) { 3666 case PF_ADDR_DYNIFTL: 3667 error = pfi_dynaddr_setup(&newpa->addr, 3668 pca->af); 3669 break; 3670 case PF_ADDR_TABLE: 3671 newpa->addr.p.tbl = pfr_attach_table(ruleset, 3672 newpa->addr.v.tblname); 3673 if (newpa->addr.p.tbl == NULL) 3674 error = ENOMEM; 3675 break; 3676 } 3677 if (error) 3678 goto DIOCCHANGEADDR_error; 3679 } 3680 3681 switch (pca->action) { 3682 case PF_CHANGE_ADD_HEAD: 3683 oldpa = TAILQ_FIRST(&pool->list); 3684 break; 3685 case PF_CHANGE_ADD_TAIL: 3686 oldpa = TAILQ_LAST(&pool->list, pf_kpalist); 3687 break; 3688 default: 3689 oldpa = TAILQ_FIRST(&pool->list); 3690 for (int i = 0; oldpa && i < pca->nr; i++) 3691 oldpa = TAILQ_NEXT(oldpa, entries); 3692 3693 if (oldpa == NULL) 3694 ERROUT(EINVAL); 3695 } 3696 3697 if (pca->action == PF_CHANGE_REMOVE) { 3698 TAILQ_REMOVE(&pool->list, oldpa, entries); 3699 switch (oldpa->addr.type) { 3700 case PF_ADDR_DYNIFTL: 3701 pfi_dynaddr_remove(oldpa->addr.p.dyn); 3702 break; 3703 case PF_ADDR_TABLE: 3704 pfr_detach_table(oldpa->addr.p.tbl); 3705 break; 3706 } 3707 if (oldpa->kif) 3708 pfi_kkif_unref(oldpa->kif); 3709 free(oldpa, M_PFRULE); 3710 } else { 3711 if (oldpa == NULL) 3712 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 3713 else if (pca->action == PF_CHANGE_ADD_HEAD || 3714 pca->action == PF_CHANGE_ADD_BEFORE) 3715 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 3716 else 3717 TAILQ_INSERT_AFTER(&pool->list, oldpa, 3718 newpa, entries); 3719 } 3720 3721 pool->cur = TAILQ_FIRST(&pool->list); 3722 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, pca->af); 3723 PF_RULES_WUNLOCK(); 3724 break; 3725 3726 #undef ERROUT 3727 DIOCCHANGEADDR_error: 3728 if (newpa != NULL) { 3729 if (newpa->kif) 3730 pfi_kkif_unref(newpa->kif); 3731 free(newpa, M_PFRULE); 3732 } 3733 PF_RULES_WUNLOCK(); 3734 pf_kkif_free(kif); 3735 break; 3736 } 3737 3738 case DIOCGETRULESETS: { 3739 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 3740 struct pf_kruleset *ruleset; 3741 struct pf_kanchor *anchor; 3742 3743 pr->path[sizeof(pr->path) - 1] = 0; 3744 3745 PF_RULES_RLOCK(); 3746 if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { 3747 PF_RULES_RUNLOCK(); 3748 error = ENOENT; 3749 break; 3750 } 3751 pr->nr = 0; 3752 if (ruleset->anchor == NULL) { 3753 /* XXX kludge for pf_main_ruleset */ 3754 RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) 3755 if (anchor->parent == NULL) 3756 pr->nr++; 3757 } else { 3758 RB_FOREACH(anchor, pf_kanchor_node, 3759 &ruleset->anchor->children) 3760 pr->nr++; 3761 } 3762 PF_RULES_RUNLOCK(); 3763 break; 3764 } 3765 3766 case DIOCGETRULESET: { 3767 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 3768 struct pf_kruleset *ruleset; 3769 struct pf_kanchor *anchor; 3770 u_int32_t nr = 0; 3771 3772 pr->path[sizeof(pr->path) - 1] = 0; 3773 3774 PF_RULES_RLOCK(); 3775 if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { 3776 PF_RULES_RUNLOCK(); 3777 error = ENOENT; 3778 break; 3779 } 3780 pr->name[0] = 0; 3781 if (ruleset->anchor == NULL) { 3782 /* XXX kludge for pf_main_ruleset */ 3783 RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) 3784 if (anchor->parent == NULL && nr++ == pr->nr) { 3785 strlcpy(pr->name, anchor->name, 3786 sizeof(pr->name)); 3787 break; 3788 } 3789 } else { 3790 RB_FOREACH(anchor, pf_kanchor_node, 3791 &ruleset->anchor->children) 3792 if (nr++ == pr->nr) { 3793 strlcpy(pr->name, anchor->name, 3794 sizeof(pr->name)); 3795 break; 3796 } 3797 } 3798 if (!pr->name[0]) 3799 error = EBUSY; 3800 PF_RULES_RUNLOCK(); 3801 break; 3802 } 3803 3804 case DIOCRCLRTABLES: { 3805 struct pfioc_table *io = (struct pfioc_table *)addr; 3806 3807 if (io->pfrio_esize != 0) { 3808 error = ENODEV; 3809 break; 3810 } 3811 PF_RULES_WLOCK(); 3812 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 3813 io->pfrio_flags | PFR_FLAG_USERIOCTL); 3814 PF_RULES_WUNLOCK(); 3815 break; 3816 } 3817 3818 case DIOCRADDTABLES: { 3819 struct pfioc_table *io = (struct pfioc_table *)addr; 3820 struct pfr_table *pfrts; 3821 size_t totlen; 3822 3823 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3824 error = ENODEV; 3825 break; 3826 } 3827 3828 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 3829 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 3830 error = ENOMEM; 3831 break; 3832 } 3833 3834 totlen = io->pfrio_size * sizeof(struct pfr_table); 3835 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3836 M_TEMP, M_WAITOK); 3837 error = copyin(io->pfrio_buffer, pfrts, totlen); 3838 if (error) { 3839 free(pfrts, M_TEMP); 3840 break; 3841 } 3842 PF_RULES_WLOCK(); 3843 error = pfr_add_tables(pfrts, io->pfrio_size, 3844 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3845 PF_RULES_WUNLOCK(); 3846 free(pfrts, M_TEMP); 3847 break; 3848 } 3849 3850 case DIOCRDELTABLES: { 3851 struct pfioc_table *io = (struct pfioc_table *)addr; 3852 struct pfr_table *pfrts; 3853 size_t totlen; 3854 3855 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3856 error = ENODEV; 3857 break; 3858 } 3859 3860 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 3861 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 3862 error = ENOMEM; 3863 break; 3864 } 3865 3866 totlen = io->pfrio_size * sizeof(struct pfr_table); 3867 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3868 M_TEMP, M_WAITOK); 3869 error = copyin(io->pfrio_buffer, pfrts, totlen); 3870 if (error) { 3871 free(pfrts, M_TEMP); 3872 break; 3873 } 3874 PF_RULES_WLOCK(); 3875 error = pfr_del_tables(pfrts, io->pfrio_size, 3876 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3877 PF_RULES_WUNLOCK(); 3878 free(pfrts, M_TEMP); 3879 break; 3880 } 3881 3882 case DIOCRGETTABLES: { 3883 struct pfioc_table *io = (struct pfioc_table *)addr; 3884 struct pfr_table *pfrts; 3885 size_t totlen; 3886 int n; 3887 3888 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3889 error = ENODEV; 3890 break; 3891 } 3892 PF_RULES_RLOCK(); 3893 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 3894 if (n < 0) { 3895 PF_RULES_RUNLOCK(); 3896 error = EINVAL; 3897 break; 3898 } 3899 io->pfrio_size = min(io->pfrio_size, n); 3900 3901 totlen = io->pfrio_size * sizeof(struct pfr_table); 3902 3903 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3904 M_TEMP, M_NOWAIT | M_ZERO); 3905 if (pfrts == NULL) { 3906 error = ENOMEM; 3907 PF_RULES_RUNLOCK(); 3908 break; 3909 } 3910 error = pfr_get_tables(&io->pfrio_table, pfrts, 3911 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3912 PF_RULES_RUNLOCK(); 3913 if (error == 0) 3914 error = copyout(pfrts, io->pfrio_buffer, totlen); 3915 free(pfrts, M_TEMP); 3916 break; 3917 } 3918 3919 case DIOCRGETTSTATS: { 3920 struct pfioc_table *io = (struct pfioc_table *)addr; 3921 struct pfr_tstats *pfrtstats; 3922 size_t totlen; 3923 int n; 3924 3925 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 3926 error = ENODEV; 3927 break; 3928 } 3929 PF_TABLE_STATS_LOCK(); 3930 PF_RULES_RLOCK(); 3931 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 3932 if (n < 0) { 3933 PF_RULES_RUNLOCK(); 3934 PF_TABLE_STATS_UNLOCK(); 3935 error = EINVAL; 3936 break; 3937 } 3938 io->pfrio_size = min(io->pfrio_size, n); 3939 3940 totlen = io->pfrio_size * sizeof(struct pfr_tstats); 3941 pfrtstats = mallocarray(io->pfrio_size, 3942 sizeof(struct pfr_tstats), M_TEMP, M_NOWAIT | M_ZERO); 3943 if (pfrtstats == NULL) { 3944 error = ENOMEM; 3945 PF_RULES_RUNLOCK(); 3946 PF_TABLE_STATS_UNLOCK(); 3947 break; 3948 } 3949 error = pfr_get_tstats(&io->pfrio_table, pfrtstats, 3950 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3951 PF_RULES_RUNLOCK(); 3952 PF_TABLE_STATS_UNLOCK(); 3953 if (error == 0) 3954 error = copyout(pfrtstats, io->pfrio_buffer, totlen); 3955 free(pfrtstats, M_TEMP); 3956 break; 3957 } 3958 3959 case DIOCRCLRTSTATS: { 3960 struct pfioc_table *io = (struct pfioc_table *)addr; 3961 struct pfr_table *pfrts; 3962 size_t totlen; 3963 3964 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3965 error = ENODEV; 3966 break; 3967 } 3968 3969 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 3970 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 3971 /* We used to count tables and use the minimum required 3972 * size, so we didn't fail on overly large requests. 3973 * Keep doing so. */ 3974 io->pfrio_size = pf_ioctl_maxcount; 3975 break; 3976 } 3977 3978 totlen = io->pfrio_size * sizeof(struct pfr_table); 3979 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3980 M_TEMP, M_WAITOK); 3981 error = copyin(io->pfrio_buffer, pfrts, totlen); 3982 if (error) { 3983 free(pfrts, M_TEMP); 3984 break; 3985 } 3986 3987 PF_TABLE_STATS_LOCK(); 3988 PF_RULES_RLOCK(); 3989 error = pfr_clr_tstats(pfrts, io->pfrio_size, 3990 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3991 PF_RULES_RUNLOCK(); 3992 PF_TABLE_STATS_UNLOCK(); 3993 free(pfrts, M_TEMP); 3994 break; 3995 } 3996 3997 case DIOCRSETTFLAGS: { 3998 struct pfioc_table *io = (struct pfioc_table *)addr; 3999 struct pfr_table *pfrts; 4000 size_t totlen; 4001 int n; 4002 4003 if (io->pfrio_esize != sizeof(struct pfr_table)) { 4004 error = ENODEV; 4005 break; 4006 } 4007 4008 PF_RULES_RLOCK(); 4009 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 4010 if (n < 0) { 4011 PF_RULES_RUNLOCK(); 4012 error = EINVAL; 4013 break; 4014 } 4015 4016 io->pfrio_size = min(io->pfrio_size, n); 4017 PF_RULES_RUNLOCK(); 4018 4019 totlen = io->pfrio_size * sizeof(struct pfr_table); 4020 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 4021 M_TEMP, M_WAITOK); 4022 error = copyin(io->pfrio_buffer, pfrts, totlen); 4023 if (error) { 4024 free(pfrts, M_TEMP); 4025 break; 4026 } 4027 PF_RULES_WLOCK(); 4028 error = pfr_set_tflags(pfrts, io->pfrio_size, 4029 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 4030 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4031 PF_RULES_WUNLOCK(); 4032 free(pfrts, M_TEMP); 4033 break; 4034 } 4035 4036 case DIOCRCLRADDRS: { 4037 struct pfioc_table *io = (struct pfioc_table *)addr; 4038 4039 if (io->pfrio_esize != 0) { 4040 error = ENODEV; 4041 break; 4042 } 4043 PF_RULES_WLOCK(); 4044 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 4045 io->pfrio_flags | PFR_FLAG_USERIOCTL); 4046 PF_RULES_WUNLOCK(); 4047 break; 4048 } 4049 4050 case DIOCRADDADDRS: { 4051 struct pfioc_table *io = (struct pfioc_table *)addr; 4052 struct pfr_addr *pfras; 4053 size_t totlen; 4054 4055 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4056 error = ENODEV; 4057 break; 4058 } 4059 if (io->pfrio_size < 0 || 4060 io->pfrio_size > pf_ioctl_maxcount || 4061 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4062 error = EINVAL; 4063 break; 4064 } 4065 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4066 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4067 M_TEMP, M_WAITOK); 4068 error = copyin(io->pfrio_buffer, pfras, totlen); 4069 if (error) { 4070 free(pfras, M_TEMP); 4071 break; 4072 } 4073 PF_RULES_WLOCK(); 4074 error = pfr_add_addrs(&io->pfrio_table, pfras, 4075 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 4076 PFR_FLAG_USERIOCTL); 4077 PF_RULES_WUNLOCK(); 4078 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4079 error = copyout(pfras, io->pfrio_buffer, totlen); 4080 free(pfras, M_TEMP); 4081 break; 4082 } 4083 4084 case DIOCRDELADDRS: { 4085 struct pfioc_table *io = (struct pfioc_table *)addr; 4086 struct pfr_addr *pfras; 4087 size_t totlen; 4088 4089 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4090 error = ENODEV; 4091 break; 4092 } 4093 if (io->pfrio_size < 0 || 4094 io->pfrio_size > pf_ioctl_maxcount || 4095 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4096 error = EINVAL; 4097 break; 4098 } 4099 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4100 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4101 M_TEMP, M_WAITOK); 4102 error = copyin(io->pfrio_buffer, pfras, totlen); 4103 if (error) { 4104 free(pfras, M_TEMP); 4105 break; 4106 } 4107 PF_RULES_WLOCK(); 4108 error = pfr_del_addrs(&io->pfrio_table, pfras, 4109 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 4110 PFR_FLAG_USERIOCTL); 4111 PF_RULES_WUNLOCK(); 4112 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4113 error = copyout(pfras, io->pfrio_buffer, totlen); 4114 free(pfras, M_TEMP); 4115 break; 4116 } 4117 4118 case DIOCRSETADDRS: { 4119 struct pfioc_table *io = (struct pfioc_table *)addr; 4120 struct pfr_addr *pfras; 4121 size_t totlen, count; 4122 4123 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4124 error = ENODEV; 4125 break; 4126 } 4127 if (io->pfrio_size < 0 || io->pfrio_size2 < 0) { 4128 error = EINVAL; 4129 break; 4130 } 4131 count = max(io->pfrio_size, io->pfrio_size2); 4132 if (count > pf_ioctl_maxcount || 4133 WOULD_OVERFLOW(count, sizeof(struct pfr_addr))) { 4134 error = EINVAL; 4135 break; 4136 } 4137 totlen = count * sizeof(struct pfr_addr); 4138 pfras = mallocarray(count, sizeof(struct pfr_addr), M_TEMP, 4139 M_WAITOK); 4140 error = copyin(io->pfrio_buffer, pfras, totlen); 4141 if (error) { 4142 free(pfras, M_TEMP); 4143 break; 4144 } 4145 PF_RULES_WLOCK(); 4146 error = pfr_set_addrs(&io->pfrio_table, pfras, 4147 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 4148 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 4149 PFR_FLAG_USERIOCTL, 0); 4150 PF_RULES_WUNLOCK(); 4151 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4152 error = copyout(pfras, io->pfrio_buffer, totlen); 4153 free(pfras, M_TEMP); 4154 break; 4155 } 4156 4157 case DIOCRGETADDRS: { 4158 struct pfioc_table *io = (struct pfioc_table *)addr; 4159 struct pfr_addr *pfras; 4160 size_t totlen; 4161 4162 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4163 error = ENODEV; 4164 break; 4165 } 4166 if (io->pfrio_size < 0 || 4167 io->pfrio_size > pf_ioctl_maxcount || 4168 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4169 error = EINVAL; 4170 break; 4171 } 4172 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4173 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4174 M_TEMP, M_WAITOK | M_ZERO); 4175 PF_RULES_RLOCK(); 4176 error = pfr_get_addrs(&io->pfrio_table, pfras, 4177 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4178 PF_RULES_RUNLOCK(); 4179 if (error == 0) 4180 error = copyout(pfras, io->pfrio_buffer, totlen); 4181 free(pfras, M_TEMP); 4182 break; 4183 } 4184 4185 case DIOCRGETASTATS: { 4186 struct pfioc_table *io = (struct pfioc_table *)addr; 4187 struct pfr_astats *pfrastats; 4188 size_t totlen; 4189 4190 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 4191 error = ENODEV; 4192 break; 4193 } 4194 if (io->pfrio_size < 0 || 4195 io->pfrio_size > pf_ioctl_maxcount || 4196 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_astats))) { 4197 error = EINVAL; 4198 break; 4199 } 4200 totlen = io->pfrio_size * sizeof(struct pfr_astats); 4201 pfrastats = mallocarray(io->pfrio_size, 4202 sizeof(struct pfr_astats), M_TEMP, M_WAITOK | M_ZERO); 4203 PF_RULES_RLOCK(); 4204 error = pfr_get_astats(&io->pfrio_table, pfrastats, 4205 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4206 PF_RULES_RUNLOCK(); 4207 if (error == 0) 4208 error = copyout(pfrastats, io->pfrio_buffer, totlen); 4209 free(pfrastats, M_TEMP); 4210 break; 4211 } 4212 4213 case DIOCRCLRASTATS: { 4214 struct pfioc_table *io = (struct pfioc_table *)addr; 4215 struct pfr_addr *pfras; 4216 size_t totlen; 4217 4218 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4219 error = ENODEV; 4220 break; 4221 } 4222 if (io->pfrio_size < 0 || 4223 io->pfrio_size > pf_ioctl_maxcount || 4224 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4225 error = EINVAL; 4226 break; 4227 } 4228 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4229 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4230 M_TEMP, M_WAITOK); 4231 error = copyin(io->pfrio_buffer, pfras, totlen); 4232 if (error) { 4233 free(pfras, M_TEMP); 4234 break; 4235 } 4236 PF_RULES_WLOCK(); 4237 error = pfr_clr_astats(&io->pfrio_table, pfras, 4238 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 4239 PFR_FLAG_USERIOCTL); 4240 PF_RULES_WUNLOCK(); 4241 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4242 error = copyout(pfras, io->pfrio_buffer, totlen); 4243 free(pfras, M_TEMP); 4244 break; 4245 } 4246 4247 case DIOCRTSTADDRS: { 4248 struct pfioc_table *io = (struct pfioc_table *)addr; 4249 struct pfr_addr *pfras; 4250 size_t totlen; 4251 4252 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4253 error = ENODEV; 4254 break; 4255 } 4256 if (io->pfrio_size < 0 || 4257 io->pfrio_size > pf_ioctl_maxcount || 4258 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4259 error = EINVAL; 4260 break; 4261 } 4262 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4263 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4264 M_TEMP, M_WAITOK); 4265 error = copyin(io->pfrio_buffer, pfras, totlen); 4266 if (error) { 4267 free(pfras, M_TEMP); 4268 break; 4269 } 4270 PF_RULES_RLOCK(); 4271 error = pfr_tst_addrs(&io->pfrio_table, pfras, 4272 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 4273 PFR_FLAG_USERIOCTL); 4274 PF_RULES_RUNLOCK(); 4275 if (error == 0) 4276 error = copyout(pfras, io->pfrio_buffer, totlen); 4277 free(pfras, M_TEMP); 4278 break; 4279 } 4280 4281 case DIOCRINADEFINE: { 4282 struct pfioc_table *io = (struct pfioc_table *)addr; 4283 struct pfr_addr *pfras; 4284 size_t totlen; 4285 4286 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4287 error = ENODEV; 4288 break; 4289 } 4290 if (io->pfrio_size < 0 || 4291 io->pfrio_size > pf_ioctl_maxcount || 4292 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4293 error = EINVAL; 4294 break; 4295 } 4296 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4297 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4298 M_TEMP, M_WAITOK); 4299 error = copyin(io->pfrio_buffer, pfras, totlen); 4300 if (error) { 4301 free(pfras, M_TEMP); 4302 break; 4303 } 4304 PF_RULES_WLOCK(); 4305 error = pfr_ina_define(&io->pfrio_table, pfras, 4306 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 4307 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4308 PF_RULES_WUNLOCK(); 4309 free(pfras, M_TEMP); 4310 break; 4311 } 4312 4313 case DIOCOSFPADD: { 4314 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 4315 PF_RULES_WLOCK(); 4316 error = pf_osfp_add(io); 4317 PF_RULES_WUNLOCK(); 4318 break; 4319 } 4320 4321 case DIOCOSFPGET: { 4322 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 4323 PF_RULES_RLOCK(); 4324 error = pf_osfp_get(io); 4325 PF_RULES_RUNLOCK(); 4326 break; 4327 } 4328 4329 case DIOCXBEGIN: { 4330 struct pfioc_trans *io = (struct pfioc_trans *)addr; 4331 struct pfioc_trans_e *ioes, *ioe; 4332 size_t totlen; 4333 int i; 4334 4335 if (io->esize != sizeof(*ioe)) { 4336 error = ENODEV; 4337 break; 4338 } 4339 if (io->size < 0 || 4340 io->size > pf_ioctl_maxcount || 4341 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 4342 error = EINVAL; 4343 break; 4344 } 4345 totlen = sizeof(struct pfioc_trans_e) * io->size; 4346 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 4347 M_TEMP, M_WAITOK); 4348 error = copyin(io->array, ioes, totlen); 4349 if (error) { 4350 free(ioes, M_TEMP); 4351 break; 4352 } 4353 PF_RULES_WLOCK(); 4354 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4355 ioe->anchor[sizeof(ioe->anchor) - 1] = '\0'; 4356 switch (ioe->rs_num) { 4357 #ifdef ALTQ 4358 case PF_RULESET_ALTQ: 4359 if (ioe->anchor[0]) { 4360 PF_RULES_WUNLOCK(); 4361 free(ioes, M_TEMP); 4362 error = EINVAL; 4363 goto fail; 4364 } 4365 if ((error = pf_begin_altq(&ioe->ticket))) { 4366 PF_RULES_WUNLOCK(); 4367 free(ioes, M_TEMP); 4368 goto fail; 4369 } 4370 break; 4371 #endif /* ALTQ */ 4372 case PF_RULESET_TABLE: 4373 { 4374 struct pfr_table table; 4375 4376 bzero(&table, sizeof(table)); 4377 strlcpy(table.pfrt_anchor, ioe->anchor, 4378 sizeof(table.pfrt_anchor)); 4379 if ((error = pfr_ina_begin(&table, 4380 &ioe->ticket, NULL, 0))) { 4381 PF_RULES_WUNLOCK(); 4382 free(ioes, M_TEMP); 4383 goto fail; 4384 } 4385 break; 4386 } 4387 default: 4388 if ((error = pf_begin_rules(&ioe->ticket, 4389 ioe->rs_num, ioe->anchor))) { 4390 PF_RULES_WUNLOCK(); 4391 free(ioes, M_TEMP); 4392 goto fail; 4393 } 4394 break; 4395 } 4396 } 4397 PF_RULES_WUNLOCK(); 4398 error = copyout(ioes, io->array, totlen); 4399 free(ioes, M_TEMP); 4400 break; 4401 } 4402 4403 case DIOCXROLLBACK: { 4404 struct pfioc_trans *io = (struct pfioc_trans *)addr; 4405 struct pfioc_trans_e *ioe, *ioes; 4406 size_t totlen; 4407 int i; 4408 4409 if (io->esize != sizeof(*ioe)) { 4410 error = ENODEV; 4411 break; 4412 } 4413 if (io->size < 0 || 4414 io->size > pf_ioctl_maxcount || 4415 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 4416 error = EINVAL; 4417 break; 4418 } 4419 totlen = sizeof(struct pfioc_trans_e) * io->size; 4420 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 4421 M_TEMP, M_WAITOK); 4422 error = copyin(io->array, ioes, totlen); 4423 if (error) { 4424 free(ioes, M_TEMP); 4425 break; 4426 } 4427 PF_RULES_WLOCK(); 4428 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4429 ioe->anchor[sizeof(ioe->anchor) - 1] = '\0'; 4430 switch (ioe->rs_num) { 4431 #ifdef ALTQ 4432 case PF_RULESET_ALTQ: 4433 if (ioe->anchor[0]) { 4434 PF_RULES_WUNLOCK(); 4435 free(ioes, M_TEMP); 4436 error = EINVAL; 4437 goto fail; 4438 } 4439 if ((error = pf_rollback_altq(ioe->ticket))) { 4440 PF_RULES_WUNLOCK(); 4441 free(ioes, M_TEMP); 4442 goto fail; /* really bad */ 4443 } 4444 break; 4445 #endif /* ALTQ */ 4446 case PF_RULESET_TABLE: 4447 { 4448 struct pfr_table table; 4449 4450 bzero(&table, sizeof(table)); 4451 strlcpy(table.pfrt_anchor, ioe->anchor, 4452 sizeof(table.pfrt_anchor)); 4453 if ((error = pfr_ina_rollback(&table, 4454 ioe->ticket, NULL, 0))) { 4455 PF_RULES_WUNLOCK(); 4456 free(ioes, M_TEMP); 4457 goto fail; /* really bad */ 4458 } 4459 break; 4460 } 4461 default: 4462 if ((error = pf_rollback_rules(ioe->ticket, 4463 ioe->rs_num, ioe->anchor))) { 4464 PF_RULES_WUNLOCK(); 4465 free(ioes, M_TEMP); 4466 goto fail; /* really bad */ 4467 } 4468 break; 4469 } 4470 } 4471 PF_RULES_WUNLOCK(); 4472 free(ioes, M_TEMP); 4473 break; 4474 } 4475 4476 case DIOCXCOMMIT: { 4477 struct pfioc_trans *io = (struct pfioc_trans *)addr; 4478 struct pfioc_trans_e *ioe, *ioes; 4479 struct pf_kruleset *rs; 4480 size_t totlen; 4481 int i; 4482 4483 if (io->esize != sizeof(*ioe)) { 4484 error = ENODEV; 4485 break; 4486 } 4487 4488 if (io->size < 0 || 4489 io->size > pf_ioctl_maxcount || 4490 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 4491 error = EINVAL; 4492 break; 4493 } 4494 4495 totlen = sizeof(struct pfioc_trans_e) * io->size; 4496 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 4497 M_TEMP, M_WAITOK); 4498 error = copyin(io->array, ioes, totlen); 4499 if (error) { 4500 free(ioes, M_TEMP); 4501 break; 4502 } 4503 PF_RULES_WLOCK(); 4504 /* First makes sure everything will succeed. */ 4505 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4506 ioe->anchor[sizeof(ioe->anchor) - 1] = 0; 4507 switch (ioe->rs_num) { 4508 #ifdef ALTQ 4509 case PF_RULESET_ALTQ: 4510 if (ioe->anchor[0]) { 4511 PF_RULES_WUNLOCK(); 4512 free(ioes, M_TEMP); 4513 error = EINVAL; 4514 goto fail; 4515 } 4516 if (!V_altqs_inactive_open || ioe->ticket != 4517 V_ticket_altqs_inactive) { 4518 PF_RULES_WUNLOCK(); 4519 free(ioes, M_TEMP); 4520 error = EBUSY; 4521 goto fail; 4522 } 4523 break; 4524 #endif /* ALTQ */ 4525 case PF_RULESET_TABLE: 4526 rs = pf_find_kruleset(ioe->anchor); 4527 if (rs == NULL || !rs->topen || ioe->ticket != 4528 rs->tticket) { 4529 PF_RULES_WUNLOCK(); 4530 free(ioes, M_TEMP); 4531 error = EBUSY; 4532 goto fail; 4533 } 4534 break; 4535 default: 4536 if (ioe->rs_num < 0 || ioe->rs_num >= 4537 PF_RULESET_MAX) { 4538 PF_RULES_WUNLOCK(); 4539 free(ioes, M_TEMP); 4540 error = EINVAL; 4541 goto fail; 4542 } 4543 rs = pf_find_kruleset(ioe->anchor); 4544 if (rs == NULL || 4545 !rs->rules[ioe->rs_num].inactive.open || 4546 rs->rules[ioe->rs_num].inactive.ticket != 4547 ioe->ticket) { 4548 PF_RULES_WUNLOCK(); 4549 free(ioes, M_TEMP); 4550 error = EBUSY; 4551 goto fail; 4552 } 4553 break; 4554 } 4555 } 4556 /* Now do the commit - no errors should happen here. */ 4557 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4558 switch (ioe->rs_num) { 4559 #ifdef ALTQ 4560 case PF_RULESET_ALTQ: 4561 if ((error = pf_commit_altq(ioe->ticket))) { 4562 PF_RULES_WUNLOCK(); 4563 free(ioes, M_TEMP); 4564 goto fail; /* really bad */ 4565 } 4566 break; 4567 #endif /* ALTQ */ 4568 case PF_RULESET_TABLE: 4569 { 4570 struct pfr_table table; 4571 4572 bzero(&table, sizeof(table)); 4573 (void)strlcpy(table.pfrt_anchor, ioe->anchor, 4574 sizeof(table.pfrt_anchor)); 4575 if ((error = pfr_ina_commit(&table, 4576 ioe->ticket, NULL, NULL, 0))) { 4577 PF_RULES_WUNLOCK(); 4578 free(ioes, M_TEMP); 4579 goto fail; /* really bad */ 4580 } 4581 break; 4582 } 4583 default: 4584 if ((error = pf_commit_rules(ioe->ticket, 4585 ioe->rs_num, ioe->anchor))) { 4586 PF_RULES_WUNLOCK(); 4587 free(ioes, M_TEMP); 4588 goto fail; /* really bad */ 4589 } 4590 break; 4591 } 4592 } 4593 PF_RULES_WUNLOCK(); 4594 free(ioes, M_TEMP); 4595 break; 4596 } 4597 4598 case DIOCGETSRCNODES: { 4599 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 4600 struct pf_srchash *sh; 4601 struct pf_ksrc_node *n; 4602 struct pf_src_node *p, *pstore; 4603 uint32_t i, nr = 0; 4604 4605 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 4606 i++, sh++) { 4607 PF_HASHROW_LOCK(sh); 4608 LIST_FOREACH(n, &sh->nodes, entry) 4609 nr++; 4610 PF_HASHROW_UNLOCK(sh); 4611 } 4612 4613 psn->psn_len = min(psn->psn_len, 4614 sizeof(struct pf_src_node) * nr); 4615 4616 if (psn->psn_len == 0) { 4617 psn->psn_len = sizeof(struct pf_src_node) * nr; 4618 break; 4619 } 4620 4621 nr = 0; 4622 4623 p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK | M_ZERO); 4624 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 4625 i++, sh++) { 4626 PF_HASHROW_LOCK(sh); 4627 LIST_FOREACH(n, &sh->nodes, entry) { 4628 4629 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 4630 break; 4631 4632 pf_src_node_copy(n, p); 4633 4634 p++; 4635 nr++; 4636 } 4637 PF_HASHROW_UNLOCK(sh); 4638 } 4639 error = copyout(pstore, psn->psn_src_nodes, 4640 sizeof(struct pf_src_node) * nr); 4641 if (error) { 4642 free(pstore, M_TEMP); 4643 break; 4644 } 4645 psn->psn_len = sizeof(struct pf_src_node) * nr; 4646 free(pstore, M_TEMP); 4647 break; 4648 } 4649 4650 case DIOCCLRSRCNODES: { 4651 pf_clear_srcnodes(NULL); 4652 pf_purge_expired_src_nodes(); 4653 break; 4654 } 4655 4656 case DIOCKILLSRCNODES: 4657 pf_kill_srcnodes((struct pfioc_src_node_kill *)addr); 4658 break; 4659 4660 case DIOCKEEPCOUNTERS: 4661 error = pf_keepcounters((struct pfioc_nv *)addr); 4662 break; 4663 4664 case DIOCGETSYNCOOKIES: 4665 error = pf_get_syncookies((struct pfioc_nv *)addr); 4666 break; 4667 4668 case DIOCSETSYNCOOKIES: 4669 error = pf_set_syncookies((struct pfioc_nv *)addr); 4670 break; 4671 4672 case DIOCSETHOSTID: { 4673 u_int32_t *hostid = (u_int32_t *)addr; 4674 4675 PF_RULES_WLOCK(); 4676 if (*hostid == 0) 4677 V_pf_status.hostid = arc4random(); 4678 else 4679 V_pf_status.hostid = *hostid; 4680 PF_RULES_WUNLOCK(); 4681 break; 4682 } 4683 4684 case DIOCOSFPFLUSH: 4685 PF_RULES_WLOCK(); 4686 pf_osfp_flush(); 4687 PF_RULES_WUNLOCK(); 4688 break; 4689 4690 case DIOCIGETIFACES: { 4691 struct pfioc_iface *io = (struct pfioc_iface *)addr; 4692 struct pfi_kif *ifstore; 4693 size_t bufsiz; 4694 4695 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 4696 error = ENODEV; 4697 break; 4698 } 4699 4700 if (io->pfiio_size < 0 || 4701 io->pfiio_size > pf_ioctl_maxcount || 4702 WOULD_OVERFLOW(io->pfiio_size, sizeof(struct pfi_kif))) { 4703 error = EINVAL; 4704 break; 4705 } 4706 4707 bufsiz = io->pfiio_size * sizeof(struct pfi_kif); 4708 ifstore = mallocarray(io->pfiio_size, sizeof(struct pfi_kif), 4709 M_TEMP, M_WAITOK | M_ZERO); 4710 4711 PF_RULES_RLOCK(); 4712 pfi_get_ifaces(io->pfiio_name, ifstore, &io->pfiio_size); 4713 PF_RULES_RUNLOCK(); 4714 error = copyout(ifstore, io->pfiio_buffer, bufsiz); 4715 free(ifstore, M_TEMP); 4716 break; 4717 } 4718 4719 case DIOCSETIFFLAG: { 4720 struct pfioc_iface *io = (struct pfioc_iface *)addr; 4721 4722 PF_RULES_WLOCK(); 4723 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 4724 PF_RULES_WUNLOCK(); 4725 break; 4726 } 4727 4728 case DIOCCLRIFFLAG: { 4729 struct pfioc_iface *io = (struct pfioc_iface *)addr; 4730 4731 PF_RULES_WLOCK(); 4732 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 4733 PF_RULES_WUNLOCK(); 4734 break; 4735 } 4736 4737 default: 4738 error = ENODEV; 4739 break; 4740 } 4741 fail: 4742 if (sx_xlocked(&pf_ioctl_lock)) 4743 sx_xunlock(&pf_ioctl_lock); 4744 CURVNET_RESTORE(); 4745 4746 #undef ERROUT_IOCTL 4747 4748 return (error); 4749 } 4750 4751 void 4752 pfsync_state_export(struct pfsync_state *sp, struct pf_kstate *st) 4753 { 4754 bzero(sp, sizeof(struct pfsync_state)); 4755 4756 /* copy from state key */ 4757 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; 4758 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1]; 4759 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0]; 4760 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1]; 4761 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0]; 4762 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1]; 4763 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0]; 4764 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1]; 4765 sp->proto = st->key[PF_SK_WIRE]->proto; 4766 sp->af = st->key[PF_SK_WIRE]->af; 4767 4768 /* copy from state */ 4769 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 4770 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr)); 4771 sp->creation = htonl(time_uptime - st->creation); 4772 sp->expire = pf_state_expires(st); 4773 if (sp->expire <= time_uptime) 4774 sp->expire = htonl(0); 4775 else 4776 sp->expire = htonl(sp->expire - time_uptime); 4777 4778 sp->direction = st->direction; 4779 sp->log = st->log; 4780 sp->timeout = st->timeout; 4781 sp->state_flags = st->state_flags; 4782 if (st->src_node) 4783 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 4784 if (st->nat_src_node) 4785 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 4786 4787 sp->id = st->id; 4788 sp->creatorid = st->creatorid; 4789 pf_state_peer_hton(&st->src, &sp->src); 4790 pf_state_peer_hton(&st->dst, &sp->dst); 4791 4792 if (st->rule.ptr == NULL) 4793 sp->rule = htonl(-1); 4794 else 4795 sp->rule = htonl(st->rule.ptr->nr); 4796 if (st->anchor.ptr == NULL) 4797 sp->anchor = htonl(-1); 4798 else 4799 sp->anchor = htonl(st->anchor.ptr->nr); 4800 if (st->nat_rule.ptr == NULL) 4801 sp->nat_rule = htonl(-1); 4802 else 4803 sp->nat_rule = htonl(st->nat_rule.ptr->nr); 4804 4805 pf_state_counter_hton(st->packets[0], sp->packets[0]); 4806 pf_state_counter_hton(st->packets[1], sp->packets[1]); 4807 pf_state_counter_hton(st->bytes[0], sp->bytes[0]); 4808 pf_state_counter_hton(st->bytes[1], sp->bytes[1]); 4809 } 4810 4811 void 4812 pf_state_export(struct pf_state_export *sp, struct pf_kstate *st) 4813 { 4814 bzero(sp, sizeof(*sp)); 4815 4816 sp->version = PF_STATE_VERSION; 4817 4818 /* copy from state key */ 4819 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; 4820 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1]; 4821 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0]; 4822 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1]; 4823 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0]; 4824 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1]; 4825 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0]; 4826 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1]; 4827 sp->proto = st->key[PF_SK_WIRE]->proto; 4828 sp->af = st->key[PF_SK_WIRE]->af; 4829 4830 /* copy from state */ 4831 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 4832 strlcpy(sp->orig_ifname, st->orig_kif->pfik_name, 4833 sizeof(sp->orig_ifname)); 4834 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr)); 4835 sp->creation = htonl(time_uptime - st->creation); 4836 sp->expire = pf_state_expires(st); 4837 if (sp->expire <= time_uptime) 4838 sp->expire = htonl(0); 4839 else 4840 sp->expire = htonl(sp->expire - time_uptime); 4841 4842 sp->direction = st->direction; 4843 sp->log = st->log; 4844 sp->timeout = st->timeout; 4845 sp->state_flags = st->state_flags; 4846 if (st->src_node) 4847 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 4848 if (st->nat_src_node) 4849 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 4850 4851 sp->id = st->id; 4852 sp->creatorid = st->creatorid; 4853 pf_state_peer_hton(&st->src, &sp->src); 4854 pf_state_peer_hton(&st->dst, &sp->dst); 4855 4856 if (st->rule.ptr == NULL) 4857 sp->rule = htonl(-1); 4858 else 4859 sp->rule = htonl(st->rule.ptr->nr); 4860 if (st->anchor.ptr == NULL) 4861 sp->anchor = htonl(-1); 4862 else 4863 sp->anchor = htonl(st->anchor.ptr->nr); 4864 if (st->nat_rule.ptr == NULL) 4865 sp->nat_rule = htonl(-1); 4866 else 4867 sp->nat_rule = htonl(st->nat_rule.ptr->nr); 4868 4869 sp->packets[0] = st->packets[0]; 4870 sp->packets[1] = st->packets[1]; 4871 sp->bytes[0] = st->bytes[0]; 4872 sp->bytes[1] = st->bytes[1]; 4873 } 4874 4875 static void 4876 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 4877 { 4878 struct pfr_ktable *kt; 4879 4880 KASSERT(aw->type == PF_ADDR_TABLE, ("%s: type %u", __func__, aw->type)); 4881 4882 kt = aw->p.tbl; 4883 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 4884 kt = kt->pfrkt_root; 4885 aw->p.tbl = NULL; 4886 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 4887 kt->pfrkt_cnt : -1; 4888 } 4889 4890 /* 4891 * XXX - Check for version missmatch!!! 4892 */ 4893 static void 4894 pf_clear_all_states(void) 4895 { 4896 struct pf_kstate *s; 4897 u_int i; 4898 4899 for (i = 0; i <= pf_hashmask; i++) { 4900 struct pf_idhash *ih = &V_pf_idhash[i]; 4901 relock: 4902 PF_HASHROW_LOCK(ih); 4903 LIST_FOREACH(s, &ih->states, entry) { 4904 s->timeout = PFTM_PURGE; 4905 /* Don't send out individual delete messages. */ 4906 s->state_flags |= PFSTATE_NOSYNC; 4907 pf_unlink_state(s, PF_ENTER_LOCKED); 4908 goto relock; 4909 } 4910 PF_HASHROW_UNLOCK(ih); 4911 } 4912 } 4913 4914 static int 4915 pf_clear_tables(void) 4916 { 4917 struct pfioc_table io; 4918 int error; 4919 4920 bzero(&io, sizeof(io)); 4921 4922 error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel, 4923 io.pfrio_flags); 4924 4925 return (error); 4926 } 4927 4928 static void 4929 pf_clear_srcnodes(struct pf_ksrc_node *n) 4930 { 4931 struct pf_kstate *s; 4932 int i; 4933 4934 for (i = 0; i <= pf_hashmask; i++) { 4935 struct pf_idhash *ih = &V_pf_idhash[i]; 4936 4937 PF_HASHROW_LOCK(ih); 4938 LIST_FOREACH(s, &ih->states, entry) { 4939 if (n == NULL || n == s->src_node) 4940 s->src_node = NULL; 4941 if (n == NULL || n == s->nat_src_node) 4942 s->nat_src_node = NULL; 4943 } 4944 PF_HASHROW_UNLOCK(ih); 4945 } 4946 4947 if (n == NULL) { 4948 struct pf_srchash *sh; 4949 4950 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 4951 i++, sh++) { 4952 PF_HASHROW_LOCK(sh); 4953 LIST_FOREACH(n, &sh->nodes, entry) { 4954 n->expire = 1; 4955 n->states = 0; 4956 } 4957 PF_HASHROW_UNLOCK(sh); 4958 } 4959 } else { 4960 /* XXX: hash slot should already be locked here. */ 4961 n->expire = 1; 4962 n->states = 0; 4963 } 4964 } 4965 4966 static void 4967 pf_kill_srcnodes(struct pfioc_src_node_kill *psnk) 4968 { 4969 struct pf_ksrc_node_list kill; 4970 4971 LIST_INIT(&kill); 4972 for (int i = 0; i <= pf_srchashmask; i++) { 4973 struct pf_srchash *sh = &V_pf_srchash[i]; 4974 struct pf_ksrc_node *sn, *tmp; 4975 4976 PF_HASHROW_LOCK(sh); 4977 LIST_FOREACH_SAFE(sn, &sh->nodes, entry, tmp) 4978 if (PF_MATCHA(psnk->psnk_src.neg, 4979 &psnk->psnk_src.addr.v.a.addr, 4980 &psnk->psnk_src.addr.v.a.mask, 4981 &sn->addr, sn->af) && 4982 PF_MATCHA(psnk->psnk_dst.neg, 4983 &psnk->psnk_dst.addr.v.a.addr, 4984 &psnk->psnk_dst.addr.v.a.mask, 4985 &sn->raddr, sn->af)) { 4986 pf_unlink_src_node(sn); 4987 LIST_INSERT_HEAD(&kill, sn, entry); 4988 sn->expire = 1; 4989 } 4990 PF_HASHROW_UNLOCK(sh); 4991 } 4992 4993 for (int i = 0; i <= pf_hashmask; i++) { 4994 struct pf_idhash *ih = &V_pf_idhash[i]; 4995 struct pf_kstate *s; 4996 4997 PF_HASHROW_LOCK(ih); 4998 LIST_FOREACH(s, &ih->states, entry) { 4999 if (s->src_node && s->src_node->expire == 1) 5000 s->src_node = NULL; 5001 if (s->nat_src_node && s->nat_src_node->expire == 1) 5002 s->nat_src_node = NULL; 5003 } 5004 PF_HASHROW_UNLOCK(ih); 5005 } 5006 5007 psnk->psnk_killed = pf_free_src_nodes(&kill); 5008 } 5009 5010 static int 5011 pf_keepcounters(struct pfioc_nv *nv) 5012 { 5013 nvlist_t *nvl = NULL; 5014 void *nvlpacked = NULL; 5015 int error = 0; 5016 5017 #define ERROUT(x) ERROUT_FUNCTION(on_error, x) 5018 5019 if (nv->len > pf_ioctl_maxcount) 5020 ERROUT(ENOMEM); 5021 5022 nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK); 5023 if (nvlpacked == NULL) 5024 ERROUT(ENOMEM); 5025 5026 error = copyin(nv->data, nvlpacked, nv->len); 5027 if (error) 5028 ERROUT(error); 5029 5030 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5031 if (nvl == NULL) 5032 ERROUT(EBADMSG); 5033 5034 if (! nvlist_exists_bool(nvl, "keep_counters")) 5035 ERROUT(EBADMSG); 5036 5037 V_pf_status.keep_counters = nvlist_get_bool(nvl, "keep_counters"); 5038 5039 on_error: 5040 nvlist_destroy(nvl); 5041 free(nvlpacked, M_TEMP); 5042 return (error); 5043 } 5044 5045 static unsigned int 5046 pf_clear_states(const struct pf_kstate_kill *kill) 5047 { 5048 struct pf_state_key_cmp match_key; 5049 struct pf_kstate *s; 5050 struct pfi_kkif *kif; 5051 int idx; 5052 unsigned int killed = 0, dir; 5053 5054 for (unsigned int i = 0; i <= pf_hashmask; i++) { 5055 struct pf_idhash *ih = &V_pf_idhash[i]; 5056 5057 relock_DIOCCLRSTATES: 5058 PF_HASHROW_LOCK(ih); 5059 LIST_FOREACH(s, &ih->states, entry) { 5060 /* For floating states look at the original kif. */ 5061 kif = s->kif == V_pfi_all ? s->orig_kif : s->kif; 5062 5063 if (kill->psk_ifname[0] && 5064 strcmp(kill->psk_ifname, 5065 kif->pfik_name)) 5066 continue; 5067 5068 if (kill->psk_kill_match) { 5069 bzero(&match_key, sizeof(match_key)); 5070 5071 if (s->direction == PF_OUT) { 5072 dir = PF_IN; 5073 idx = PF_SK_STACK; 5074 } else { 5075 dir = PF_OUT; 5076 idx = PF_SK_WIRE; 5077 } 5078 5079 match_key.af = s->key[idx]->af; 5080 match_key.proto = s->key[idx]->proto; 5081 PF_ACPY(&match_key.addr[0], 5082 &s->key[idx]->addr[1], match_key.af); 5083 match_key.port[0] = s->key[idx]->port[1]; 5084 PF_ACPY(&match_key.addr[1], 5085 &s->key[idx]->addr[0], match_key.af); 5086 match_key.port[1] = s->key[idx]->port[0]; 5087 } 5088 5089 /* 5090 * Don't send out individual 5091 * delete messages. 5092 */ 5093 s->state_flags |= PFSTATE_NOSYNC; 5094 pf_unlink_state(s, PF_ENTER_LOCKED); 5095 killed++; 5096 5097 if (kill->psk_kill_match) 5098 killed += pf_kill_matching_state(&match_key, 5099 dir); 5100 5101 goto relock_DIOCCLRSTATES; 5102 } 5103 PF_HASHROW_UNLOCK(ih); 5104 } 5105 5106 if (V_pfsync_clear_states_ptr != NULL) 5107 V_pfsync_clear_states_ptr(V_pf_status.hostid, kill->psk_ifname); 5108 5109 return (killed); 5110 } 5111 5112 static void 5113 pf_killstates(struct pf_kstate_kill *kill, unsigned int *killed) 5114 { 5115 struct pf_kstate *s; 5116 5117 if (kill->psk_pfcmp.id) { 5118 if (kill->psk_pfcmp.creatorid == 0) 5119 kill->psk_pfcmp.creatorid = V_pf_status.hostid; 5120 if ((s = pf_find_state_byid(kill->psk_pfcmp.id, 5121 kill->psk_pfcmp.creatorid))) { 5122 pf_unlink_state(s, PF_ENTER_LOCKED); 5123 *killed = 1; 5124 } 5125 return; 5126 } 5127 5128 for (unsigned int i = 0; i <= pf_hashmask; i++) 5129 *killed += pf_killstates_row(kill, &V_pf_idhash[i]); 5130 5131 return; 5132 } 5133 5134 static int 5135 pf_killstates_nv(struct pfioc_nv *nv) 5136 { 5137 struct pf_kstate_kill kill; 5138 nvlist_t *nvl = NULL; 5139 void *nvlpacked = NULL; 5140 int error = 0; 5141 unsigned int killed = 0; 5142 5143 #define ERROUT(x) ERROUT_FUNCTION(on_error, x) 5144 5145 if (nv->len > pf_ioctl_maxcount) 5146 ERROUT(ENOMEM); 5147 5148 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 5149 if (nvlpacked == NULL) 5150 ERROUT(ENOMEM); 5151 5152 error = copyin(nv->data, nvlpacked, nv->len); 5153 if (error) 5154 ERROUT(error); 5155 5156 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5157 if (nvl == NULL) 5158 ERROUT(EBADMSG); 5159 5160 error = pf_nvstate_kill_to_kstate_kill(nvl, &kill); 5161 if (error) 5162 ERROUT(error); 5163 5164 pf_killstates(&kill, &killed); 5165 5166 free(nvlpacked, M_NVLIST); 5167 nvlpacked = NULL; 5168 nvlist_destroy(nvl); 5169 nvl = nvlist_create(0); 5170 if (nvl == NULL) 5171 ERROUT(ENOMEM); 5172 5173 nvlist_add_number(nvl, "killed", killed); 5174 5175 nvlpacked = nvlist_pack(nvl, &nv->len); 5176 if (nvlpacked == NULL) 5177 ERROUT(ENOMEM); 5178 5179 if (nv->size == 0) 5180 ERROUT(0); 5181 else if (nv->size < nv->len) 5182 ERROUT(ENOSPC); 5183 5184 error = copyout(nvlpacked, nv->data, nv->len); 5185 5186 on_error: 5187 nvlist_destroy(nvl); 5188 free(nvlpacked, M_NVLIST); 5189 return (error); 5190 } 5191 5192 static int 5193 pf_clearstates_nv(struct pfioc_nv *nv) 5194 { 5195 struct pf_kstate_kill kill; 5196 nvlist_t *nvl = NULL; 5197 void *nvlpacked = NULL; 5198 int error = 0; 5199 unsigned int killed; 5200 5201 #define ERROUT(x) ERROUT_FUNCTION(on_error, x) 5202 5203 if (nv->len > pf_ioctl_maxcount) 5204 ERROUT(ENOMEM); 5205 5206 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 5207 if (nvlpacked == NULL) 5208 ERROUT(ENOMEM); 5209 5210 error = copyin(nv->data, nvlpacked, nv->len); 5211 if (error) 5212 ERROUT(error); 5213 5214 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5215 if (nvl == NULL) 5216 ERROUT(EBADMSG); 5217 5218 error = pf_nvstate_kill_to_kstate_kill(nvl, &kill); 5219 if (error) 5220 ERROUT(error); 5221 5222 killed = pf_clear_states(&kill); 5223 5224 free(nvlpacked, M_NVLIST); 5225 nvlpacked = NULL; 5226 nvlist_destroy(nvl); 5227 nvl = nvlist_create(0); 5228 if (nvl == NULL) 5229 ERROUT(ENOMEM); 5230 5231 nvlist_add_number(nvl, "killed", killed); 5232 5233 nvlpacked = nvlist_pack(nvl, &nv->len); 5234 if (nvlpacked == NULL) 5235 ERROUT(ENOMEM); 5236 5237 if (nv->size == 0) 5238 ERROUT(0); 5239 else if (nv->size < nv->len) 5240 ERROUT(ENOSPC); 5241 5242 error = copyout(nvlpacked, nv->data, nv->len); 5243 5244 #undef ERROUT 5245 on_error: 5246 nvlist_destroy(nvl); 5247 free(nvlpacked, M_NVLIST); 5248 return (error); 5249 } 5250 5251 static int 5252 pf_getstate(struct pfioc_nv *nv) 5253 { 5254 nvlist_t *nvl = NULL, *nvls; 5255 void *nvlpacked = NULL; 5256 struct pf_kstate *s = NULL; 5257 int error = 0; 5258 uint64_t id, creatorid; 5259 5260 #define ERROUT(x) ERROUT_FUNCTION(errout, x) 5261 5262 if (nv->len > pf_ioctl_maxcount) 5263 ERROUT(ENOMEM); 5264 5265 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 5266 if (nvlpacked == NULL) 5267 ERROUT(ENOMEM); 5268 5269 error = copyin(nv->data, nvlpacked, nv->len); 5270 if (error) 5271 ERROUT(error); 5272 5273 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5274 if (nvl == NULL) 5275 ERROUT(EBADMSG); 5276 5277 PFNV_CHK(pf_nvuint64(nvl, "id", &id)); 5278 PFNV_CHK(pf_nvuint64(nvl, "creatorid", &creatorid)); 5279 5280 s = pf_find_state_byid(id, creatorid); 5281 if (s == NULL) 5282 ERROUT(ENOENT); 5283 5284 free(nvlpacked, M_NVLIST); 5285 nvlpacked = NULL; 5286 nvlist_destroy(nvl); 5287 nvl = nvlist_create(0); 5288 if (nvl == NULL) 5289 ERROUT(ENOMEM); 5290 5291 nvls = pf_state_to_nvstate(s); 5292 if (nvls == NULL) 5293 ERROUT(ENOMEM); 5294 5295 nvlist_add_nvlist(nvl, "state", nvls); 5296 nvlist_destroy(nvls); 5297 5298 nvlpacked = nvlist_pack(nvl, &nv->len); 5299 if (nvlpacked == NULL) 5300 ERROUT(ENOMEM); 5301 5302 if (nv->size == 0) 5303 ERROUT(0); 5304 else if (nv->size < nv->len) 5305 ERROUT(ENOSPC); 5306 5307 error = copyout(nvlpacked, nv->data, nv->len); 5308 5309 #undef ERROUT 5310 errout: 5311 if (s != NULL) 5312 PF_STATE_UNLOCK(s); 5313 free(nvlpacked, M_NVLIST); 5314 nvlist_destroy(nvl); 5315 return (error); 5316 } 5317 5318 /* 5319 * XXX - Check for version missmatch!!! 5320 */ 5321 5322 /* 5323 * Duplicate pfctl -Fa operation to get rid of as much as we can. 5324 */ 5325 static int 5326 shutdown_pf(void) 5327 { 5328 int error = 0; 5329 u_int32_t t[5]; 5330 char nn = '\0'; 5331 5332 do { 5333 if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn)) 5334 != 0) { 5335 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n")); 5336 break; 5337 } 5338 if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn)) 5339 != 0) { 5340 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n")); 5341 break; /* XXX: rollback? */ 5342 } 5343 if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn)) 5344 != 0) { 5345 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n")); 5346 break; /* XXX: rollback? */ 5347 } 5348 if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn)) 5349 != 0) { 5350 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n")); 5351 break; /* XXX: rollback? */ 5352 } 5353 if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn)) 5354 != 0) { 5355 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n")); 5356 break; /* XXX: rollback? */ 5357 } 5358 5359 /* XXX: these should always succeed here */ 5360 pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn); 5361 pf_commit_rules(t[1], PF_RULESET_FILTER, &nn); 5362 pf_commit_rules(t[2], PF_RULESET_NAT, &nn); 5363 pf_commit_rules(t[3], PF_RULESET_BINAT, &nn); 5364 pf_commit_rules(t[4], PF_RULESET_RDR, &nn); 5365 5366 if ((error = pf_clear_tables()) != 0) 5367 break; 5368 5369 #ifdef ALTQ 5370 if ((error = pf_begin_altq(&t[0])) != 0) { 5371 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n")); 5372 break; 5373 } 5374 pf_commit_altq(t[0]); 5375 #endif 5376 5377 pf_clear_all_states(); 5378 5379 pf_clear_srcnodes(NULL); 5380 5381 /* status does not use malloced mem so no need to cleanup */ 5382 /* fingerprints and interfaces have their own cleanup code */ 5383 } while(0); 5384 5385 return (error); 5386 } 5387 5388 static pfil_return_t 5389 pf_check_return(int chk, struct mbuf **m) 5390 { 5391 5392 switch (chk) { 5393 case PF_PASS: 5394 if (*m == NULL) 5395 return (PFIL_CONSUMED); 5396 else 5397 return (PFIL_PASS); 5398 break; 5399 default: 5400 if (*m != NULL) { 5401 m_freem(*m); 5402 *m = NULL; 5403 } 5404 return (PFIL_DROPPED); 5405 } 5406 } 5407 5408 #ifdef INET 5409 static pfil_return_t 5410 pf_check_in(struct mbuf **m, struct ifnet *ifp, int flags, 5411 void *ruleset __unused, struct inpcb *inp) 5412 { 5413 int chk; 5414 5415 chk = pf_test(PF_IN, flags, ifp, m, inp); 5416 5417 return (pf_check_return(chk, m)); 5418 } 5419 5420 static pfil_return_t 5421 pf_check_out(struct mbuf **m, struct ifnet *ifp, int flags, 5422 void *ruleset __unused, struct inpcb *inp) 5423 { 5424 int chk; 5425 5426 chk = pf_test(PF_OUT, flags, ifp, m, inp); 5427 5428 return (pf_check_return(chk, m)); 5429 } 5430 #endif 5431 5432 #ifdef INET6 5433 static pfil_return_t 5434 pf_check6_in(struct mbuf **m, struct ifnet *ifp, int flags, 5435 void *ruleset __unused, struct inpcb *inp) 5436 { 5437 int chk; 5438 5439 /* 5440 * In case of loopback traffic IPv6 uses the real interface in 5441 * order to support scoped addresses. In order to support stateful 5442 * filtering we have change this to lo0 as it is the case in IPv4. 5443 */ 5444 CURVNET_SET(ifp->if_vnet); 5445 chk = pf_test6(PF_IN, flags, (*m)->m_flags & M_LOOP ? V_loif : ifp, m, inp); 5446 CURVNET_RESTORE(); 5447 5448 return (pf_check_return(chk, m)); 5449 } 5450 5451 static pfil_return_t 5452 pf_check6_out(struct mbuf **m, struct ifnet *ifp, int flags, 5453 void *ruleset __unused, struct inpcb *inp) 5454 { 5455 int chk; 5456 5457 CURVNET_SET(ifp->if_vnet); 5458 chk = pf_test6(PF_OUT, flags, ifp, m, inp); 5459 CURVNET_RESTORE(); 5460 5461 return (pf_check_return(chk, m)); 5462 } 5463 #endif /* INET6 */ 5464 5465 #ifdef INET 5466 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip4_in_hook); 5467 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip4_out_hook); 5468 #define V_pf_ip4_in_hook VNET(pf_ip4_in_hook) 5469 #define V_pf_ip4_out_hook VNET(pf_ip4_out_hook) 5470 #endif 5471 #ifdef INET6 5472 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip6_in_hook); 5473 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip6_out_hook); 5474 #define V_pf_ip6_in_hook VNET(pf_ip6_in_hook) 5475 #define V_pf_ip6_out_hook VNET(pf_ip6_out_hook) 5476 #endif 5477 5478 static void 5479 hook_pf(void) 5480 { 5481 struct pfil_hook_args pha; 5482 struct pfil_link_args pla; 5483 int ret; 5484 5485 if (V_pf_pfil_hooked) 5486 return; 5487 5488 pha.pa_version = PFIL_VERSION; 5489 pha.pa_modname = "pf"; 5490 pha.pa_ruleset = NULL; 5491 5492 pla.pa_version = PFIL_VERSION; 5493 5494 #ifdef INET 5495 pha.pa_type = PFIL_TYPE_IP4; 5496 pha.pa_func = pf_check_in; 5497 pha.pa_flags = PFIL_IN; 5498 pha.pa_rulname = "default-in"; 5499 V_pf_ip4_in_hook = pfil_add_hook(&pha); 5500 pla.pa_flags = PFIL_IN | PFIL_HEADPTR | PFIL_HOOKPTR; 5501 pla.pa_head = V_inet_pfil_head; 5502 pla.pa_hook = V_pf_ip4_in_hook; 5503 ret = pfil_link(&pla); 5504 MPASS(ret == 0); 5505 pha.pa_func = pf_check_out; 5506 pha.pa_flags = PFIL_OUT; 5507 pha.pa_rulname = "default-out"; 5508 V_pf_ip4_out_hook = pfil_add_hook(&pha); 5509 pla.pa_flags = PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR; 5510 pla.pa_head = V_inet_pfil_head; 5511 pla.pa_hook = V_pf_ip4_out_hook; 5512 ret = pfil_link(&pla); 5513 MPASS(ret == 0); 5514 #endif 5515 #ifdef INET6 5516 pha.pa_type = PFIL_TYPE_IP6; 5517 pha.pa_func = pf_check6_in; 5518 pha.pa_flags = PFIL_IN; 5519 pha.pa_rulname = "default-in6"; 5520 V_pf_ip6_in_hook = pfil_add_hook(&pha); 5521 pla.pa_flags = PFIL_IN | PFIL_HEADPTR | PFIL_HOOKPTR; 5522 pla.pa_head = V_inet6_pfil_head; 5523 pla.pa_hook = V_pf_ip6_in_hook; 5524 ret = pfil_link(&pla); 5525 MPASS(ret == 0); 5526 pha.pa_func = pf_check6_out; 5527 pha.pa_rulname = "default-out6"; 5528 pha.pa_flags = PFIL_OUT; 5529 V_pf_ip6_out_hook = pfil_add_hook(&pha); 5530 pla.pa_flags = PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR; 5531 pla.pa_head = V_inet6_pfil_head; 5532 pla.pa_hook = V_pf_ip6_out_hook; 5533 ret = pfil_link(&pla); 5534 MPASS(ret == 0); 5535 #endif 5536 5537 V_pf_pfil_hooked = 1; 5538 } 5539 5540 static void 5541 dehook_pf(void) 5542 { 5543 5544 if (V_pf_pfil_hooked == 0) 5545 return; 5546 5547 #ifdef INET 5548 pfil_remove_hook(V_pf_ip4_in_hook); 5549 pfil_remove_hook(V_pf_ip4_out_hook); 5550 #endif 5551 #ifdef INET6 5552 pfil_remove_hook(V_pf_ip6_in_hook); 5553 pfil_remove_hook(V_pf_ip6_out_hook); 5554 #endif 5555 5556 V_pf_pfil_hooked = 0; 5557 } 5558 5559 static void 5560 pf_load_vnet(void) 5561 { 5562 V_pf_tag_z = uma_zcreate("pf tags", sizeof(struct pf_tagname), 5563 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0); 5564 5565 pf_init_tagset(&V_pf_tags, &pf_rule_tag_hashsize, 5566 PF_RULE_TAG_HASH_SIZE_DEFAULT); 5567 #ifdef ALTQ 5568 pf_init_tagset(&V_pf_qids, &pf_queue_tag_hashsize, 5569 PF_QUEUE_TAG_HASH_SIZE_DEFAULT); 5570 #endif 5571 5572 pfattach_vnet(); 5573 V_pf_vnet_active = 1; 5574 } 5575 5576 static int 5577 pf_load(void) 5578 { 5579 int error; 5580 5581 rm_init_flags(&pf_rules_lock, "pf rulesets", RM_RECURSE); 5582 sx_init(&pf_ioctl_lock, "pf ioctl"); 5583 sx_init(&pf_end_lock, "pf end thread"); 5584 5585 pf_mtag_initialize(); 5586 5587 pf_dev = make_dev(&pf_cdevsw, 0, UID_ROOT, GID_WHEEL, 0600, PF_NAME); 5588 if (pf_dev == NULL) 5589 return (ENOMEM); 5590 5591 pf_end_threads = 0; 5592 error = kproc_create(pf_purge_thread, NULL, &pf_purge_proc, 0, 0, "pf purge"); 5593 if (error != 0) 5594 return (error); 5595 5596 pfi_initialize(); 5597 5598 return (0); 5599 } 5600 5601 static void 5602 pf_unload_vnet(void) 5603 { 5604 int ret; 5605 5606 V_pf_vnet_active = 0; 5607 V_pf_status.running = 0; 5608 dehook_pf(); 5609 5610 PF_RULES_WLOCK(); 5611 pf_syncookies_cleanup(); 5612 shutdown_pf(); 5613 PF_RULES_WUNLOCK(); 5614 5615 ret = swi_remove(V_pf_swi_cookie); 5616 MPASS(ret == 0); 5617 ret = intr_event_destroy(V_pf_swi_ie); 5618 MPASS(ret == 0); 5619 5620 pf_unload_vnet_purge(); 5621 5622 pf_normalize_cleanup(); 5623 PF_RULES_WLOCK(); 5624 pfi_cleanup_vnet(); 5625 PF_RULES_WUNLOCK(); 5626 pfr_cleanup(); 5627 pf_osfp_flush(); 5628 pf_cleanup(); 5629 if (IS_DEFAULT_VNET(curvnet)) 5630 pf_mtag_cleanup(); 5631 5632 pf_cleanup_tagset(&V_pf_tags); 5633 #ifdef ALTQ 5634 pf_cleanup_tagset(&V_pf_qids); 5635 #endif 5636 uma_zdestroy(V_pf_tag_z); 5637 5638 #ifdef PF_WANT_32_TO_64_COUNTER 5639 PF_RULES_WLOCK(); 5640 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist); 5641 5642 MPASS(LIST_EMPTY(&V_pf_allkiflist)); 5643 MPASS(V_pf_allkifcount == 0); 5644 5645 LIST_REMOVE(&V_pf_default_rule, allrulelist); 5646 V_pf_allrulecount--; 5647 LIST_REMOVE(V_pf_rulemarker, allrulelist); 5648 5649 /* 5650 * There are known pf rule leaks when running the test suite. 5651 */ 5652 #ifdef notyet 5653 MPASS(LIST_EMPTY(&V_pf_allrulelist)); 5654 MPASS(V_pf_allrulecount == 0); 5655 #endif 5656 5657 PF_RULES_WUNLOCK(); 5658 5659 free(V_pf_kifmarker, PFI_MTYPE); 5660 free(V_pf_rulemarker, M_PFRULE); 5661 #endif 5662 5663 /* Free counters last as we updated them during shutdown. */ 5664 pf_counter_u64_deinit(&V_pf_default_rule.evaluations); 5665 for (int i = 0; i < 2; i++) { 5666 pf_counter_u64_deinit(&V_pf_default_rule.packets[i]); 5667 pf_counter_u64_deinit(&V_pf_default_rule.bytes[i]); 5668 } 5669 counter_u64_free(V_pf_default_rule.states_cur); 5670 counter_u64_free(V_pf_default_rule.states_tot); 5671 counter_u64_free(V_pf_default_rule.src_nodes); 5672 5673 for (int i = 0; i < PFRES_MAX; i++) 5674 counter_u64_free(V_pf_status.counters[i]); 5675 for (int i = 0; i < LCNT_MAX; i++) 5676 counter_u64_free(V_pf_status.lcounters[i]); 5677 for (int i = 0; i < FCNT_MAX; i++) 5678 pf_counter_u64_deinit(&V_pf_status.fcounters[i]); 5679 for (int i = 0; i < SCNT_MAX; i++) 5680 counter_u64_free(V_pf_status.scounters[i]); 5681 } 5682 5683 static void 5684 pf_unload(void) 5685 { 5686 5687 sx_xlock(&pf_end_lock); 5688 pf_end_threads = 1; 5689 while (pf_end_threads < 2) { 5690 wakeup_one(pf_purge_thread); 5691 sx_sleep(pf_purge_proc, &pf_end_lock, 0, "pftmo", 0); 5692 } 5693 sx_xunlock(&pf_end_lock); 5694 5695 if (pf_dev != NULL) 5696 destroy_dev(pf_dev); 5697 5698 pfi_cleanup(); 5699 5700 rm_destroy(&pf_rules_lock); 5701 sx_destroy(&pf_ioctl_lock); 5702 sx_destroy(&pf_end_lock); 5703 } 5704 5705 static void 5706 vnet_pf_init(void *unused __unused) 5707 { 5708 5709 pf_load_vnet(); 5710 } 5711 VNET_SYSINIT(vnet_pf_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD, 5712 vnet_pf_init, NULL); 5713 5714 static void 5715 vnet_pf_uninit(const void *unused __unused) 5716 { 5717 5718 pf_unload_vnet(); 5719 } 5720 SYSUNINIT(pf_unload, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND, pf_unload, NULL); 5721 VNET_SYSUNINIT(vnet_pf_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD, 5722 vnet_pf_uninit, NULL); 5723 5724 static int 5725 pf_modevent(module_t mod, int type, void *data) 5726 { 5727 int error = 0; 5728 5729 switch(type) { 5730 case MOD_LOAD: 5731 error = pf_load(); 5732 break; 5733 case MOD_UNLOAD: 5734 /* Handled in SYSUNINIT(pf_unload) to ensure it's done after 5735 * the vnet_pf_uninit()s */ 5736 break; 5737 default: 5738 error = EINVAL; 5739 break; 5740 } 5741 5742 return (error); 5743 } 5744 5745 static moduledata_t pf_mod = { 5746 "pf", 5747 pf_modevent, 5748 0 5749 }; 5750 5751 DECLARE_MODULE(pf, pf_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND); 5752 MODULE_VERSION(pf, PF_MODVER); 5753