1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 * $OpenBSD: pf_ioctl.c,v 1.213 2009/02/15 21:46:12 mbalmer Exp $ 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD$"); 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_bpf.h" 46 #include "opt_pf.h" 47 48 #include <sys/param.h> 49 #include <sys/bus.h> 50 #include <sys/conf.h> 51 #include <sys/endian.h> 52 #include <sys/fcntl.h> 53 #include <sys/filio.h> 54 #include <sys/interrupt.h> 55 #include <sys/jail.h> 56 #include <sys/kernel.h> 57 #include <sys/kthread.h> 58 #include <sys/lock.h> 59 #include <sys/mbuf.h> 60 #include <sys/module.h> 61 #include <sys/proc.h> 62 #include <sys/smp.h> 63 #include <sys/socket.h> 64 #include <sys/sysctl.h> 65 #include <sys/md5.h> 66 #include <sys/ucred.h> 67 68 #include <net/if.h> 69 #include <net/if_var.h> 70 #include <net/vnet.h> 71 #include <net/route.h> 72 #include <net/pfil.h> 73 #include <net/pfvar.h> 74 #include <net/if_pfsync.h> 75 #include <net/if_pflog.h> 76 77 #include <netinet/in.h> 78 #include <netinet/ip.h> 79 #include <netinet/ip_var.h> 80 #include <netinet6/ip6_var.h> 81 #include <netinet/ip_icmp.h> 82 83 #ifdef INET6 84 #include <netinet/ip6.h> 85 #endif /* INET6 */ 86 87 #ifdef ALTQ 88 #include <net/altq/altq.h> 89 #endif 90 91 static struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t, 92 u_int8_t, u_int8_t, u_int8_t); 93 94 static void pf_mv_pool(struct pf_palist *, struct pf_palist *); 95 static void pf_empty_pool(struct pf_palist *); 96 static int pfioctl(struct cdev *, u_long, caddr_t, int, 97 struct thread *); 98 #ifdef ALTQ 99 static int pf_begin_altq(u_int32_t *); 100 static int pf_rollback_altq(u_int32_t); 101 static int pf_commit_altq(u_int32_t); 102 static int pf_enable_altq(struct pf_altq *); 103 static int pf_disable_altq(struct pf_altq *); 104 static u_int32_t pf_qname2qid(char *); 105 static void pf_qid_unref(u_int32_t); 106 #endif /* ALTQ */ 107 static int pf_begin_rules(u_int32_t *, int, const char *); 108 static int pf_rollback_rules(u_int32_t, int, char *); 109 static int pf_setup_pfsync_matching(struct pf_ruleset *); 110 static void pf_hash_rule(MD5_CTX *, struct pf_rule *); 111 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 112 static int pf_commit_rules(u_int32_t, int, char *); 113 static int pf_addr_setup(struct pf_ruleset *, 114 struct pf_addr_wrap *, sa_family_t); 115 static void pf_addr_copyout(struct pf_addr_wrap *); 116 117 VNET_DEFINE(struct pf_rule, pf_default_rule); 118 119 #ifdef ALTQ 120 static VNET_DEFINE(int, pf_altq_running); 121 #define V_pf_altq_running VNET(pf_altq_running) 122 #endif 123 124 #define TAGID_MAX 50000 125 struct pf_tagname { 126 TAILQ_ENTRY(pf_tagname) entries; 127 char name[PF_TAG_NAME_SIZE]; 128 uint16_t tag; 129 int ref; 130 }; 131 132 TAILQ_HEAD(pf_tags, pf_tagname); 133 #define V_pf_tags VNET(pf_tags) 134 VNET_DEFINE(struct pf_tags, pf_tags); 135 #define V_pf_qids VNET(pf_qids) 136 VNET_DEFINE(struct pf_tags, pf_qids); 137 static MALLOC_DEFINE(M_PFTAG, "pf_tag", "pf(4) tag names"); 138 static MALLOC_DEFINE(M_PFALTQ, "pf_altq", "pf(4) altq configuration db"); 139 static MALLOC_DEFINE(M_PFRULE, "pf_rule", "pf(4) rules"); 140 141 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 142 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 143 #endif 144 145 static u_int16_t tagname2tag(struct pf_tags *, char *); 146 static u_int16_t pf_tagname2tag(char *); 147 static void tag_unref(struct pf_tags *, u_int16_t); 148 149 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x 150 151 struct cdev *pf_dev; 152 153 /* 154 * XXX - These are new and need to be checked when moveing to a new version 155 */ 156 static void pf_clear_states(void); 157 static int pf_clear_tables(void); 158 static void pf_clear_srcnodes(struct pf_src_node *); 159 static void pf_kill_srcnodes(struct pfioc_src_node_kill *); 160 static void pf_tbladdr_copyout(struct pf_addr_wrap *); 161 162 /* 163 * Wrapper functions for pfil(9) hooks 164 */ 165 #ifdef INET 166 static int pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, 167 int dir, int flags, struct inpcb *inp); 168 static int pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, 169 int dir, int flags, struct inpcb *inp); 170 #endif 171 #ifdef INET6 172 static int pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, 173 int dir, int flags, struct inpcb *inp); 174 static int pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, 175 int dir, int flags, struct inpcb *inp); 176 #endif 177 178 static int hook_pf(void); 179 static int dehook_pf(void); 180 static int shutdown_pf(void); 181 static int pf_load(void); 182 static void pf_unload(void); 183 184 static struct cdevsw pf_cdevsw = { 185 .d_ioctl = pfioctl, 186 .d_name = PF_NAME, 187 .d_version = D_VERSION, 188 }; 189 190 static volatile VNET_DEFINE(int, pf_pfil_hooked); 191 #define V_pf_pfil_hooked VNET(pf_pfil_hooked) 192 193 /* 194 * We need a flag that is neither hooked nor running to know when 195 * the VNET is "valid". We primarily need this to control (global) 196 * external event, e.g., eventhandlers. 197 */ 198 VNET_DEFINE(int, pf_vnet_active); 199 #define V_pf_vnet_active VNET(pf_vnet_active) 200 201 int pf_end_threads; 202 struct proc *pf_purge_proc; 203 204 struct rmlock pf_rules_lock; 205 struct sx pf_ioctl_lock; 206 struct sx pf_end_lock; 207 208 /* pfsync */ 209 pfsync_state_import_t *pfsync_state_import_ptr = NULL; 210 pfsync_insert_state_t *pfsync_insert_state_ptr = NULL; 211 pfsync_update_state_t *pfsync_update_state_ptr = NULL; 212 pfsync_delete_state_t *pfsync_delete_state_ptr = NULL; 213 pfsync_clear_states_t *pfsync_clear_states_ptr = NULL; 214 pfsync_defer_t *pfsync_defer_ptr = NULL; 215 /* pflog */ 216 pflog_packet_t *pflog_packet_ptr = NULL; 217 218 extern u_long pf_ioctl_maxcount; 219 220 static void 221 pfattach_vnet(void) 222 { 223 u_int32_t *my_timeout = V_pf_default_rule.timeout; 224 225 pf_initialize(); 226 pfr_initialize(); 227 pfi_initialize_vnet(); 228 pf_normalize_init(); 229 230 V_pf_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT; 231 V_pf_limits[PF_LIMIT_SRC_NODES].limit = PFSNODE_HIWAT; 232 233 RB_INIT(&V_pf_anchors); 234 pf_init_ruleset(&pf_main_ruleset); 235 236 /* default rule should never be garbage collected */ 237 V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next; 238 #ifdef PF_DEFAULT_TO_DROP 239 V_pf_default_rule.action = PF_DROP; 240 #else 241 V_pf_default_rule.action = PF_PASS; 242 #endif 243 V_pf_default_rule.nr = -1; 244 V_pf_default_rule.rtableid = -1; 245 246 V_pf_default_rule.states_cur = counter_u64_alloc(M_WAITOK); 247 V_pf_default_rule.states_tot = counter_u64_alloc(M_WAITOK); 248 V_pf_default_rule.src_nodes = counter_u64_alloc(M_WAITOK); 249 250 /* initialize default timeouts */ 251 my_timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 252 my_timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 253 my_timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 254 my_timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 255 my_timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 256 my_timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 257 my_timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 258 my_timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 259 my_timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 260 my_timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 261 my_timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 262 my_timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 263 my_timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 264 my_timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 265 my_timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 266 my_timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 267 my_timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 268 my_timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 269 my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 270 my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 271 272 bzero(&V_pf_status, sizeof(V_pf_status)); 273 V_pf_status.debug = PF_DEBUG_URGENT; 274 275 V_pf_pfil_hooked = 0; 276 277 /* XXX do our best to avoid a conflict */ 278 V_pf_status.hostid = arc4random(); 279 280 for (int i = 0; i < PFRES_MAX; i++) 281 V_pf_status.counters[i] = counter_u64_alloc(M_WAITOK); 282 for (int i = 0; i < LCNT_MAX; i++) 283 V_pf_status.lcounters[i] = counter_u64_alloc(M_WAITOK); 284 for (int i = 0; i < FCNT_MAX; i++) 285 V_pf_status.fcounters[i] = counter_u64_alloc(M_WAITOK); 286 for (int i = 0; i < SCNT_MAX; i++) 287 V_pf_status.scounters[i] = counter_u64_alloc(M_WAITOK); 288 289 if (swi_add(NULL, "pf send", pf_intr, curvnet, SWI_NET, 290 INTR_MPSAFE, &V_pf_swi_cookie) != 0) 291 /* XXXGL: leaked all above. */ 292 return; 293 } 294 295 296 static struct pf_pool * 297 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action, 298 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 299 u_int8_t check_ticket) 300 { 301 struct pf_ruleset *ruleset; 302 struct pf_rule *rule; 303 int rs_num; 304 305 ruleset = pf_find_ruleset(anchor); 306 if (ruleset == NULL) 307 return (NULL); 308 rs_num = pf_get_ruleset_number(rule_action); 309 if (rs_num >= PF_RULESET_MAX) 310 return (NULL); 311 if (active) { 312 if (check_ticket && ticket != 313 ruleset->rules[rs_num].active.ticket) 314 return (NULL); 315 if (r_last) 316 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 317 pf_rulequeue); 318 else 319 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 320 } else { 321 if (check_ticket && ticket != 322 ruleset->rules[rs_num].inactive.ticket) 323 return (NULL); 324 if (r_last) 325 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 326 pf_rulequeue); 327 else 328 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 329 } 330 if (!r_last) { 331 while ((rule != NULL) && (rule->nr != rule_number)) 332 rule = TAILQ_NEXT(rule, entries); 333 } 334 if (rule == NULL) 335 return (NULL); 336 337 return (&rule->rpool); 338 } 339 340 static void 341 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb) 342 { 343 struct pf_pooladdr *mv_pool_pa; 344 345 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 346 TAILQ_REMOVE(poola, mv_pool_pa, entries); 347 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 348 } 349 } 350 351 static void 352 pf_empty_pool(struct pf_palist *poola) 353 { 354 struct pf_pooladdr *pa; 355 356 while ((pa = TAILQ_FIRST(poola)) != NULL) { 357 switch (pa->addr.type) { 358 case PF_ADDR_DYNIFTL: 359 pfi_dynaddr_remove(pa->addr.p.dyn); 360 break; 361 case PF_ADDR_TABLE: 362 /* XXX: this could be unfinished pooladdr on pabuf */ 363 if (pa->addr.p.tbl != NULL) 364 pfr_detach_table(pa->addr.p.tbl); 365 break; 366 } 367 if (pa->kif) 368 pfi_kif_unref(pa->kif); 369 TAILQ_REMOVE(poola, pa, entries); 370 free(pa, M_PFRULE); 371 } 372 } 373 374 static void 375 pf_unlink_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule) 376 { 377 378 PF_RULES_WASSERT(); 379 380 TAILQ_REMOVE(rulequeue, rule, entries); 381 382 PF_UNLNKDRULES_LOCK(); 383 rule->rule_flag |= PFRULE_REFS; 384 TAILQ_INSERT_TAIL(&V_pf_unlinked_rules, rule, entries); 385 PF_UNLNKDRULES_UNLOCK(); 386 } 387 388 void 389 pf_free_rule(struct pf_rule *rule) 390 { 391 392 PF_RULES_WASSERT(); 393 394 if (rule->tag) 395 tag_unref(&V_pf_tags, rule->tag); 396 if (rule->match_tag) 397 tag_unref(&V_pf_tags, rule->match_tag); 398 #ifdef ALTQ 399 if (rule->pqid != rule->qid) 400 pf_qid_unref(rule->pqid); 401 pf_qid_unref(rule->qid); 402 #endif 403 switch (rule->src.addr.type) { 404 case PF_ADDR_DYNIFTL: 405 pfi_dynaddr_remove(rule->src.addr.p.dyn); 406 break; 407 case PF_ADDR_TABLE: 408 pfr_detach_table(rule->src.addr.p.tbl); 409 break; 410 } 411 switch (rule->dst.addr.type) { 412 case PF_ADDR_DYNIFTL: 413 pfi_dynaddr_remove(rule->dst.addr.p.dyn); 414 break; 415 case PF_ADDR_TABLE: 416 pfr_detach_table(rule->dst.addr.p.tbl); 417 break; 418 } 419 if (rule->overload_tbl) 420 pfr_detach_table(rule->overload_tbl); 421 if (rule->kif) 422 pfi_kif_unref(rule->kif); 423 pf_anchor_remove(rule); 424 pf_empty_pool(&rule->rpool.list); 425 counter_u64_free(rule->states_cur); 426 counter_u64_free(rule->states_tot); 427 counter_u64_free(rule->src_nodes); 428 free(rule, M_PFRULE); 429 } 430 431 static u_int16_t 432 tagname2tag(struct pf_tags *head, char *tagname) 433 { 434 struct pf_tagname *tag, *p = NULL; 435 u_int16_t new_tagid = 1; 436 437 PF_RULES_WASSERT(); 438 439 TAILQ_FOREACH(tag, head, entries) 440 if (strcmp(tagname, tag->name) == 0) { 441 tag->ref++; 442 return (tag->tag); 443 } 444 445 /* 446 * to avoid fragmentation, we do a linear search from the beginning 447 * and take the first free slot we find. if there is none or the list 448 * is empty, append a new entry at the end. 449 */ 450 451 /* new entry */ 452 if (!TAILQ_EMPTY(head)) 453 for (p = TAILQ_FIRST(head); p != NULL && 454 p->tag == new_tagid; p = TAILQ_NEXT(p, entries)) 455 new_tagid = p->tag + 1; 456 457 if (new_tagid > TAGID_MAX) 458 return (0); 459 460 /* allocate and fill new struct pf_tagname */ 461 tag = malloc(sizeof(*tag), M_PFTAG, M_NOWAIT|M_ZERO); 462 if (tag == NULL) 463 return (0); 464 strlcpy(tag->name, tagname, sizeof(tag->name)); 465 tag->tag = new_tagid; 466 tag->ref++; 467 468 if (p != NULL) /* insert new entry before p */ 469 TAILQ_INSERT_BEFORE(p, tag, entries); 470 else /* either list empty or no free slot in between */ 471 TAILQ_INSERT_TAIL(head, tag, entries); 472 473 return (tag->tag); 474 } 475 476 static void 477 tag_unref(struct pf_tags *head, u_int16_t tag) 478 { 479 struct pf_tagname *p, *next; 480 481 PF_RULES_WASSERT(); 482 483 for (p = TAILQ_FIRST(head); p != NULL; p = next) { 484 next = TAILQ_NEXT(p, entries); 485 if (tag == p->tag) { 486 if (--p->ref == 0) { 487 TAILQ_REMOVE(head, p, entries); 488 free(p, M_PFTAG); 489 } 490 break; 491 } 492 } 493 } 494 495 static u_int16_t 496 pf_tagname2tag(char *tagname) 497 { 498 return (tagname2tag(&V_pf_tags, tagname)); 499 } 500 501 #ifdef ALTQ 502 static u_int32_t 503 pf_qname2qid(char *qname) 504 { 505 return ((u_int32_t)tagname2tag(&V_pf_qids, qname)); 506 } 507 508 static void 509 pf_qid_unref(u_int32_t qid) 510 { 511 tag_unref(&V_pf_qids, (u_int16_t)qid); 512 } 513 514 static int 515 pf_begin_altq(u_int32_t *ticket) 516 { 517 struct pf_altq *altq; 518 int error = 0; 519 520 PF_RULES_WASSERT(); 521 522 /* Purge the old altq list */ 523 while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) { 524 TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries); 525 if (altq->qname[0] == 0 && 526 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 527 /* detach and destroy the discipline */ 528 error = altq_remove(altq); 529 } else 530 pf_qid_unref(altq->qid); 531 free(altq, M_PFALTQ); 532 } 533 if (error) 534 return (error); 535 *ticket = ++V_ticket_altqs_inactive; 536 V_altqs_inactive_open = 1; 537 return (0); 538 } 539 540 static int 541 pf_rollback_altq(u_int32_t ticket) 542 { 543 struct pf_altq *altq; 544 int error = 0; 545 546 PF_RULES_WASSERT(); 547 548 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 549 return (0); 550 /* Purge the old altq list */ 551 while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) { 552 TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries); 553 if (altq->qname[0] == 0 && 554 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 555 /* detach and destroy the discipline */ 556 error = altq_remove(altq); 557 } else 558 pf_qid_unref(altq->qid); 559 free(altq, M_PFALTQ); 560 } 561 V_altqs_inactive_open = 0; 562 return (error); 563 } 564 565 static int 566 pf_commit_altq(u_int32_t ticket) 567 { 568 struct pf_altqqueue *old_altqs; 569 struct pf_altq *altq; 570 int err, error = 0; 571 572 PF_RULES_WASSERT(); 573 574 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 575 return (EBUSY); 576 577 /* swap altqs, keep the old. */ 578 old_altqs = V_pf_altqs_active; 579 V_pf_altqs_active = V_pf_altqs_inactive; 580 V_pf_altqs_inactive = old_altqs; 581 V_ticket_altqs_active = V_ticket_altqs_inactive; 582 583 /* Attach new disciplines */ 584 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 585 if (altq->qname[0] == 0 && 586 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 587 /* attach the discipline */ 588 error = altq_pfattach(altq); 589 if (error == 0 && V_pf_altq_running) 590 error = pf_enable_altq(altq); 591 if (error != 0) 592 return (error); 593 } 594 } 595 596 /* Purge the old altq list */ 597 while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) { 598 TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries); 599 if (altq->qname[0] == 0 && 600 (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 601 /* detach and destroy the discipline */ 602 if (V_pf_altq_running) 603 error = pf_disable_altq(altq); 604 err = altq_pfdetach(altq); 605 if (err != 0 && error == 0) 606 error = err; 607 err = altq_remove(altq); 608 if (err != 0 && error == 0) 609 error = err; 610 } else 611 pf_qid_unref(altq->qid); 612 free(altq, M_PFALTQ); 613 } 614 615 V_altqs_inactive_open = 0; 616 return (error); 617 } 618 619 static int 620 pf_enable_altq(struct pf_altq *altq) 621 { 622 struct ifnet *ifp; 623 struct tb_profile tb; 624 int error = 0; 625 626 if ((ifp = ifunit(altq->ifname)) == NULL) 627 return (EINVAL); 628 629 if (ifp->if_snd.altq_type != ALTQT_NONE) 630 error = altq_enable(&ifp->if_snd); 631 632 /* set tokenbucket regulator */ 633 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 634 tb.rate = altq->ifbandwidth; 635 tb.depth = altq->tbrsize; 636 error = tbr_set(&ifp->if_snd, &tb); 637 } 638 639 return (error); 640 } 641 642 static int 643 pf_disable_altq(struct pf_altq *altq) 644 { 645 struct ifnet *ifp; 646 struct tb_profile tb; 647 int error; 648 649 if ((ifp = ifunit(altq->ifname)) == NULL) 650 return (EINVAL); 651 652 /* 653 * when the discipline is no longer referenced, it was overridden 654 * by a new one. if so, just return. 655 */ 656 if (altq->altq_disc != ifp->if_snd.altq_disc) 657 return (0); 658 659 error = altq_disable(&ifp->if_snd); 660 661 if (error == 0) { 662 /* clear tokenbucket regulator */ 663 tb.rate = 0; 664 error = tbr_set(&ifp->if_snd, &tb); 665 } 666 667 return (error); 668 } 669 670 void 671 pf_altq_ifnet_event(struct ifnet *ifp, int remove) 672 { 673 struct ifnet *ifp1; 674 struct pf_altq *a1, *a2, *a3; 675 u_int32_t ticket; 676 int error = 0; 677 678 /* Interrupt userland queue modifications */ 679 if (V_altqs_inactive_open) 680 pf_rollback_altq(V_ticket_altqs_inactive); 681 682 /* Start new altq ruleset */ 683 if (pf_begin_altq(&ticket)) 684 return; 685 686 /* Copy the current active set */ 687 TAILQ_FOREACH(a1, V_pf_altqs_active, entries) { 688 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT); 689 if (a2 == NULL) { 690 error = ENOMEM; 691 break; 692 } 693 bcopy(a1, a2, sizeof(struct pf_altq)); 694 695 if (a2->qname[0] != 0) { 696 if ((a2->qid = pf_qname2qid(a2->qname)) == 0) { 697 error = EBUSY; 698 free(a2, M_PFALTQ); 699 break; 700 } 701 a2->altq_disc = NULL; 702 TAILQ_FOREACH(a3, V_pf_altqs_inactive, entries) { 703 if (strncmp(a3->ifname, a2->ifname, 704 IFNAMSIZ) == 0 && a3->qname[0] == 0) { 705 a2->altq_disc = a3->altq_disc; 706 break; 707 } 708 } 709 } 710 /* Deactivate the interface in question */ 711 a2->local_flags &= ~PFALTQ_FLAG_IF_REMOVED; 712 if ((ifp1 = ifunit(a2->ifname)) == NULL || 713 (remove && ifp1 == ifp)) { 714 a2->local_flags |= PFALTQ_FLAG_IF_REMOVED; 715 } else { 716 error = altq_add(a2); 717 718 if (ticket != V_ticket_altqs_inactive) 719 error = EBUSY; 720 721 if (error) { 722 free(a2, M_PFALTQ); 723 break; 724 } 725 } 726 727 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, a2, entries); 728 } 729 730 if (error != 0) 731 pf_rollback_altq(ticket); 732 else 733 pf_commit_altq(ticket); 734 } 735 #endif /* ALTQ */ 736 737 static int 738 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 739 { 740 struct pf_ruleset *rs; 741 struct pf_rule *rule; 742 743 PF_RULES_WASSERT(); 744 745 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 746 return (EINVAL); 747 rs = pf_find_or_create_ruleset(anchor); 748 if (rs == NULL) 749 return (EINVAL); 750 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 751 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 752 rs->rules[rs_num].inactive.rcount--; 753 } 754 *ticket = ++rs->rules[rs_num].inactive.ticket; 755 rs->rules[rs_num].inactive.open = 1; 756 return (0); 757 } 758 759 static int 760 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 761 { 762 struct pf_ruleset *rs; 763 struct pf_rule *rule; 764 765 PF_RULES_WASSERT(); 766 767 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 768 return (EINVAL); 769 rs = pf_find_ruleset(anchor); 770 if (rs == NULL || !rs->rules[rs_num].inactive.open || 771 rs->rules[rs_num].inactive.ticket != ticket) 772 return (0); 773 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 774 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 775 rs->rules[rs_num].inactive.rcount--; 776 } 777 rs->rules[rs_num].inactive.open = 0; 778 return (0); 779 } 780 781 #define PF_MD5_UPD(st, elm) \ 782 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 783 784 #define PF_MD5_UPD_STR(st, elm) \ 785 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 786 787 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 788 (stor) = htonl((st)->elm); \ 789 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 790 } while (0) 791 792 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 793 (stor) = htons((st)->elm); \ 794 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 795 } while (0) 796 797 static void 798 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 799 { 800 PF_MD5_UPD(pfr, addr.type); 801 switch (pfr->addr.type) { 802 case PF_ADDR_DYNIFTL: 803 PF_MD5_UPD(pfr, addr.v.ifname); 804 PF_MD5_UPD(pfr, addr.iflags); 805 break; 806 case PF_ADDR_TABLE: 807 PF_MD5_UPD(pfr, addr.v.tblname); 808 break; 809 case PF_ADDR_ADDRMASK: 810 /* XXX ignore af? */ 811 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 812 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 813 break; 814 } 815 816 PF_MD5_UPD(pfr, port[0]); 817 PF_MD5_UPD(pfr, port[1]); 818 PF_MD5_UPD(pfr, neg); 819 PF_MD5_UPD(pfr, port_op); 820 } 821 822 static void 823 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule) 824 { 825 u_int16_t x; 826 u_int32_t y; 827 828 pf_hash_rule_addr(ctx, &rule->src); 829 pf_hash_rule_addr(ctx, &rule->dst); 830 PF_MD5_UPD_STR(rule, label); 831 PF_MD5_UPD_STR(rule, ifname); 832 PF_MD5_UPD_STR(rule, match_tagname); 833 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 834 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 835 PF_MD5_UPD_HTONL(rule, prob, y); 836 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 837 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 838 PF_MD5_UPD(rule, uid.op); 839 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 840 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 841 PF_MD5_UPD(rule, gid.op); 842 PF_MD5_UPD_HTONL(rule, rule_flag, y); 843 PF_MD5_UPD(rule, action); 844 PF_MD5_UPD(rule, direction); 845 PF_MD5_UPD(rule, af); 846 PF_MD5_UPD(rule, quick); 847 PF_MD5_UPD(rule, ifnot); 848 PF_MD5_UPD(rule, match_tag_not); 849 PF_MD5_UPD(rule, natpass); 850 PF_MD5_UPD(rule, keep_state); 851 PF_MD5_UPD(rule, proto); 852 PF_MD5_UPD(rule, type); 853 PF_MD5_UPD(rule, code); 854 PF_MD5_UPD(rule, flags); 855 PF_MD5_UPD(rule, flagset); 856 PF_MD5_UPD(rule, allow_opts); 857 PF_MD5_UPD(rule, rt); 858 PF_MD5_UPD(rule, tos); 859 } 860 861 static int 862 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 863 { 864 struct pf_ruleset *rs; 865 struct pf_rule *rule, **old_array; 866 struct pf_rulequeue *old_rules; 867 int error; 868 u_int32_t old_rcount; 869 870 PF_RULES_WASSERT(); 871 872 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 873 return (EINVAL); 874 rs = pf_find_ruleset(anchor); 875 if (rs == NULL || !rs->rules[rs_num].inactive.open || 876 ticket != rs->rules[rs_num].inactive.ticket) 877 return (EBUSY); 878 879 /* Calculate checksum for the main ruleset */ 880 if (rs == &pf_main_ruleset) { 881 error = pf_setup_pfsync_matching(rs); 882 if (error != 0) 883 return (error); 884 } 885 886 /* Swap rules, keep the old. */ 887 old_rules = rs->rules[rs_num].active.ptr; 888 old_rcount = rs->rules[rs_num].active.rcount; 889 old_array = rs->rules[rs_num].active.ptr_array; 890 891 rs->rules[rs_num].active.ptr = 892 rs->rules[rs_num].inactive.ptr; 893 rs->rules[rs_num].active.ptr_array = 894 rs->rules[rs_num].inactive.ptr_array; 895 rs->rules[rs_num].active.rcount = 896 rs->rules[rs_num].inactive.rcount; 897 rs->rules[rs_num].inactive.ptr = old_rules; 898 rs->rules[rs_num].inactive.ptr_array = old_array; 899 rs->rules[rs_num].inactive.rcount = old_rcount; 900 901 rs->rules[rs_num].active.ticket = 902 rs->rules[rs_num].inactive.ticket; 903 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 904 905 906 /* Purge the old rule list. */ 907 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 908 pf_unlink_rule(old_rules, rule); 909 if (rs->rules[rs_num].inactive.ptr_array) 910 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 911 rs->rules[rs_num].inactive.ptr_array = NULL; 912 rs->rules[rs_num].inactive.rcount = 0; 913 rs->rules[rs_num].inactive.open = 0; 914 pf_remove_if_empty_ruleset(rs); 915 916 return (0); 917 } 918 919 static int 920 pf_setup_pfsync_matching(struct pf_ruleset *rs) 921 { 922 MD5_CTX ctx; 923 struct pf_rule *rule; 924 int rs_cnt; 925 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 926 927 MD5Init(&ctx); 928 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 929 /* XXX PF_RULESET_SCRUB as well? */ 930 if (rs_cnt == PF_RULESET_SCRUB) 931 continue; 932 933 if (rs->rules[rs_cnt].inactive.ptr_array) 934 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 935 rs->rules[rs_cnt].inactive.ptr_array = NULL; 936 937 if (rs->rules[rs_cnt].inactive.rcount) { 938 rs->rules[rs_cnt].inactive.ptr_array = 939 malloc(sizeof(caddr_t) * 940 rs->rules[rs_cnt].inactive.rcount, 941 M_TEMP, M_NOWAIT); 942 943 if (!rs->rules[rs_cnt].inactive.ptr_array) 944 return (ENOMEM); 945 } 946 947 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 948 entries) { 949 pf_hash_rule(&ctx, rule); 950 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 951 } 952 } 953 954 MD5Final(digest, &ctx); 955 memcpy(V_pf_status.pf_chksum, digest, sizeof(V_pf_status.pf_chksum)); 956 return (0); 957 } 958 959 static int 960 pf_addr_setup(struct pf_ruleset *ruleset, struct pf_addr_wrap *addr, 961 sa_family_t af) 962 { 963 int error = 0; 964 965 switch (addr->type) { 966 case PF_ADDR_TABLE: 967 addr->p.tbl = pfr_attach_table(ruleset, addr->v.tblname); 968 if (addr->p.tbl == NULL) 969 error = ENOMEM; 970 break; 971 case PF_ADDR_DYNIFTL: 972 error = pfi_dynaddr_setup(addr, af); 973 break; 974 } 975 976 return (error); 977 } 978 979 static void 980 pf_addr_copyout(struct pf_addr_wrap *addr) 981 { 982 983 switch (addr->type) { 984 case PF_ADDR_DYNIFTL: 985 pfi_dynaddr_copyout(addr); 986 break; 987 case PF_ADDR_TABLE: 988 pf_tbladdr_copyout(addr); 989 break; 990 } 991 } 992 993 static int 994 pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) 995 { 996 int error = 0; 997 PF_RULES_RLOCK_TRACKER; 998 999 /* XXX keep in sync with switch() below */ 1000 if (securelevel_gt(td->td_ucred, 2)) 1001 switch (cmd) { 1002 case DIOCGETRULES: 1003 case DIOCGETRULE: 1004 case DIOCGETADDRS: 1005 case DIOCGETADDR: 1006 case DIOCGETSTATE: 1007 case DIOCSETSTATUSIF: 1008 case DIOCGETSTATUS: 1009 case DIOCCLRSTATUS: 1010 case DIOCNATLOOK: 1011 case DIOCSETDEBUG: 1012 case DIOCGETSTATES: 1013 case DIOCGETTIMEOUT: 1014 case DIOCCLRRULECTRS: 1015 case DIOCGETLIMIT: 1016 case DIOCGETALTQS: 1017 case DIOCGETALTQ: 1018 case DIOCGETQSTATS: 1019 case DIOCGETRULESETS: 1020 case DIOCGETRULESET: 1021 case DIOCRGETTABLES: 1022 case DIOCRGETTSTATS: 1023 case DIOCRCLRTSTATS: 1024 case DIOCRCLRADDRS: 1025 case DIOCRADDADDRS: 1026 case DIOCRDELADDRS: 1027 case DIOCRSETADDRS: 1028 case DIOCRGETADDRS: 1029 case DIOCRGETASTATS: 1030 case DIOCRCLRASTATS: 1031 case DIOCRTSTADDRS: 1032 case DIOCOSFPGET: 1033 case DIOCGETSRCNODES: 1034 case DIOCCLRSRCNODES: 1035 case DIOCIGETIFACES: 1036 case DIOCGIFSPEED: 1037 case DIOCSETIFFLAG: 1038 case DIOCCLRIFFLAG: 1039 break; 1040 case DIOCRCLRTABLES: 1041 case DIOCRADDTABLES: 1042 case DIOCRDELTABLES: 1043 case DIOCRSETTFLAGS: 1044 if (((struct pfioc_table *)addr)->pfrio_flags & 1045 PFR_FLAG_DUMMY) 1046 break; /* dummy operation ok */ 1047 return (EPERM); 1048 default: 1049 return (EPERM); 1050 } 1051 1052 if (!(flags & FWRITE)) 1053 switch (cmd) { 1054 case DIOCGETRULES: 1055 case DIOCGETADDRS: 1056 case DIOCGETADDR: 1057 case DIOCGETSTATE: 1058 case DIOCGETSTATUS: 1059 case DIOCGETSTATES: 1060 case DIOCGETTIMEOUT: 1061 case DIOCGETLIMIT: 1062 case DIOCGETALTQS: 1063 case DIOCGETALTQ: 1064 case DIOCGETQSTATS: 1065 case DIOCGETRULESETS: 1066 case DIOCGETRULESET: 1067 case DIOCNATLOOK: 1068 case DIOCRGETTABLES: 1069 case DIOCRGETTSTATS: 1070 case DIOCRGETADDRS: 1071 case DIOCRGETASTATS: 1072 case DIOCRTSTADDRS: 1073 case DIOCOSFPGET: 1074 case DIOCGETSRCNODES: 1075 case DIOCIGETIFACES: 1076 case DIOCGIFSPEED: 1077 break; 1078 case DIOCRCLRTABLES: 1079 case DIOCRADDTABLES: 1080 case DIOCRDELTABLES: 1081 case DIOCRCLRTSTATS: 1082 case DIOCRCLRADDRS: 1083 case DIOCRADDADDRS: 1084 case DIOCRDELADDRS: 1085 case DIOCRSETADDRS: 1086 case DIOCRSETTFLAGS: 1087 if (((struct pfioc_table *)addr)->pfrio_flags & 1088 PFR_FLAG_DUMMY) { 1089 flags |= FWRITE; /* need write lock for dummy */ 1090 break; /* dummy operation ok */ 1091 } 1092 return (EACCES); 1093 case DIOCGETRULE: 1094 if (((struct pfioc_rule *)addr)->action == 1095 PF_GET_CLR_CNTR) 1096 return (EACCES); 1097 break; 1098 default: 1099 return (EACCES); 1100 } 1101 1102 CURVNET_SET(TD_TO_VNET(td)); 1103 1104 switch (cmd) { 1105 case DIOCSTART: 1106 sx_xlock(&pf_ioctl_lock); 1107 if (V_pf_status.running) 1108 error = EEXIST; 1109 else { 1110 int cpu; 1111 1112 error = hook_pf(); 1113 if (error) { 1114 DPFPRINTF(PF_DEBUG_MISC, 1115 ("pf: pfil registration failed\n")); 1116 break; 1117 } 1118 V_pf_status.running = 1; 1119 V_pf_status.since = time_second; 1120 1121 CPU_FOREACH(cpu) 1122 V_pf_stateid[cpu] = time_second; 1123 1124 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 1125 } 1126 break; 1127 1128 case DIOCSTOP: 1129 sx_xlock(&pf_ioctl_lock); 1130 if (!V_pf_status.running) 1131 error = ENOENT; 1132 else { 1133 V_pf_status.running = 0; 1134 error = dehook_pf(); 1135 if (error) { 1136 V_pf_status.running = 1; 1137 DPFPRINTF(PF_DEBUG_MISC, 1138 ("pf: pfil unregistration failed\n")); 1139 } 1140 V_pf_status.since = time_second; 1141 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 1142 } 1143 break; 1144 1145 case DIOCADDRULE: { 1146 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1147 struct pf_ruleset *ruleset; 1148 struct pf_rule *rule, *tail; 1149 struct pf_pooladdr *pa; 1150 struct pfi_kif *kif = NULL; 1151 int rs_num; 1152 1153 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1154 error = EINVAL; 1155 break; 1156 } 1157 #ifndef INET 1158 if (pr->rule.af == AF_INET) { 1159 error = EAFNOSUPPORT; 1160 break; 1161 } 1162 #endif /* INET */ 1163 #ifndef INET6 1164 if (pr->rule.af == AF_INET6) { 1165 error = EAFNOSUPPORT; 1166 break; 1167 } 1168 #endif /* INET6 */ 1169 1170 rule = malloc(sizeof(*rule), M_PFRULE, M_WAITOK); 1171 bcopy(&pr->rule, rule, sizeof(struct pf_rule)); 1172 if (rule->ifname[0]) 1173 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 1174 rule->states_cur = counter_u64_alloc(M_WAITOK); 1175 rule->states_tot = counter_u64_alloc(M_WAITOK); 1176 rule->src_nodes = counter_u64_alloc(M_WAITOK); 1177 rule->cuid = td->td_ucred->cr_ruid; 1178 rule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 1179 TAILQ_INIT(&rule->rpool.list); 1180 1181 #define ERROUT(x) { error = (x); goto DIOCADDRULE_error; } 1182 1183 PF_RULES_WLOCK(); 1184 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1185 ruleset = pf_find_ruleset(pr->anchor); 1186 if (ruleset == NULL) 1187 ERROUT(EINVAL); 1188 rs_num = pf_get_ruleset_number(pr->rule.action); 1189 if (rs_num >= PF_RULESET_MAX) 1190 ERROUT(EINVAL); 1191 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) { 1192 DPFPRINTF(PF_DEBUG_MISC, 1193 ("ticket: %d != [%d]%d\n", pr->ticket, rs_num, 1194 ruleset->rules[rs_num].inactive.ticket)); 1195 ERROUT(EBUSY); 1196 } 1197 if (pr->pool_ticket != V_ticket_pabuf) { 1198 DPFPRINTF(PF_DEBUG_MISC, 1199 ("pool_ticket: %d != %d\n", pr->pool_ticket, 1200 V_ticket_pabuf)); 1201 ERROUT(EBUSY); 1202 } 1203 1204 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1205 pf_rulequeue); 1206 if (tail) 1207 rule->nr = tail->nr + 1; 1208 else 1209 rule->nr = 0; 1210 if (rule->ifname[0]) { 1211 rule->kif = pfi_kif_attach(kif, rule->ifname); 1212 pfi_kif_ref(rule->kif); 1213 } else 1214 rule->kif = NULL; 1215 1216 if (rule->rtableid > 0 && rule->rtableid >= rt_numfibs) 1217 error = EBUSY; 1218 1219 #ifdef ALTQ 1220 /* set queue IDs */ 1221 if (rule->qname[0] != 0) { 1222 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1223 error = EBUSY; 1224 else if (rule->pqname[0] != 0) { 1225 if ((rule->pqid = 1226 pf_qname2qid(rule->pqname)) == 0) 1227 error = EBUSY; 1228 } else 1229 rule->pqid = rule->qid; 1230 } 1231 #endif 1232 if (rule->tagname[0]) 1233 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1234 error = EBUSY; 1235 if (rule->match_tagname[0]) 1236 if ((rule->match_tag = 1237 pf_tagname2tag(rule->match_tagname)) == 0) 1238 error = EBUSY; 1239 if (rule->rt && !rule->direction) 1240 error = EINVAL; 1241 if (!rule->log) 1242 rule->logif = 0; 1243 if (rule->logif >= PFLOGIFS_MAX) 1244 error = EINVAL; 1245 if (pf_addr_setup(ruleset, &rule->src.addr, rule->af)) 1246 error = ENOMEM; 1247 if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af)) 1248 error = ENOMEM; 1249 if (pf_anchor_setup(rule, ruleset, pr->anchor_call)) 1250 error = EINVAL; 1251 if (rule->scrub_flags & PFSTATE_SETPRIO && 1252 (rule->set_prio[0] > PF_PRIO_MAX || 1253 rule->set_prio[1] > PF_PRIO_MAX)) 1254 error = EINVAL; 1255 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 1256 if (pa->addr.type == PF_ADDR_TABLE) { 1257 pa->addr.p.tbl = pfr_attach_table(ruleset, 1258 pa->addr.v.tblname); 1259 if (pa->addr.p.tbl == NULL) 1260 error = ENOMEM; 1261 } 1262 1263 rule->overload_tbl = NULL; 1264 if (rule->overload_tblname[0]) { 1265 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1266 rule->overload_tblname)) == NULL) 1267 error = EINVAL; 1268 else 1269 rule->overload_tbl->pfrkt_flags |= 1270 PFR_TFLAG_ACTIVE; 1271 } 1272 1273 pf_mv_pool(&V_pf_pabuf, &rule->rpool.list); 1274 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1275 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1276 (rule->rt > PF_NOPFROUTE)) && 1277 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1278 error = EINVAL; 1279 1280 if (error) { 1281 pf_free_rule(rule); 1282 PF_RULES_WUNLOCK(); 1283 break; 1284 } 1285 1286 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1287 rule->evaluations = rule->packets[0] = rule->packets[1] = 1288 rule->bytes[0] = rule->bytes[1] = 0; 1289 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 1290 rule, entries); 1291 ruleset->rules[rs_num].inactive.rcount++; 1292 PF_RULES_WUNLOCK(); 1293 break; 1294 1295 #undef ERROUT 1296 DIOCADDRULE_error: 1297 PF_RULES_WUNLOCK(); 1298 counter_u64_free(rule->states_cur); 1299 counter_u64_free(rule->states_tot); 1300 counter_u64_free(rule->src_nodes); 1301 free(rule, M_PFRULE); 1302 if (kif) 1303 free(kif, PFI_MTYPE); 1304 break; 1305 } 1306 1307 case DIOCGETRULES: { 1308 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1309 struct pf_ruleset *ruleset; 1310 struct pf_rule *tail; 1311 int rs_num; 1312 1313 PF_RULES_WLOCK(); 1314 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1315 ruleset = pf_find_ruleset(pr->anchor); 1316 if (ruleset == NULL) { 1317 PF_RULES_WUNLOCK(); 1318 error = EINVAL; 1319 break; 1320 } 1321 rs_num = pf_get_ruleset_number(pr->rule.action); 1322 if (rs_num >= PF_RULESET_MAX) { 1323 PF_RULES_WUNLOCK(); 1324 error = EINVAL; 1325 break; 1326 } 1327 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 1328 pf_rulequeue); 1329 if (tail) 1330 pr->nr = tail->nr + 1; 1331 else 1332 pr->nr = 0; 1333 pr->ticket = ruleset->rules[rs_num].active.ticket; 1334 PF_RULES_WUNLOCK(); 1335 break; 1336 } 1337 1338 case DIOCGETRULE: { 1339 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 1340 struct pf_ruleset *ruleset; 1341 struct pf_rule *rule; 1342 int rs_num, i; 1343 1344 PF_RULES_WLOCK(); 1345 pr->anchor[sizeof(pr->anchor) - 1] = 0; 1346 ruleset = pf_find_ruleset(pr->anchor); 1347 if (ruleset == NULL) { 1348 PF_RULES_WUNLOCK(); 1349 error = EINVAL; 1350 break; 1351 } 1352 rs_num = pf_get_ruleset_number(pr->rule.action); 1353 if (rs_num >= PF_RULESET_MAX) { 1354 PF_RULES_WUNLOCK(); 1355 error = EINVAL; 1356 break; 1357 } 1358 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 1359 PF_RULES_WUNLOCK(); 1360 error = EBUSY; 1361 break; 1362 } 1363 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 1364 while ((rule != NULL) && (rule->nr != pr->nr)) 1365 rule = TAILQ_NEXT(rule, entries); 1366 if (rule == NULL) { 1367 PF_RULES_WUNLOCK(); 1368 error = EBUSY; 1369 break; 1370 } 1371 bcopy(rule, &pr->rule, sizeof(struct pf_rule)); 1372 pr->rule.u_states_cur = counter_u64_fetch(rule->states_cur); 1373 pr->rule.u_states_tot = counter_u64_fetch(rule->states_tot); 1374 pr->rule.u_src_nodes = counter_u64_fetch(rule->src_nodes); 1375 if (pf_anchor_copyout(ruleset, rule, pr)) { 1376 PF_RULES_WUNLOCK(); 1377 error = EBUSY; 1378 break; 1379 } 1380 pf_addr_copyout(&pr->rule.src.addr); 1381 pf_addr_copyout(&pr->rule.dst.addr); 1382 for (i = 0; i < PF_SKIP_COUNT; ++i) 1383 if (rule->skip[i].ptr == NULL) 1384 pr->rule.skip[i].nr = -1; 1385 else 1386 pr->rule.skip[i].nr = 1387 rule->skip[i].ptr->nr; 1388 1389 if (pr->action == PF_GET_CLR_CNTR) { 1390 rule->evaluations = 0; 1391 rule->packets[0] = rule->packets[1] = 0; 1392 rule->bytes[0] = rule->bytes[1] = 0; 1393 counter_u64_zero(rule->states_tot); 1394 } 1395 PF_RULES_WUNLOCK(); 1396 break; 1397 } 1398 1399 case DIOCCHANGERULE: { 1400 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 1401 struct pf_ruleset *ruleset; 1402 struct pf_rule *oldrule = NULL, *newrule = NULL; 1403 struct pfi_kif *kif = NULL; 1404 struct pf_pooladdr *pa; 1405 u_int32_t nr = 0; 1406 int rs_num; 1407 1408 if (pcr->action < PF_CHANGE_ADD_HEAD || 1409 pcr->action > PF_CHANGE_GET_TICKET) { 1410 error = EINVAL; 1411 break; 1412 } 1413 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 1414 error = EINVAL; 1415 break; 1416 } 1417 1418 if (pcr->action != PF_CHANGE_REMOVE) { 1419 #ifndef INET 1420 if (pcr->rule.af == AF_INET) { 1421 error = EAFNOSUPPORT; 1422 break; 1423 } 1424 #endif /* INET */ 1425 #ifndef INET6 1426 if (pcr->rule.af == AF_INET6) { 1427 error = EAFNOSUPPORT; 1428 break; 1429 } 1430 #endif /* INET6 */ 1431 newrule = malloc(sizeof(*newrule), M_PFRULE, M_WAITOK); 1432 bcopy(&pcr->rule, newrule, sizeof(struct pf_rule)); 1433 if (newrule->ifname[0]) 1434 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 1435 newrule->states_cur = counter_u64_alloc(M_WAITOK); 1436 newrule->states_tot = counter_u64_alloc(M_WAITOK); 1437 newrule->src_nodes = counter_u64_alloc(M_WAITOK); 1438 newrule->cuid = td->td_ucred->cr_ruid; 1439 newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 1440 TAILQ_INIT(&newrule->rpool.list); 1441 } 1442 1443 #define ERROUT(x) { error = (x); goto DIOCCHANGERULE_error; } 1444 1445 PF_RULES_WLOCK(); 1446 if (!(pcr->action == PF_CHANGE_REMOVE || 1447 pcr->action == PF_CHANGE_GET_TICKET) && 1448 pcr->pool_ticket != V_ticket_pabuf) 1449 ERROUT(EBUSY); 1450 1451 ruleset = pf_find_ruleset(pcr->anchor); 1452 if (ruleset == NULL) 1453 ERROUT(EINVAL); 1454 1455 rs_num = pf_get_ruleset_number(pcr->rule.action); 1456 if (rs_num >= PF_RULESET_MAX) 1457 ERROUT(EINVAL); 1458 1459 if (pcr->action == PF_CHANGE_GET_TICKET) { 1460 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 1461 ERROUT(0); 1462 } else if (pcr->ticket != 1463 ruleset->rules[rs_num].active.ticket) 1464 ERROUT(EINVAL); 1465 1466 if (pcr->action != PF_CHANGE_REMOVE) { 1467 if (newrule->ifname[0]) { 1468 newrule->kif = pfi_kif_attach(kif, 1469 newrule->ifname); 1470 pfi_kif_ref(newrule->kif); 1471 } else 1472 newrule->kif = NULL; 1473 1474 if (newrule->rtableid > 0 && 1475 newrule->rtableid >= rt_numfibs) 1476 error = EBUSY; 1477 1478 #ifdef ALTQ 1479 /* set queue IDs */ 1480 if (newrule->qname[0] != 0) { 1481 if ((newrule->qid = 1482 pf_qname2qid(newrule->qname)) == 0) 1483 error = EBUSY; 1484 else if (newrule->pqname[0] != 0) { 1485 if ((newrule->pqid = 1486 pf_qname2qid(newrule->pqname)) == 0) 1487 error = EBUSY; 1488 } else 1489 newrule->pqid = newrule->qid; 1490 } 1491 #endif /* ALTQ */ 1492 if (newrule->tagname[0]) 1493 if ((newrule->tag = 1494 pf_tagname2tag(newrule->tagname)) == 0) 1495 error = EBUSY; 1496 if (newrule->match_tagname[0]) 1497 if ((newrule->match_tag = pf_tagname2tag( 1498 newrule->match_tagname)) == 0) 1499 error = EBUSY; 1500 if (newrule->rt && !newrule->direction) 1501 error = EINVAL; 1502 if (!newrule->log) 1503 newrule->logif = 0; 1504 if (newrule->logif >= PFLOGIFS_MAX) 1505 error = EINVAL; 1506 if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af)) 1507 error = ENOMEM; 1508 if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af)) 1509 error = ENOMEM; 1510 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call)) 1511 error = EINVAL; 1512 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 1513 if (pa->addr.type == PF_ADDR_TABLE) { 1514 pa->addr.p.tbl = 1515 pfr_attach_table(ruleset, 1516 pa->addr.v.tblname); 1517 if (pa->addr.p.tbl == NULL) 1518 error = ENOMEM; 1519 } 1520 1521 newrule->overload_tbl = NULL; 1522 if (newrule->overload_tblname[0]) { 1523 if ((newrule->overload_tbl = pfr_attach_table( 1524 ruleset, newrule->overload_tblname)) == 1525 NULL) 1526 error = EINVAL; 1527 else 1528 newrule->overload_tbl->pfrkt_flags |= 1529 PFR_TFLAG_ACTIVE; 1530 } 1531 1532 pf_mv_pool(&V_pf_pabuf, &newrule->rpool.list); 1533 if (((((newrule->action == PF_NAT) || 1534 (newrule->action == PF_RDR) || 1535 (newrule->action == PF_BINAT) || 1536 (newrule->rt > PF_NOPFROUTE)) && 1537 !newrule->anchor)) && 1538 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 1539 error = EINVAL; 1540 1541 if (error) { 1542 pf_free_rule(newrule); 1543 PF_RULES_WUNLOCK(); 1544 break; 1545 } 1546 1547 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 1548 newrule->evaluations = 0; 1549 newrule->packets[0] = newrule->packets[1] = 0; 1550 newrule->bytes[0] = newrule->bytes[1] = 0; 1551 } 1552 pf_empty_pool(&V_pf_pabuf); 1553 1554 if (pcr->action == PF_CHANGE_ADD_HEAD) 1555 oldrule = TAILQ_FIRST( 1556 ruleset->rules[rs_num].active.ptr); 1557 else if (pcr->action == PF_CHANGE_ADD_TAIL) 1558 oldrule = TAILQ_LAST( 1559 ruleset->rules[rs_num].active.ptr, pf_rulequeue); 1560 else { 1561 oldrule = TAILQ_FIRST( 1562 ruleset->rules[rs_num].active.ptr); 1563 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 1564 oldrule = TAILQ_NEXT(oldrule, entries); 1565 if (oldrule == NULL) { 1566 if (newrule != NULL) 1567 pf_free_rule(newrule); 1568 PF_RULES_WUNLOCK(); 1569 error = EINVAL; 1570 break; 1571 } 1572 } 1573 1574 if (pcr->action == PF_CHANGE_REMOVE) { 1575 pf_unlink_rule(ruleset->rules[rs_num].active.ptr, 1576 oldrule); 1577 ruleset->rules[rs_num].active.rcount--; 1578 } else { 1579 if (oldrule == NULL) 1580 TAILQ_INSERT_TAIL( 1581 ruleset->rules[rs_num].active.ptr, 1582 newrule, entries); 1583 else if (pcr->action == PF_CHANGE_ADD_HEAD || 1584 pcr->action == PF_CHANGE_ADD_BEFORE) 1585 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 1586 else 1587 TAILQ_INSERT_AFTER( 1588 ruleset->rules[rs_num].active.ptr, 1589 oldrule, newrule, entries); 1590 ruleset->rules[rs_num].active.rcount++; 1591 } 1592 1593 nr = 0; 1594 TAILQ_FOREACH(oldrule, 1595 ruleset->rules[rs_num].active.ptr, entries) 1596 oldrule->nr = nr++; 1597 1598 ruleset->rules[rs_num].active.ticket++; 1599 1600 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 1601 pf_remove_if_empty_ruleset(ruleset); 1602 1603 PF_RULES_WUNLOCK(); 1604 break; 1605 1606 #undef ERROUT 1607 DIOCCHANGERULE_error: 1608 PF_RULES_WUNLOCK(); 1609 if (newrule != NULL) { 1610 counter_u64_free(newrule->states_cur); 1611 counter_u64_free(newrule->states_tot); 1612 counter_u64_free(newrule->src_nodes); 1613 free(newrule, M_PFRULE); 1614 } 1615 if (kif != NULL) 1616 free(kif, PFI_MTYPE); 1617 break; 1618 } 1619 1620 case DIOCCLRSTATES: { 1621 struct pf_state *s; 1622 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1623 u_int i, killed = 0; 1624 1625 for (i = 0; i <= pf_hashmask; i++) { 1626 struct pf_idhash *ih = &V_pf_idhash[i]; 1627 1628 relock_DIOCCLRSTATES: 1629 PF_HASHROW_LOCK(ih); 1630 LIST_FOREACH(s, &ih->states, entry) 1631 if (!psk->psk_ifname[0] || 1632 !strcmp(psk->psk_ifname, 1633 s->kif->pfik_name)) { 1634 /* 1635 * Don't send out individual 1636 * delete messages. 1637 */ 1638 s->state_flags |= PFSTATE_NOSYNC; 1639 pf_unlink_state(s, PF_ENTER_LOCKED); 1640 killed++; 1641 goto relock_DIOCCLRSTATES; 1642 } 1643 PF_HASHROW_UNLOCK(ih); 1644 } 1645 psk->psk_killed = killed; 1646 if (pfsync_clear_states_ptr != NULL) 1647 pfsync_clear_states_ptr(V_pf_status.hostid, psk->psk_ifname); 1648 break; 1649 } 1650 1651 case DIOCKILLSTATES: { 1652 struct pf_state *s; 1653 struct pf_state_key *sk; 1654 struct pf_addr *srcaddr, *dstaddr; 1655 u_int16_t srcport, dstport; 1656 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 1657 u_int i, killed = 0; 1658 1659 if (psk->psk_pfcmp.id) { 1660 if (psk->psk_pfcmp.creatorid == 0) 1661 psk->psk_pfcmp.creatorid = V_pf_status.hostid; 1662 if ((s = pf_find_state_byid(psk->psk_pfcmp.id, 1663 psk->psk_pfcmp.creatorid))) { 1664 pf_unlink_state(s, PF_ENTER_LOCKED); 1665 psk->psk_killed = 1; 1666 } 1667 break; 1668 } 1669 1670 for (i = 0; i <= pf_hashmask; i++) { 1671 struct pf_idhash *ih = &V_pf_idhash[i]; 1672 1673 relock_DIOCKILLSTATES: 1674 PF_HASHROW_LOCK(ih); 1675 LIST_FOREACH(s, &ih->states, entry) { 1676 sk = s->key[PF_SK_WIRE]; 1677 if (s->direction == PF_OUT) { 1678 srcaddr = &sk->addr[1]; 1679 dstaddr = &sk->addr[0]; 1680 srcport = sk->port[1]; 1681 dstport = sk->port[0]; 1682 } else { 1683 srcaddr = &sk->addr[0]; 1684 dstaddr = &sk->addr[1]; 1685 srcport = sk->port[0]; 1686 dstport = sk->port[1]; 1687 } 1688 1689 if ((!psk->psk_af || sk->af == psk->psk_af) 1690 && (!psk->psk_proto || psk->psk_proto == 1691 sk->proto) && 1692 PF_MATCHA(psk->psk_src.neg, 1693 &psk->psk_src.addr.v.a.addr, 1694 &psk->psk_src.addr.v.a.mask, 1695 srcaddr, sk->af) && 1696 PF_MATCHA(psk->psk_dst.neg, 1697 &psk->psk_dst.addr.v.a.addr, 1698 &psk->psk_dst.addr.v.a.mask, 1699 dstaddr, sk->af) && 1700 (psk->psk_src.port_op == 0 || 1701 pf_match_port(psk->psk_src.port_op, 1702 psk->psk_src.port[0], psk->psk_src.port[1], 1703 srcport)) && 1704 (psk->psk_dst.port_op == 0 || 1705 pf_match_port(psk->psk_dst.port_op, 1706 psk->psk_dst.port[0], psk->psk_dst.port[1], 1707 dstport)) && 1708 (!psk->psk_label[0] || 1709 (s->rule.ptr->label[0] && 1710 !strcmp(psk->psk_label, 1711 s->rule.ptr->label))) && 1712 (!psk->psk_ifname[0] || 1713 !strcmp(psk->psk_ifname, 1714 s->kif->pfik_name))) { 1715 pf_unlink_state(s, PF_ENTER_LOCKED); 1716 killed++; 1717 goto relock_DIOCKILLSTATES; 1718 } 1719 } 1720 PF_HASHROW_UNLOCK(ih); 1721 } 1722 psk->psk_killed = killed; 1723 break; 1724 } 1725 1726 case DIOCADDSTATE: { 1727 struct pfioc_state *ps = (struct pfioc_state *)addr; 1728 struct pfsync_state *sp = &ps->state; 1729 1730 if (sp->timeout >= PFTM_MAX) { 1731 error = EINVAL; 1732 break; 1733 } 1734 if (pfsync_state_import_ptr != NULL) { 1735 PF_RULES_RLOCK(); 1736 error = pfsync_state_import_ptr(sp, PFSYNC_SI_IOCTL); 1737 PF_RULES_RUNLOCK(); 1738 } else 1739 error = EOPNOTSUPP; 1740 break; 1741 } 1742 1743 case DIOCGETSTATE: { 1744 struct pfioc_state *ps = (struct pfioc_state *)addr; 1745 struct pf_state *s; 1746 1747 s = pf_find_state_byid(ps->state.id, ps->state.creatorid); 1748 if (s == NULL) { 1749 error = ENOENT; 1750 break; 1751 } 1752 1753 pfsync_state_export(&ps->state, s); 1754 PF_STATE_UNLOCK(s); 1755 break; 1756 } 1757 1758 case DIOCGETSTATES: { 1759 struct pfioc_states *ps = (struct pfioc_states *)addr; 1760 struct pf_state *s; 1761 struct pfsync_state *pstore, *p; 1762 int i, nr; 1763 1764 if (ps->ps_len == 0) { 1765 nr = uma_zone_get_cur(V_pf_state_z); 1766 ps->ps_len = sizeof(struct pfsync_state) * nr; 1767 break; 1768 } 1769 1770 p = pstore = malloc(ps->ps_len, M_TEMP, M_WAITOK); 1771 nr = 0; 1772 1773 for (i = 0; i <= pf_hashmask; i++) { 1774 struct pf_idhash *ih = &V_pf_idhash[i]; 1775 1776 PF_HASHROW_LOCK(ih); 1777 LIST_FOREACH(s, &ih->states, entry) { 1778 1779 if (s->timeout == PFTM_UNLINKED) 1780 continue; 1781 1782 if ((nr+1) * sizeof(*p) > ps->ps_len) { 1783 PF_HASHROW_UNLOCK(ih); 1784 goto DIOCGETSTATES_full; 1785 } 1786 pfsync_state_export(p, s); 1787 p++; 1788 nr++; 1789 } 1790 PF_HASHROW_UNLOCK(ih); 1791 } 1792 DIOCGETSTATES_full: 1793 error = copyout(pstore, ps->ps_states, 1794 sizeof(struct pfsync_state) * nr); 1795 if (error) { 1796 free(pstore, M_TEMP); 1797 break; 1798 } 1799 ps->ps_len = sizeof(struct pfsync_state) * nr; 1800 free(pstore, M_TEMP); 1801 1802 break; 1803 } 1804 1805 case DIOCGETSTATUS: { 1806 struct pf_status *s = (struct pf_status *)addr; 1807 1808 PF_RULES_RLOCK(); 1809 s->running = V_pf_status.running; 1810 s->since = V_pf_status.since; 1811 s->debug = V_pf_status.debug; 1812 s->hostid = V_pf_status.hostid; 1813 s->states = V_pf_status.states; 1814 s->src_nodes = V_pf_status.src_nodes; 1815 1816 for (int i = 0; i < PFRES_MAX; i++) 1817 s->counters[i] = 1818 counter_u64_fetch(V_pf_status.counters[i]); 1819 for (int i = 0; i < LCNT_MAX; i++) 1820 s->lcounters[i] = 1821 counter_u64_fetch(V_pf_status.lcounters[i]); 1822 for (int i = 0; i < FCNT_MAX; i++) 1823 s->fcounters[i] = 1824 counter_u64_fetch(V_pf_status.fcounters[i]); 1825 for (int i = 0; i < SCNT_MAX; i++) 1826 s->scounters[i] = 1827 counter_u64_fetch(V_pf_status.scounters[i]); 1828 1829 bcopy(V_pf_status.ifname, s->ifname, IFNAMSIZ); 1830 bcopy(V_pf_status.pf_chksum, s->pf_chksum, 1831 PF_MD5_DIGEST_LENGTH); 1832 1833 pfi_update_status(s->ifname, s); 1834 PF_RULES_RUNLOCK(); 1835 break; 1836 } 1837 1838 case DIOCSETSTATUSIF: { 1839 struct pfioc_if *pi = (struct pfioc_if *)addr; 1840 1841 if (pi->ifname[0] == 0) { 1842 bzero(V_pf_status.ifname, IFNAMSIZ); 1843 break; 1844 } 1845 PF_RULES_WLOCK(); 1846 strlcpy(V_pf_status.ifname, pi->ifname, IFNAMSIZ); 1847 PF_RULES_WUNLOCK(); 1848 break; 1849 } 1850 1851 case DIOCCLRSTATUS: { 1852 PF_RULES_WLOCK(); 1853 for (int i = 0; i < PFRES_MAX; i++) 1854 counter_u64_zero(V_pf_status.counters[i]); 1855 for (int i = 0; i < FCNT_MAX; i++) 1856 counter_u64_zero(V_pf_status.fcounters[i]); 1857 for (int i = 0; i < SCNT_MAX; i++) 1858 counter_u64_zero(V_pf_status.scounters[i]); 1859 for (int i = 0; i < LCNT_MAX; i++) 1860 counter_u64_zero(V_pf_status.lcounters[i]); 1861 V_pf_status.since = time_second; 1862 if (*V_pf_status.ifname) 1863 pfi_update_status(V_pf_status.ifname, NULL); 1864 PF_RULES_WUNLOCK(); 1865 break; 1866 } 1867 1868 case DIOCNATLOOK: { 1869 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 1870 struct pf_state_key *sk; 1871 struct pf_state *state; 1872 struct pf_state_key_cmp key; 1873 int m = 0, direction = pnl->direction; 1874 int sidx, didx; 1875 1876 /* NATLOOK src and dst are reversed, so reverse sidx/didx */ 1877 sidx = (direction == PF_IN) ? 1 : 0; 1878 didx = (direction == PF_IN) ? 0 : 1; 1879 1880 if (!pnl->proto || 1881 PF_AZERO(&pnl->saddr, pnl->af) || 1882 PF_AZERO(&pnl->daddr, pnl->af) || 1883 ((pnl->proto == IPPROTO_TCP || 1884 pnl->proto == IPPROTO_UDP) && 1885 (!pnl->dport || !pnl->sport))) 1886 error = EINVAL; 1887 else { 1888 bzero(&key, sizeof(key)); 1889 key.af = pnl->af; 1890 key.proto = pnl->proto; 1891 PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af); 1892 key.port[sidx] = pnl->sport; 1893 PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af); 1894 key.port[didx] = pnl->dport; 1895 1896 state = pf_find_state_all(&key, direction, &m); 1897 1898 if (m > 1) 1899 error = E2BIG; /* more than one state */ 1900 else if (state != NULL) { 1901 /* XXXGL: not locked read */ 1902 sk = state->key[sidx]; 1903 PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af); 1904 pnl->rsport = sk->port[sidx]; 1905 PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af); 1906 pnl->rdport = sk->port[didx]; 1907 } else 1908 error = ENOENT; 1909 } 1910 break; 1911 } 1912 1913 case DIOCSETTIMEOUT: { 1914 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1915 int old; 1916 1917 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 1918 pt->seconds < 0) { 1919 error = EINVAL; 1920 break; 1921 } 1922 PF_RULES_WLOCK(); 1923 old = V_pf_default_rule.timeout[pt->timeout]; 1924 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 1925 pt->seconds = 1; 1926 V_pf_default_rule.timeout[pt->timeout] = pt->seconds; 1927 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 1928 wakeup(pf_purge_thread); 1929 pt->seconds = old; 1930 PF_RULES_WUNLOCK(); 1931 break; 1932 } 1933 1934 case DIOCGETTIMEOUT: { 1935 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 1936 1937 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 1938 error = EINVAL; 1939 break; 1940 } 1941 PF_RULES_RLOCK(); 1942 pt->seconds = V_pf_default_rule.timeout[pt->timeout]; 1943 PF_RULES_RUNLOCK(); 1944 break; 1945 } 1946 1947 case DIOCGETLIMIT: { 1948 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1949 1950 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 1951 error = EINVAL; 1952 break; 1953 } 1954 PF_RULES_RLOCK(); 1955 pl->limit = V_pf_limits[pl->index].limit; 1956 PF_RULES_RUNLOCK(); 1957 break; 1958 } 1959 1960 case DIOCSETLIMIT: { 1961 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 1962 int old_limit; 1963 1964 PF_RULES_WLOCK(); 1965 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 1966 V_pf_limits[pl->index].zone == NULL) { 1967 PF_RULES_WUNLOCK(); 1968 error = EINVAL; 1969 break; 1970 } 1971 uma_zone_set_max(V_pf_limits[pl->index].zone, pl->limit); 1972 old_limit = V_pf_limits[pl->index].limit; 1973 V_pf_limits[pl->index].limit = pl->limit; 1974 pl->limit = old_limit; 1975 PF_RULES_WUNLOCK(); 1976 break; 1977 } 1978 1979 case DIOCSETDEBUG: { 1980 u_int32_t *level = (u_int32_t *)addr; 1981 1982 PF_RULES_WLOCK(); 1983 V_pf_status.debug = *level; 1984 PF_RULES_WUNLOCK(); 1985 break; 1986 } 1987 1988 case DIOCCLRRULECTRS: { 1989 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 1990 struct pf_ruleset *ruleset = &pf_main_ruleset; 1991 struct pf_rule *rule; 1992 1993 PF_RULES_WLOCK(); 1994 TAILQ_FOREACH(rule, 1995 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 1996 rule->evaluations = 0; 1997 rule->packets[0] = rule->packets[1] = 0; 1998 rule->bytes[0] = rule->bytes[1] = 0; 1999 } 2000 PF_RULES_WUNLOCK(); 2001 break; 2002 } 2003 2004 case DIOCGIFSPEED: { 2005 struct pf_ifspeed *psp = (struct pf_ifspeed *)addr; 2006 struct pf_ifspeed ps; 2007 struct ifnet *ifp; 2008 2009 if (psp->ifname[0] != 0) { 2010 /* Can we completely trust user-land? */ 2011 strlcpy(ps.ifname, psp->ifname, IFNAMSIZ); 2012 ifp = ifunit(ps.ifname); 2013 if (ifp != NULL) 2014 psp->baudrate = ifp->if_baudrate; 2015 else 2016 error = EINVAL; 2017 } else 2018 error = EINVAL; 2019 break; 2020 } 2021 2022 #ifdef ALTQ 2023 case DIOCSTARTALTQ: { 2024 struct pf_altq *altq; 2025 2026 PF_RULES_WLOCK(); 2027 /* enable all altq interfaces on active list */ 2028 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 2029 if (altq->qname[0] == 0 && (altq->local_flags & 2030 PFALTQ_FLAG_IF_REMOVED) == 0) { 2031 error = pf_enable_altq(altq); 2032 if (error != 0) 2033 break; 2034 } 2035 } 2036 if (error == 0) 2037 V_pf_altq_running = 1; 2038 PF_RULES_WUNLOCK(); 2039 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 2040 break; 2041 } 2042 2043 case DIOCSTOPALTQ: { 2044 struct pf_altq *altq; 2045 2046 PF_RULES_WLOCK(); 2047 /* disable all altq interfaces on active list */ 2048 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 2049 if (altq->qname[0] == 0 && (altq->local_flags & 2050 PFALTQ_FLAG_IF_REMOVED) == 0) { 2051 error = pf_disable_altq(altq); 2052 if (error != 0) 2053 break; 2054 } 2055 } 2056 if (error == 0) 2057 V_pf_altq_running = 0; 2058 PF_RULES_WUNLOCK(); 2059 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 2060 break; 2061 } 2062 2063 case DIOCADDALTQ: { 2064 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2065 struct pf_altq *altq, *a; 2066 struct ifnet *ifp; 2067 2068 altq = malloc(sizeof(*altq), M_PFALTQ, M_WAITOK); 2069 bcopy(&pa->altq, altq, sizeof(struct pf_altq)); 2070 altq->local_flags = 0; 2071 2072 PF_RULES_WLOCK(); 2073 if (pa->ticket != V_ticket_altqs_inactive) { 2074 PF_RULES_WUNLOCK(); 2075 free(altq, M_PFALTQ); 2076 error = EBUSY; 2077 break; 2078 } 2079 2080 /* 2081 * if this is for a queue, find the discipline and 2082 * copy the necessary fields 2083 */ 2084 if (altq->qname[0] != 0) { 2085 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 2086 PF_RULES_WUNLOCK(); 2087 error = EBUSY; 2088 free(altq, M_PFALTQ); 2089 break; 2090 } 2091 altq->altq_disc = NULL; 2092 TAILQ_FOREACH(a, V_pf_altqs_inactive, entries) { 2093 if (strncmp(a->ifname, altq->ifname, 2094 IFNAMSIZ) == 0 && a->qname[0] == 0) { 2095 altq->altq_disc = a->altq_disc; 2096 break; 2097 } 2098 } 2099 } 2100 2101 if ((ifp = ifunit(altq->ifname)) == NULL) 2102 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED; 2103 else 2104 error = altq_add(altq); 2105 2106 if (error) { 2107 PF_RULES_WUNLOCK(); 2108 free(altq, M_PFALTQ); 2109 break; 2110 } 2111 2112 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, altq, entries); 2113 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2114 PF_RULES_WUNLOCK(); 2115 break; 2116 } 2117 2118 case DIOCGETALTQS: { 2119 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2120 struct pf_altq *altq; 2121 2122 PF_RULES_RLOCK(); 2123 pa->nr = 0; 2124 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) 2125 pa->nr++; 2126 pa->ticket = V_ticket_altqs_active; 2127 PF_RULES_RUNLOCK(); 2128 break; 2129 } 2130 2131 case DIOCGETALTQ: { 2132 struct pfioc_altq *pa = (struct pfioc_altq *)addr; 2133 struct pf_altq *altq; 2134 u_int32_t nr; 2135 2136 PF_RULES_RLOCK(); 2137 if (pa->ticket != V_ticket_altqs_active) { 2138 PF_RULES_RUNLOCK(); 2139 error = EBUSY; 2140 break; 2141 } 2142 nr = 0; 2143 altq = TAILQ_FIRST(V_pf_altqs_active); 2144 while ((altq != NULL) && (nr < pa->nr)) { 2145 altq = TAILQ_NEXT(altq, entries); 2146 nr++; 2147 } 2148 if (altq == NULL) { 2149 PF_RULES_RUNLOCK(); 2150 error = EBUSY; 2151 break; 2152 } 2153 bcopy(altq, &pa->altq, sizeof(struct pf_altq)); 2154 PF_RULES_RUNLOCK(); 2155 break; 2156 } 2157 2158 case DIOCCHANGEALTQ: 2159 /* CHANGEALTQ not supported yet! */ 2160 error = ENODEV; 2161 break; 2162 2163 case DIOCGETQSTATS: { 2164 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr; 2165 struct pf_altq *altq; 2166 u_int32_t nr; 2167 int nbytes; 2168 2169 PF_RULES_RLOCK(); 2170 if (pq->ticket != V_ticket_altqs_active) { 2171 PF_RULES_RUNLOCK(); 2172 error = EBUSY; 2173 break; 2174 } 2175 nbytes = pq->nbytes; 2176 nr = 0; 2177 altq = TAILQ_FIRST(V_pf_altqs_active); 2178 while ((altq != NULL) && (nr < pq->nr)) { 2179 altq = TAILQ_NEXT(altq, entries); 2180 nr++; 2181 } 2182 if (altq == NULL) { 2183 PF_RULES_RUNLOCK(); 2184 error = EBUSY; 2185 break; 2186 } 2187 2188 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) != 0) { 2189 PF_RULES_RUNLOCK(); 2190 error = ENXIO; 2191 break; 2192 } 2193 PF_RULES_RUNLOCK(); 2194 error = altq_getqstats(altq, pq->buf, &nbytes); 2195 if (error == 0) { 2196 pq->scheduler = altq->scheduler; 2197 pq->nbytes = nbytes; 2198 } 2199 break; 2200 } 2201 #endif /* ALTQ */ 2202 2203 case DIOCBEGINADDRS: { 2204 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2205 2206 PF_RULES_WLOCK(); 2207 pf_empty_pool(&V_pf_pabuf); 2208 pp->ticket = ++V_ticket_pabuf; 2209 PF_RULES_WUNLOCK(); 2210 break; 2211 } 2212 2213 case DIOCADDADDR: { 2214 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2215 struct pf_pooladdr *pa; 2216 struct pfi_kif *kif = NULL; 2217 2218 #ifndef INET 2219 if (pp->af == AF_INET) { 2220 error = EAFNOSUPPORT; 2221 break; 2222 } 2223 #endif /* INET */ 2224 #ifndef INET6 2225 if (pp->af == AF_INET6) { 2226 error = EAFNOSUPPORT; 2227 break; 2228 } 2229 #endif /* INET6 */ 2230 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 2231 pp->addr.addr.type != PF_ADDR_DYNIFTL && 2232 pp->addr.addr.type != PF_ADDR_TABLE) { 2233 error = EINVAL; 2234 break; 2235 } 2236 pa = malloc(sizeof(*pa), M_PFRULE, M_WAITOK); 2237 bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr)); 2238 if (pa->ifname[0]) 2239 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 2240 PF_RULES_WLOCK(); 2241 if (pp->ticket != V_ticket_pabuf) { 2242 PF_RULES_WUNLOCK(); 2243 if (pa->ifname[0]) 2244 free(kif, PFI_MTYPE); 2245 free(pa, M_PFRULE); 2246 error = EBUSY; 2247 break; 2248 } 2249 if (pa->ifname[0]) { 2250 pa->kif = pfi_kif_attach(kif, pa->ifname); 2251 pfi_kif_ref(pa->kif); 2252 } else 2253 pa->kif = NULL; 2254 if (pa->addr.type == PF_ADDR_DYNIFTL && ((error = 2255 pfi_dynaddr_setup(&pa->addr, pp->af)) != 0)) { 2256 if (pa->ifname[0]) 2257 pfi_kif_unref(pa->kif); 2258 PF_RULES_WUNLOCK(); 2259 free(pa, M_PFRULE); 2260 break; 2261 } 2262 TAILQ_INSERT_TAIL(&V_pf_pabuf, pa, entries); 2263 PF_RULES_WUNLOCK(); 2264 break; 2265 } 2266 2267 case DIOCGETADDRS: { 2268 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2269 struct pf_pool *pool; 2270 struct pf_pooladdr *pa; 2271 2272 PF_RULES_RLOCK(); 2273 pp->nr = 0; 2274 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2275 pp->r_num, 0, 1, 0); 2276 if (pool == NULL) { 2277 PF_RULES_RUNLOCK(); 2278 error = EBUSY; 2279 break; 2280 } 2281 TAILQ_FOREACH(pa, &pool->list, entries) 2282 pp->nr++; 2283 PF_RULES_RUNLOCK(); 2284 break; 2285 } 2286 2287 case DIOCGETADDR: { 2288 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 2289 struct pf_pool *pool; 2290 struct pf_pooladdr *pa; 2291 u_int32_t nr = 0; 2292 2293 PF_RULES_RLOCK(); 2294 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action, 2295 pp->r_num, 0, 1, 1); 2296 if (pool == NULL) { 2297 PF_RULES_RUNLOCK(); 2298 error = EBUSY; 2299 break; 2300 } 2301 pa = TAILQ_FIRST(&pool->list); 2302 while ((pa != NULL) && (nr < pp->nr)) { 2303 pa = TAILQ_NEXT(pa, entries); 2304 nr++; 2305 } 2306 if (pa == NULL) { 2307 PF_RULES_RUNLOCK(); 2308 error = EBUSY; 2309 break; 2310 } 2311 bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr)); 2312 pf_addr_copyout(&pp->addr.addr); 2313 PF_RULES_RUNLOCK(); 2314 break; 2315 } 2316 2317 case DIOCCHANGEADDR: { 2318 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 2319 struct pf_pool *pool; 2320 struct pf_pooladdr *oldpa = NULL, *newpa = NULL; 2321 struct pf_ruleset *ruleset; 2322 struct pfi_kif *kif = NULL; 2323 2324 if (pca->action < PF_CHANGE_ADD_HEAD || 2325 pca->action > PF_CHANGE_REMOVE) { 2326 error = EINVAL; 2327 break; 2328 } 2329 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 2330 pca->addr.addr.type != PF_ADDR_DYNIFTL && 2331 pca->addr.addr.type != PF_ADDR_TABLE) { 2332 error = EINVAL; 2333 break; 2334 } 2335 2336 if (pca->action != PF_CHANGE_REMOVE) { 2337 #ifndef INET 2338 if (pca->af == AF_INET) { 2339 error = EAFNOSUPPORT; 2340 break; 2341 } 2342 #endif /* INET */ 2343 #ifndef INET6 2344 if (pca->af == AF_INET6) { 2345 error = EAFNOSUPPORT; 2346 break; 2347 } 2348 #endif /* INET6 */ 2349 newpa = malloc(sizeof(*newpa), M_PFRULE, M_WAITOK); 2350 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 2351 if (newpa->ifname[0]) 2352 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 2353 newpa->kif = NULL; 2354 } 2355 2356 #define ERROUT(x) { error = (x); goto DIOCCHANGEADDR_error; } 2357 PF_RULES_WLOCK(); 2358 ruleset = pf_find_ruleset(pca->anchor); 2359 if (ruleset == NULL) 2360 ERROUT(EBUSY); 2361 2362 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action, 2363 pca->r_num, pca->r_last, 1, 1); 2364 if (pool == NULL) 2365 ERROUT(EBUSY); 2366 2367 if (pca->action != PF_CHANGE_REMOVE) { 2368 if (newpa->ifname[0]) { 2369 newpa->kif = pfi_kif_attach(kif, newpa->ifname); 2370 pfi_kif_ref(newpa->kif); 2371 kif = NULL; 2372 } 2373 2374 switch (newpa->addr.type) { 2375 case PF_ADDR_DYNIFTL: 2376 error = pfi_dynaddr_setup(&newpa->addr, 2377 pca->af); 2378 break; 2379 case PF_ADDR_TABLE: 2380 newpa->addr.p.tbl = pfr_attach_table(ruleset, 2381 newpa->addr.v.tblname); 2382 if (newpa->addr.p.tbl == NULL) 2383 error = ENOMEM; 2384 break; 2385 } 2386 if (error) 2387 goto DIOCCHANGEADDR_error; 2388 } 2389 2390 switch (pca->action) { 2391 case PF_CHANGE_ADD_HEAD: 2392 oldpa = TAILQ_FIRST(&pool->list); 2393 break; 2394 case PF_CHANGE_ADD_TAIL: 2395 oldpa = TAILQ_LAST(&pool->list, pf_palist); 2396 break; 2397 default: 2398 oldpa = TAILQ_FIRST(&pool->list); 2399 for (int i = 0; oldpa && i < pca->nr; i++) 2400 oldpa = TAILQ_NEXT(oldpa, entries); 2401 2402 if (oldpa == NULL) 2403 ERROUT(EINVAL); 2404 } 2405 2406 if (pca->action == PF_CHANGE_REMOVE) { 2407 TAILQ_REMOVE(&pool->list, oldpa, entries); 2408 switch (oldpa->addr.type) { 2409 case PF_ADDR_DYNIFTL: 2410 pfi_dynaddr_remove(oldpa->addr.p.dyn); 2411 break; 2412 case PF_ADDR_TABLE: 2413 pfr_detach_table(oldpa->addr.p.tbl); 2414 break; 2415 } 2416 if (oldpa->kif) 2417 pfi_kif_unref(oldpa->kif); 2418 free(oldpa, M_PFRULE); 2419 } else { 2420 if (oldpa == NULL) 2421 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 2422 else if (pca->action == PF_CHANGE_ADD_HEAD || 2423 pca->action == PF_CHANGE_ADD_BEFORE) 2424 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 2425 else 2426 TAILQ_INSERT_AFTER(&pool->list, oldpa, 2427 newpa, entries); 2428 } 2429 2430 pool->cur = TAILQ_FIRST(&pool->list); 2431 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, pca->af); 2432 PF_RULES_WUNLOCK(); 2433 break; 2434 2435 #undef ERROUT 2436 DIOCCHANGEADDR_error: 2437 if (newpa != NULL) { 2438 if (newpa->kif) 2439 pfi_kif_unref(newpa->kif); 2440 free(newpa, M_PFRULE); 2441 } 2442 PF_RULES_WUNLOCK(); 2443 if (kif != NULL) 2444 free(kif, PFI_MTYPE); 2445 break; 2446 } 2447 2448 case DIOCGETRULESETS: { 2449 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2450 struct pf_ruleset *ruleset; 2451 struct pf_anchor *anchor; 2452 2453 PF_RULES_RLOCK(); 2454 pr->path[sizeof(pr->path) - 1] = 0; 2455 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2456 PF_RULES_RUNLOCK(); 2457 error = ENOENT; 2458 break; 2459 } 2460 pr->nr = 0; 2461 if (ruleset->anchor == NULL) { 2462 /* XXX kludge for pf_main_ruleset */ 2463 RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors) 2464 if (anchor->parent == NULL) 2465 pr->nr++; 2466 } else { 2467 RB_FOREACH(anchor, pf_anchor_node, 2468 &ruleset->anchor->children) 2469 pr->nr++; 2470 } 2471 PF_RULES_RUNLOCK(); 2472 break; 2473 } 2474 2475 case DIOCGETRULESET: { 2476 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 2477 struct pf_ruleset *ruleset; 2478 struct pf_anchor *anchor; 2479 u_int32_t nr = 0; 2480 2481 PF_RULES_RLOCK(); 2482 pr->path[sizeof(pr->path) - 1] = 0; 2483 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) { 2484 PF_RULES_RUNLOCK(); 2485 error = ENOENT; 2486 break; 2487 } 2488 pr->name[0] = 0; 2489 if (ruleset->anchor == NULL) { 2490 /* XXX kludge for pf_main_ruleset */ 2491 RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors) 2492 if (anchor->parent == NULL && nr++ == pr->nr) { 2493 strlcpy(pr->name, anchor->name, 2494 sizeof(pr->name)); 2495 break; 2496 } 2497 } else { 2498 RB_FOREACH(anchor, pf_anchor_node, 2499 &ruleset->anchor->children) 2500 if (nr++ == pr->nr) { 2501 strlcpy(pr->name, anchor->name, 2502 sizeof(pr->name)); 2503 break; 2504 } 2505 } 2506 if (!pr->name[0]) 2507 error = EBUSY; 2508 PF_RULES_RUNLOCK(); 2509 break; 2510 } 2511 2512 case DIOCRCLRTABLES: { 2513 struct pfioc_table *io = (struct pfioc_table *)addr; 2514 2515 if (io->pfrio_esize != 0) { 2516 error = ENODEV; 2517 break; 2518 } 2519 PF_RULES_WLOCK(); 2520 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 2521 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2522 PF_RULES_WUNLOCK(); 2523 break; 2524 } 2525 2526 case DIOCRADDTABLES: { 2527 struct pfioc_table *io = (struct pfioc_table *)addr; 2528 struct pfr_table *pfrts; 2529 size_t totlen; 2530 2531 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2532 error = ENODEV; 2533 break; 2534 } 2535 2536 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 2537 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 2538 error = ENOMEM; 2539 break; 2540 } 2541 2542 totlen = io->pfrio_size * sizeof(struct pfr_table); 2543 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 2544 M_TEMP, M_WAITOK); 2545 error = copyin(io->pfrio_buffer, pfrts, totlen); 2546 if (error) { 2547 free(pfrts, M_TEMP); 2548 break; 2549 } 2550 PF_RULES_WLOCK(); 2551 error = pfr_add_tables(pfrts, io->pfrio_size, 2552 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2553 PF_RULES_WUNLOCK(); 2554 free(pfrts, M_TEMP); 2555 break; 2556 } 2557 2558 case DIOCRDELTABLES: { 2559 struct pfioc_table *io = (struct pfioc_table *)addr; 2560 struct pfr_table *pfrts; 2561 size_t totlen; 2562 2563 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2564 error = ENODEV; 2565 break; 2566 } 2567 2568 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 2569 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 2570 error = ENOMEM; 2571 break; 2572 } 2573 2574 totlen = io->pfrio_size * sizeof(struct pfr_table); 2575 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 2576 M_TEMP, M_WAITOK); 2577 error = copyin(io->pfrio_buffer, pfrts, totlen); 2578 if (error) { 2579 free(pfrts, M_TEMP); 2580 break; 2581 } 2582 PF_RULES_WLOCK(); 2583 error = pfr_del_tables(pfrts, io->pfrio_size, 2584 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2585 PF_RULES_WUNLOCK(); 2586 free(pfrts, M_TEMP); 2587 break; 2588 } 2589 2590 case DIOCRGETTABLES: { 2591 struct pfioc_table *io = (struct pfioc_table *)addr; 2592 struct pfr_table *pfrts; 2593 size_t totlen, n; 2594 2595 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2596 error = ENODEV; 2597 break; 2598 } 2599 PF_RULES_RLOCK(); 2600 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 2601 io->pfrio_size = min(io->pfrio_size, n); 2602 2603 totlen = io->pfrio_size * sizeof(struct pfr_table); 2604 2605 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 2606 M_TEMP, M_NOWAIT); 2607 if (pfrts == NULL) { 2608 error = ENOMEM; 2609 PF_RULES_RUNLOCK(); 2610 break; 2611 } 2612 error = pfr_get_tables(&io->pfrio_table, pfrts, 2613 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2614 PF_RULES_RUNLOCK(); 2615 if (error == 0) 2616 error = copyout(pfrts, io->pfrio_buffer, totlen); 2617 free(pfrts, M_TEMP); 2618 break; 2619 } 2620 2621 case DIOCRGETTSTATS: { 2622 struct pfioc_table *io = (struct pfioc_table *)addr; 2623 struct pfr_tstats *pfrtstats; 2624 size_t totlen, n; 2625 2626 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 2627 error = ENODEV; 2628 break; 2629 } 2630 PF_RULES_WLOCK(); 2631 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 2632 io->pfrio_size = min(io->pfrio_size, n); 2633 2634 totlen = io->pfrio_size * sizeof(struct pfr_tstats); 2635 pfrtstats = mallocarray(io->pfrio_size, 2636 sizeof(struct pfr_tstats), M_TEMP, M_NOWAIT); 2637 if (pfrtstats == NULL) { 2638 error = ENOMEM; 2639 PF_RULES_WUNLOCK(); 2640 break; 2641 } 2642 error = pfr_get_tstats(&io->pfrio_table, pfrtstats, 2643 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2644 PF_RULES_WUNLOCK(); 2645 if (error == 0) 2646 error = copyout(pfrtstats, io->pfrio_buffer, totlen); 2647 free(pfrtstats, M_TEMP); 2648 break; 2649 } 2650 2651 case DIOCRCLRTSTATS: { 2652 struct pfioc_table *io = (struct pfioc_table *)addr; 2653 struct pfr_table *pfrts; 2654 size_t totlen, n; 2655 2656 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2657 error = ENODEV; 2658 break; 2659 } 2660 2661 PF_RULES_WLOCK(); 2662 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 2663 io->pfrio_size = min(io->pfrio_size, n); 2664 2665 totlen = io->pfrio_size * sizeof(struct pfr_table); 2666 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 2667 M_TEMP, M_NOWAIT); 2668 if (pfrts == NULL) { 2669 error = ENOMEM; 2670 PF_RULES_WUNLOCK(); 2671 break; 2672 } 2673 error = copyin(io->pfrio_buffer, pfrts, totlen); 2674 if (error) { 2675 free(pfrts, M_TEMP); 2676 PF_RULES_WUNLOCK(); 2677 break; 2678 } 2679 error = pfr_clr_tstats(pfrts, io->pfrio_size, 2680 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2681 PF_RULES_WUNLOCK(); 2682 free(pfrts, M_TEMP); 2683 break; 2684 } 2685 2686 case DIOCRSETTFLAGS: { 2687 struct pfioc_table *io = (struct pfioc_table *)addr; 2688 struct pfr_table *pfrts; 2689 size_t totlen, n; 2690 2691 if (io->pfrio_esize != sizeof(struct pfr_table)) { 2692 error = ENODEV; 2693 break; 2694 } 2695 2696 PF_RULES_WLOCK(); 2697 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 2698 io->pfrio_size = min(io->pfrio_size, n); 2699 2700 totlen = io->pfrio_size * sizeof(struct pfr_table); 2701 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 2702 M_TEMP, M_NOWAIT); 2703 if (pfrts == NULL) { 2704 error = ENOMEM; 2705 PF_RULES_WUNLOCK(); 2706 break; 2707 } 2708 error = copyin(io->pfrio_buffer, pfrts, totlen); 2709 if (error) { 2710 free(pfrts, M_TEMP); 2711 PF_RULES_WUNLOCK(); 2712 break; 2713 } 2714 error = pfr_set_tflags(pfrts, io->pfrio_size, 2715 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 2716 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2717 PF_RULES_WUNLOCK(); 2718 free(pfrts, M_TEMP); 2719 break; 2720 } 2721 2722 case DIOCRCLRADDRS: { 2723 struct pfioc_table *io = (struct pfioc_table *)addr; 2724 2725 if (io->pfrio_esize != 0) { 2726 error = ENODEV; 2727 break; 2728 } 2729 PF_RULES_WLOCK(); 2730 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 2731 io->pfrio_flags | PFR_FLAG_USERIOCTL); 2732 PF_RULES_WUNLOCK(); 2733 break; 2734 } 2735 2736 case DIOCRADDADDRS: { 2737 struct pfioc_table *io = (struct pfioc_table *)addr; 2738 struct pfr_addr *pfras; 2739 size_t totlen; 2740 2741 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2742 error = ENODEV; 2743 break; 2744 } 2745 if (io->pfrio_size < 0 || 2746 io->pfrio_size > pf_ioctl_maxcount || 2747 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 2748 error = EINVAL; 2749 break; 2750 } 2751 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2752 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 2753 M_TEMP, M_NOWAIT); 2754 if (! pfras) { 2755 error = ENOMEM; 2756 break; 2757 } 2758 error = copyin(io->pfrio_buffer, pfras, totlen); 2759 if (error) { 2760 free(pfras, M_TEMP); 2761 break; 2762 } 2763 PF_RULES_WLOCK(); 2764 error = pfr_add_addrs(&io->pfrio_table, pfras, 2765 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 2766 PFR_FLAG_USERIOCTL); 2767 PF_RULES_WUNLOCK(); 2768 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2769 error = copyout(pfras, io->pfrio_buffer, totlen); 2770 free(pfras, M_TEMP); 2771 break; 2772 } 2773 2774 case DIOCRDELADDRS: { 2775 struct pfioc_table *io = (struct pfioc_table *)addr; 2776 struct pfr_addr *pfras; 2777 size_t totlen; 2778 2779 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2780 error = ENODEV; 2781 break; 2782 } 2783 if (io->pfrio_size < 0 || 2784 io->pfrio_size > pf_ioctl_maxcount || 2785 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 2786 error = EINVAL; 2787 break; 2788 } 2789 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2790 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 2791 M_TEMP, M_NOWAIT); 2792 if (! pfras) { 2793 error = ENOMEM; 2794 break; 2795 } 2796 error = copyin(io->pfrio_buffer, pfras, totlen); 2797 if (error) { 2798 free(pfras, M_TEMP); 2799 break; 2800 } 2801 PF_RULES_WLOCK(); 2802 error = pfr_del_addrs(&io->pfrio_table, pfras, 2803 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 2804 PFR_FLAG_USERIOCTL); 2805 PF_RULES_WUNLOCK(); 2806 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2807 error = copyout(pfras, io->pfrio_buffer, totlen); 2808 free(pfras, M_TEMP); 2809 break; 2810 } 2811 2812 case DIOCRSETADDRS: { 2813 struct pfioc_table *io = (struct pfioc_table *)addr; 2814 struct pfr_addr *pfras; 2815 size_t totlen, count; 2816 2817 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2818 error = ENODEV; 2819 break; 2820 } 2821 if (io->pfrio_size < 0 || io->pfrio_size2 < 0) { 2822 error = EINVAL; 2823 break; 2824 } 2825 count = max(io->pfrio_size, io->pfrio_size2); 2826 if (count > pf_ioctl_maxcount || 2827 WOULD_OVERFLOW(count, sizeof(struct pfr_addr))) { 2828 error = EINVAL; 2829 break; 2830 } 2831 totlen = count * sizeof(struct pfr_addr); 2832 pfras = mallocarray(count, sizeof(struct pfr_addr), M_TEMP, 2833 M_NOWAIT); 2834 if (! pfras) { 2835 error = ENOMEM; 2836 break; 2837 } 2838 error = copyin(io->pfrio_buffer, pfras, totlen); 2839 if (error) { 2840 free(pfras, M_TEMP); 2841 break; 2842 } 2843 PF_RULES_WLOCK(); 2844 error = pfr_set_addrs(&io->pfrio_table, pfras, 2845 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 2846 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 2847 PFR_FLAG_USERIOCTL, 0); 2848 PF_RULES_WUNLOCK(); 2849 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2850 error = copyout(pfras, io->pfrio_buffer, totlen); 2851 free(pfras, M_TEMP); 2852 break; 2853 } 2854 2855 case DIOCRGETADDRS: { 2856 struct pfioc_table *io = (struct pfioc_table *)addr; 2857 struct pfr_addr *pfras; 2858 size_t totlen; 2859 2860 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2861 error = ENODEV; 2862 break; 2863 } 2864 if (io->pfrio_size < 0 || 2865 io->pfrio_size > pf_ioctl_maxcount || 2866 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 2867 error = EINVAL; 2868 break; 2869 } 2870 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2871 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 2872 M_TEMP, M_NOWAIT); 2873 if (! pfras) { 2874 error = ENOMEM; 2875 break; 2876 } 2877 PF_RULES_RLOCK(); 2878 error = pfr_get_addrs(&io->pfrio_table, pfras, 2879 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2880 PF_RULES_RUNLOCK(); 2881 if (error == 0) 2882 error = copyout(pfras, io->pfrio_buffer, totlen); 2883 free(pfras, M_TEMP); 2884 break; 2885 } 2886 2887 case DIOCRGETASTATS: { 2888 struct pfioc_table *io = (struct pfioc_table *)addr; 2889 struct pfr_astats *pfrastats; 2890 size_t totlen; 2891 2892 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 2893 error = ENODEV; 2894 break; 2895 } 2896 if (io->pfrio_size < 0 || 2897 io->pfrio_size > pf_ioctl_maxcount || 2898 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_astats))) { 2899 error = EINVAL; 2900 break; 2901 } 2902 totlen = io->pfrio_size * sizeof(struct pfr_astats); 2903 pfrastats = mallocarray(io->pfrio_size, 2904 sizeof(struct pfr_astats), M_TEMP, M_NOWAIT); 2905 if (! pfrastats) { 2906 error = ENOMEM; 2907 break; 2908 } 2909 PF_RULES_RLOCK(); 2910 error = pfr_get_astats(&io->pfrio_table, pfrastats, 2911 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 2912 PF_RULES_RUNLOCK(); 2913 if (error == 0) 2914 error = copyout(pfrastats, io->pfrio_buffer, totlen); 2915 free(pfrastats, M_TEMP); 2916 break; 2917 } 2918 2919 case DIOCRCLRASTATS: { 2920 struct pfioc_table *io = (struct pfioc_table *)addr; 2921 struct pfr_addr *pfras; 2922 size_t totlen; 2923 2924 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2925 error = ENODEV; 2926 break; 2927 } 2928 if (io->pfrio_size < 0 || 2929 io->pfrio_size > pf_ioctl_maxcount || 2930 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 2931 error = EINVAL; 2932 break; 2933 } 2934 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2935 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 2936 M_TEMP, M_NOWAIT); 2937 if (! pfras) { 2938 error = ENOMEM; 2939 break; 2940 } 2941 error = copyin(io->pfrio_buffer, pfras, totlen); 2942 if (error) { 2943 free(pfras, M_TEMP); 2944 break; 2945 } 2946 PF_RULES_WLOCK(); 2947 error = pfr_clr_astats(&io->pfrio_table, pfras, 2948 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 2949 PFR_FLAG_USERIOCTL); 2950 PF_RULES_WUNLOCK(); 2951 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 2952 error = copyout(pfras, io->pfrio_buffer, totlen); 2953 free(pfras, M_TEMP); 2954 break; 2955 } 2956 2957 case DIOCRTSTADDRS: { 2958 struct pfioc_table *io = (struct pfioc_table *)addr; 2959 struct pfr_addr *pfras; 2960 size_t totlen; 2961 2962 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 2963 error = ENODEV; 2964 break; 2965 } 2966 if (io->pfrio_size < 0 || 2967 io->pfrio_size > pf_ioctl_maxcount || 2968 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 2969 error = EINVAL; 2970 break; 2971 } 2972 totlen = io->pfrio_size * sizeof(struct pfr_addr); 2973 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 2974 M_TEMP, M_NOWAIT); 2975 if (! pfras) { 2976 error = ENOMEM; 2977 break; 2978 } 2979 error = copyin(io->pfrio_buffer, pfras, totlen); 2980 if (error) { 2981 free(pfras, M_TEMP); 2982 break; 2983 } 2984 PF_RULES_RLOCK(); 2985 error = pfr_tst_addrs(&io->pfrio_table, pfras, 2986 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 2987 PFR_FLAG_USERIOCTL); 2988 PF_RULES_RUNLOCK(); 2989 if (error == 0) 2990 error = copyout(pfras, io->pfrio_buffer, totlen); 2991 free(pfras, M_TEMP); 2992 break; 2993 } 2994 2995 case DIOCRINADEFINE: { 2996 struct pfioc_table *io = (struct pfioc_table *)addr; 2997 struct pfr_addr *pfras; 2998 size_t totlen; 2999 3000 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 3001 error = ENODEV; 3002 break; 3003 } 3004 if (io->pfrio_size < 0 || 3005 io->pfrio_size > pf_ioctl_maxcount || 3006 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 3007 error = EINVAL; 3008 break; 3009 } 3010 totlen = io->pfrio_size * sizeof(struct pfr_addr); 3011 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 3012 M_TEMP, M_NOWAIT); 3013 if (! pfras) { 3014 error = ENOMEM; 3015 break; 3016 } 3017 error = copyin(io->pfrio_buffer, pfras, totlen); 3018 if (error) { 3019 free(pfras, M_TEMP); 3020 break; 3021 } 3022 PF_RULES_WLOCK(); 3023 error = pfr_ina_define(&io->pfrio_table, pfras, 3024 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 3025 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3026 PF_RULES_WUNLOCK(); 3027 free(pfras, M_TEMP); 3028 break; 3029 } 3030 3031 case DIOCOSFPADD: { 3032 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 3033 PF_RULES_WLOCK(); 3034 error = pf_osfp_add(io); 3035 PF_RULES_WUNLOCK(); 3036 break; 3037 } 3038 3039 case DIOCOSFPGET: { 3040 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 3041 PF_RULES_RLOCK(); 3042 error = pf_osfp_get(io); 3043 PF_RULES_RUNLOCK(); 3044 break; 3045 } 3046 3047 case DIOCXBEGIN: { 3048 struct pfioc_trans *io = (struct pfioc_trans *)addr; 3049 struct pfioc_trans_e *ioes, *ioe; 3050 size_t totlen; 3051 int i; 3052 3053 if (io->esize != sizeof(*ioe)) { 3054 error = ENODEV; 3055 break; 3056 } 3057 if (io->size < 0 || 3058 io->size > pf_ioctl_maxcount || 3059 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 3060 error = EINVAL; 3061 break; 3062 } 3063 totlen = sizeof(struct pfioc_trans_e) * io->size; 3064 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 3065 M_TEMP, M_NOWAIT); 3066 if (! ioes) { 3067 error = ENOMEM; 3068 break; 3069 } 3070 error = copyin(io->array, ioes, totlen); 3071 if (error) { 3072 free(ioes, M_TEMP); 3073 break; 3074 } 3075 PF_RULES_WLOCK(); 3076 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 3077 switch (ioe->rs_num) { 3078 #ifdef ALTQ 3079 case PF_RULESET_ALTQ: 3080 if (ioe->anchor[0]) { 3081 PF_RULES_WUNLOCK(); 3082 free(ioes, M_TEMP); 3083 error = EINVAL; 3084 goto fail; 3085 } 3086 if ((error = pf_begin_altq(&ioe->ticket))) { 3087 PF_RULES_WUNLOCK(); 3088 free(ioes, M_TEMP); 3089 goto fail; 3090 } 3091 break; 3092 #endif /* ALTQ */ 3093 case PF_RULESET_TABLE: 3094 { 3095 struct pfr_table table; 3096 3097 bzero(&table, sizeof(table)); 3098 strlcpy(table.pfrt_anchor, ioe->anchor, 3099 sizeof(table.pfrt_anchor)); 3100 if ((error = pfr_ina_begin(&table, 3101 &ioe->ticket, NULL, 0))) { 3102 PF_RULES_WUNLOCK(); 3103 free(ioes, M_TEMP); 3104 goto fail; 3105 } 3106 break; 3107 } 3108 default: 3109 if ((error = pf_begin_rules(&ioe->ticket, 3110 ioe->rs_num, ioe->anchor))) { 3111 PF_RULES_WUNLOCK(); 3112 free(ioes, M_TEMP); 3113 goto fail; 3114 } 3115 break; 3116 } 3117 } 3118 PF_RULES_WUNLOCK(); 3119 error = copyout(ioes, io->array, totlen); 3120 free(ioes, M_TEMP); 3121 break; 3122 } 3123 3124 case DIOCXROLLBACK: { 3125 struct pfioc_trans *io = (struct pfioc_trans *)addr; 3126 struct pfioc_trans_e *ioe, *ioes; 3127 size_t totlen; 3128 int i; 3129 3130 if (io->esize != sizeof(*ioe)) { 3131 error = ENODEV; 3132 break; 3133 } 3134 if (io->size < 0 || 3135 io->size > pf_ioctl_maxcount || 3136 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 3137 error = EINVAL; 3138 break; 3139 } 3140 totlen = sizeof(struct pfioc_trans_e) * io->size; 3141 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 3142 M_TEMP, M_NOWAIT); 3143 if (! ioes) { 3144 error = ENOMEM; 3145 break; 3146 } 3147 error = copyin(io->array, ioes, totlen); 3148 if (error) { 3149 free(ioes, M_TEMP); 3150 break; 3151 } 3152 PF_RULES_WLOCK(); 3153 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 3154 switch (ioe->rs_num) { 3155 #ifdef ALTQ 3156 case PF_RULESET_ALTQ: 3157 if (ioe->anchor[0]) { 3158 PF_RULES_WUNLOCK(); 3159 free(ioes, M_TEMP); 3160 error = EINVAL; 3161 goto fail; 3162 } 3163 if ((error = pf_rollback_altq(ioe->ticket))) { 3164 PF_RULES_WUNLOCK(); 3165 free(ioes, M_TEMP); 3166 goto fail; /* really bad */ 3167 } 3168 break; 3169 #endif /* ALTQ */ 3170 case PF_RULESET_TABLE: 3171 { 3172 struct pfr_table table; 3173 3174 bzero(&table, sizeof(table)); 3175 strlcpy(table.pfrt_anchor, ioe->anchor, 3176 sizeof(table.pfrt_anchor)); 3177 if ((error = pfr_ina_rollback(&table, 3178 ioe->ticket, NULL, 0))) { 3179 PF_RULES_WUNLOCK(); 3180 free(ioes, M_TEMP); 3181 goto fail; /* really bad */ 3182 } 3183 break; 3184 } 3185 default: 3186 if ((error = pf_rollback_rules(ioe->ticket, 3187 ioe->rs_num, ioe->anchor))) { 3188 PF_RULES_WUNLOCK(); 3189 free(ioes, M_TEMP); 3190 goto fail; /* really bad */ 3191 } 3192 break; 3193 } 3194 } 3195 PF_RULES_WUNLOCK(); 3196 free(ioes, M_TEMP); 3197 break; 3198 } 3199 3200 case DIOCXCOMMIT: { 3201 struct pfioc_trans *io = (struct pfioc_trans *)addr; 3202 struct pfioc_trans_e *ioe, *ioes; 3203 struct pf_ruleset *rs; 3204 size_t totlen; 3205 int i; 3206 3207 if (io->esize != sizeof(*ioe)) { 3208 error = ENODEV; 3209 break; 3210 } 3211 3212 if (io->size < 0 || 3213 io->size > pf_ioctl_maxcount || 3214 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 3215 error = EINVAL; 3216 break; 3217 } 3218 3219 totlen = sizeof(struct pfioc_trans_e) * io->size; 3220 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 3221 M_TEMP, M_NOWAIT); 3222 if (ioes == NULL) { 3223 error = ENOMEM; 3224 break; 3225 } 3226 error = copyin(io->array, ioes, totlen); 3227 if (error) { 3228 free(ioes, M_TEMP); 3229 break; 3230 } 3231 PF_RULES_WLOCK(); 3232 /* First makes sure everything will succeed. */ 3233 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 3234 switch (ioe->rs_num) { 3235 #ifdef ALTQ 3236 case PF_RULESET_ALTQ: 3237 if (ioe->anchor[0]) { 3238 PF_RULES_WUNLOCK(); 3239 free(ioes, M_TEMP); 3240 error = EINVAL; 3241 goto fail; 3242 } 3243 if (!V_altqs_inactive_open || ioe->ticket != 3244 V_ticket_altqs_inactive) { 3245 PF_RULES_WUNLOCK(); 3246 free(ioes, M_TEMP); 3247 error = EBUSY; 3248 goto fail; 3249 } 3250 break; 3251 #endif /* ALTQ */ 3252 case PF_RULESET_TABLE: 3253 rs = pf_find_ruleset(ioe->anchor); 3254 if (rs == NULL || !rs->topen || ioe->ticket != 3255 rs->tticket) { 3256 PF_RULES_WUNLOCK(); 3257 free(ioes, M_TEMP); 3258 error = EBUSY; 3259 goto fail; 3260 } 3261 break; 3262 default: 3263 if (ioe->rs_num < 0 || ioe->rs_num >= 3264 PF_RULESET_MAX) { 3265 PF_RULES_WUNLOCK(); 3266 free(ioes, M_TEMP); 3267 error = EINVAL; 3268 goto fail; 3269 } 3270 rs = pf_find_ruleset(ioe->anchor); 3271 if (rs == NULL || 3272 !rs->rules[ioe->rs_num].inactive.open || 3273 rs->rules[ioe->rs_num].inactive.ticket != 3274 ioe->ticket) { 3275 PF_RULES_WUNLOCK(); 3276 free(ioes, M_TEMP); 3277 error = EBUSY; 3278 goto fail; 3279 } 3280 break; 3281 } 3282 } 3283 /* Now do the commit - no errors should happen here. */ 3284 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 3285 switch (ioe->rs_num) { 3286 #ifdef ALTQ 3287 case PF_RULESET_ALTQ: 3288 if ((error = pf_commit_altq(ioe->ticket))) { 3289 PF_RULES_WUNLOCK(); 3290 free(ioes, M_TEMP); 3291 goto fail; /* really bad */ 3292 } 3293 break; 3294 #endif /* ALTQ */ 3295 case PF_RULESET_TABLE: 3296 { 3297 struct pfr_table table; 3298 3299 bzero(&table, sizeof(table)); 3300 strlcpy(table.pfrt_anchor, ioe->anchor, 3301 sizeof(table.pfrt_anchor)); 3302 if ((error = pfr_ina_commit(&table, 3303 ioe->ticket, NULL, NULL, 0))) { 3304 PF_RULES_WUNLOCK(); 3305 free(ioes, M_TEMP); 3306 goto fail; /* really bad */ 3307 } 3308 break; 3309 } 3310 default: 3311 if ((error = pf_commit_rules(ioe->ticket, 3312 ioe->rs_num, ioe->anchor))) { 3313 PF_RULES_WUNLOCK(); 3314 free(ioes, M_TEMP); 3315 goto fail; /* really bad */ 3316 } 3317 break; 3318 } 3319 } 3320 PF_RULES_WUNLOCK(); 3321 free(ioes, M_TEMP); 3322 break; 3323 } 3324 3325 case DIOCGETSRCNODES: { 3326 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 3327 struct pf_srchash *sh; 3328 struct pf_src_node *n, *p, *pstore; 3329 uint32_t i, nr = 0; 3330 3331 if (psn->psn_len == 0) { 3332 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 3333 i++, sh++) { 3334 PF_HASHROW_LOCK(sh); 3335 LIST_FOREACH(n, &sh->nodes, entry) 3336 nr++; 3337 PF_HASHROW_UNLOCK(sh); 3338 } 3339 psn->psn_len = sizeof(struct pf_src_node) * nr; 3340 break; 3341 } 3342 3343 p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK); 3344 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 3345 i++, sh++) { 3346 PF_HASHROW_LOCK(sh); 3347 LIST_FOREACH(n, &sh->nodes, entry) { 3348 int secs = time_uptime, diff; 3349 3350 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 3351 break; 3352 3353 bcopy(n, p, sizeof(struct pf_src_node)); 3354 if (n->rule.ptr != NULL) 3355 p->rule.nr = n->rule.ptr->nr; 3356 p->creation = secs - p->creation; 3357 if (p->expire > secs) 3358 p->expire -= secs; 3359 else 3360 p->expire = 0; 3361 3362 /* Adjust the connection rate estimate. */ 3363 diff = secs - n->conn_rate.last; 3364 if (diff >= n->conn_rate.seconds) 3365 p->conn_rate.count = 0; 3366 else 3367 p->conn_rate.count -= 3368 n->conn_rate.count * diff / 3369 n->conn_rate.seconds; 3370 p++; 3371 nr++; 3372 } 3373 PF_HASHROW_UNLOCK(sh); 3374 } 3375 error = copyout(pstore, psn->psn_src_nodes, 3376 sizeof(struct pf_src_node) * nr); 3377 if (error) { 3378 free(pstore, M_TEMP); 3379 break; 3380 } 3381 psn->psn_len = sizeof(struct pf_src_node) * nr; 3382 free(pstore, M_TEMP); 3383 break; 3384 } 3385 3386 case DIOCCLRSRCNODES: { 3387 3388 pf_clear_srcnodes(NULL); 3389 pf_purge_expired_src_nodes(); 3390 break; 3391 } 3392 3393 case DIOCKILLSRCNODES: 3394 pf_kill_srcnodes((struct pfioc_src_node_kill *)addr); 3395 break; 3396 3397 case DIOCSETHOSTID: { 3398 u_int32_t *hostid = (u_int32_t *)addr; 3399 3400 PF_RULES_WLOCK(); 3401 if (*hostid == 0) 3402 V_pf_status.hostid = arc4random(); 3403 else 3404 V_pf_status.hostid = *hostid; 3405 PF_RULES_WUNLOCK(); 3406 break; 3407 } 3408 3409 case DIOCOSFPFLUSH: 3410 PF_RULES_WLOCK(); 3411 pf_osfp_flush(); 3412 PF_RULES_WUNLOCK(); 3413 break; 3414 3415 case DIOCIGETIFACES: { 3416 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3417 struct pfi_kif *ifstore; 3418 size_t bufsiz; 3419 3420 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 3421 error = ENODEV; 3422 break; 3423 } 3424 3425 if (io->pfiio_size < 0 || 3426 io->pfiio_size > pf_ioctl_maxcount || 3427 WOULD_OVERFLOW(io->pfiio_size, sizeof(struct pfi_kif))) { 3428 error = EINVAL; 3429 break; 3430 } 3431 3432 bufsiz = io->pfiio_size * sizeof(struct pfi_kif); 3433 ifstore = mallocarray(io->pfiio_size, sizeof(struct pfi_kif), 3434 M_TEMP, M_NOWAIT); 3435 if (ifstore == NULL) { 3436 error = ENOMEM; 3437 break; 3438 } 3439 3440 PF_RULES_RLOCK(); 3441 pfi_get_ifaces(io->pfiio_name, ifstore, &io->pfiio_size); 3442 PF_RULES_RUNLOCK(); 3443 error = copyout(ifstore, io->pfiio_buffer, bufsiz); 3444 free(ifstore, M_TEMP); 3445 break; 3446 } 3447 3448 case DIOCSETIFFLAG: { 3449 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3450 3451 PF_RULES_WLOCK(); 3452 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 3453 PF_RULES_WUNLOCK(); 3454 break; 3455 } 3456 3457 case DIOCCLRIFFLAG: { 3458 struct pfioc_iface *io = (struct pfioc_iface *)addr; 3459 3460 PF_RULES_WLOCK(); 3461 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 3462 PF_RULES_WUNLOCK(); 3463 break; 3464 } 3465 3466 default: 3467 error = ENODEV; 3468 break; 3469 } 3470 fail: 3471 if (sx_xlocked(&pf_ioctl_lock)) 3472 sx_xunlock(&pf_ioctl_lock); 3473 CURVNET_RESTORE(); 3474 3475 return (error); 3476 } 3477 3478 void 3479 pfsync_state_export(struct pfsync_state *sp, struct pf_state *st) 3480 { 3481 bzero(sp, sizeof(struct pfsync_state)); 3482 3483 /* copy from state key */ 3484 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; 3485 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1]; 3486 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0]; 3487 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1]; 3488 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0]; 3489 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1]; 3490 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0]; 3491 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1]; 3492 sp->proto = st->key[PF_SK_WIRE]->proto; 3493 sp->af = st->key[PF_SK_WIRE]->af; 3494 3495 /* copy from state */ 3496 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 3497 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr)); 3498 sp->creation = htonl(time_uptime - st->creation); 3499 sp->expire = pf_state_expires(st); 3500 if (sp->expire <= time_uptime) 3501 sp->expire = htonl(0); 3502 else 3503 sp->expire = htonl(sp->expire - time_uptime); 3504 3505 sp->direction = st->direction; 3506 sp->log = st->log; 3507 sp->timeout = st->timeout; 3508 sp->state_flags = st->state_flags; 3509 if (st->src_node) 3510 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 3511 if (st->nat_src_node) 3512 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 3513 3514 sp->id = st->id; 3515 sp->creatorid = st->creatorid; 3516 pf_state_peer_hton(&st->src, &sp->src); 3517 pf_state_peer_hton(&st->dst, &sp->dst); 3518 3519 if (st->rule.ptr == NULL) 3520 sp->rule = htonl(-1); 3521 else 3522 sp->rule = htonl(st->rule.ptr->nr); 3523 if (st->anchor.ptr == NULL) 3524 sp->anchor = htonl(-1); 3525 else 3526 sp->anchor = htonl(st->anchor.ptr->nr); 3527 if (st->nat_rule.ptr == NULL) 3528 sp->nat_rule = htonl(-1); 3529 else 3530 sp->nat_rule = htonl(st->nat_rule.ptr->nr); 3531 3532 pf_state_counter_hton(st->packets[0], sp->packets[0]); 3533 pf_state_counter_hton(st->packets[1], sp->packets[1]); 3534 pf_state_counter_hton(st->bytes[0], sp->bytes[0]); 3535 pf_state_counter_hton(st->bytes[1], sp->bytes[1]); 3536 3537 } 3538 3539 static void 3540 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 3541 { 3542 struct pfr_ktable *kt; 3543 3544 KASSERT(aw->type == PF_ADDR_TABLE, ("%s: type %u", __func__, aw->type)); 3545 3546 kt = aw->p.tbl; 3547 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 3548 kt = kt->pfrkt_root; 3549 aw->p.tbl = NULL; 3550 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 3551 kt->pfrkt_cnt : -1; 3552 } 3553 3554 /* 3555 * XXX - Check for version missmatch!!! 3556 */ 3557 static void 3558 pf_clear_states(void) 3559 { 3560 struct pf_state *s; 3561 u_int i; 3562 3563 for (i = 0; i <= pf_hashmask; i++) { 3564 struct pf_idhash *ih = &V_pf_idhash[i]; 3565 relock: 3566 PF_HASHROW_LOCK(ih); 3567 LIST_FOREACH(s, &ih->states, entry) { 3568 s->timeout = PFTM_PURGE; 3569 /* Don't send out individual delete messages. */ 3570 s->state_flags |= PFSTATE_NOSYNC; 3571 pf_unlink_state(s, PF_ENTER_LOCKED); 3572 goto relock; 3573 } 3574 PF_HASHROW_UNLOCK(ih); 3575 } 3576 } 3577 3578 static int 3579 pf_clear_tables(void) 3580 { 3581 struct pfioc_table io; 3582 int error; 3583 3584 bzero(&io, sizeof(io)); 3585 3586 error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel, 3587 io.pfrio_flags); 3588 3589 return (error); 3590 } 3591 3592 static void 3593 pf_clear_srcnodes(struct pf_src_node *n) 3594 { 3595 struct pf_state *s; 3596 int i; 3597 3598 for (i = 0; i <= pf_hashmask; i++) { 3599 struct pf_idhash *ih = &V_pf_idhash[i]; 3600 3601 PF_HASHROW_LOCK(ih); 3602 LIST_FOREACH(s, &ih->states, entry) { 3603 if (n == NULL || n == s->src_node) 3604 s->src_node = NULL; 3605 if (n == NULL || n == s->nat_src_node) 3606 s->nat_src_node = NULL; 3607 } 3608 PF_HASHROW_UNLOCK(ih); 3609 } 3610 3611 if (n == NULL) { 3612 struct pf_srchash *sh; 3613 3614 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 3615 i++, sh++) { 3616 PF_HASHROW_LOCK(sh); 3617 LIST_FOREACH(n, &sh->nodes, entry) { 3618 n->expire = 1; 3619 n->states = 0; 3620 } 3621 PF_HASHROW_UNLOCK(sh); 3622 } 3623 } else { 3624 /* XXX: hash slot should already be locked here. */ 3625 n->expire = 1; 3626 n->states = 0; 3627 } 3628 } 3629 3630 static void 3631 pf_kill_srcnodes(struct pfioc_src_node_kill *psnk) 3632 { 3633 struct pf_src_node_list kill; 3634 3635 LIST_INIT(&kill); 3636 for (int i = 0; i <= pf_srchashmask; i++) { 3637 struct pf_srchash *sh = &V_pf_srchash[i]; 3638 struct pf_src_node *sn, *tmp; 3639 3640 PF_HASHROW_LOCK(sh); 3641 LIST_FOREACH_SAFE(sn, &sh->nodes, entry, tmp) 3642 if (PF_MATCHA(psnk->psnk_src.neg, 3643 &psnk->psnk_src.addr.v.a.addr, 3644 &psnk->psnk_src.addr.v.a.mask, 3645 &sn->addr, sn->af) && 3646 PF_MATCHA(psnk->psnk_dst.neg, 3647 &psnk->psnk_dst.addr.v.a.addr, 3648 &psnk->psnk_dst.addr.v.a.mask, 3649 &sn->raddr, sn->af)) { 3650 pf_unlink_src_node(sn); 3651 LIST_INSERT_HEAD(&kill, sn, entry); 3652 sn->expire = 1; 3653 } 3654 PF_HASHROW_UNLOCK(sh); 3655 } 3656 3657 for (int i = 0; i <= pf_hashmask; i++) { 3658 struct pf_idhash *ih = &V_pf_idhash[i]; 3659 struct pf_state *s; 3660 3661 PF_HASHROW_LOCK(ih); 3662 LIST_FOREACH(s, &ih->states, entry) { 3663 if (s->src_node && s->src_node->expire == 1) 3664 s->src_node = NULL; 3665 if (s->nat_src_node && s->nat_src_node->expire == 1) 3666 s->nat_src_node = NULL; 3667 } 3668 PF_HASHROW_UNLOCK(ih); 3669 } 3670 3671 psnk->psnk_killed = pf_free_src_nodes(&kill); 3672 } 3673 3674 /* 3675 * XXX - Check for version missmatch!!! 3676 */ 3677 3678 /* 3679 * Duplicate pfctl -Fa operation to get rid of as much as we can. 3680 */ 3681 static int 3682 shutdown_pf(void) 3683 { 3684 int error = 0; 3685 u_int32_t t[5]; 3686 char nn = '\0'; 3687 3688 do { 3689 if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn)) 3690 != 0) { 3691 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n")); 3692 break; 3693 } 3694 if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn)) 3695 != 0) { 3696 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n")); 3697 break; /* XXX: rollback? */ 3698 } 3699 if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn)) 3700 != 0) { 3701 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n")); 3702 break; /* XXX: rollback? */ 3703 } 3704 if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn)) 3705 != 0) { 3706 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n")); 3707 break; /* XXX: rollback? */ 3708 } 3709 if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn)) 3710 != 0) { 3711 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n")); 3712 break; /* XXX: rollback? */ 3713 } 3714 3715 /* XXX: these should always succeed here */ 3716 pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn); 3717 pf_commit_rules(t[1], PF_RULESET_FILTER, &nn); 3718 pf_commit_rules(t[2], PF_RULESET_NAT, &nn); 3719 pf_commit_rules(t[3], PF_RULESET_BINAT, &nn); 3720 pf_commit_rules(t[4], PF_RULESET_RDR, &nn); 3721 3722 if ((error = pf_clear_tables()) != 0) 3723 break; 3724 3725 #ifdef ALTQ 3726 if ((error = pf_begin_altq(&t[0])) != 0) { 3727 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n")); 3728 break; 3729 } 3730 pf_commit_altq(t[0]); 3731 #endif 3732 3733 pf_clear_states(); 3734 3735 pf_clear_srcnodes(NULL); 3736 3737 /* status does not use malloced mem so no need to cleanup */ 3738 /* fingerprints and interfaces have their own cleanup code */ 3739 3740 /* Free counters last as we updated them during shutdown. */ 3741 counter_u64_free(V_pf_default_rule.states_cur); 3742 counter_u64_free(V_pf_default_rule.states_tot); 3743 counter_u64_free(V_pf_default_rule.src_nodes); 3744 3745 for (int i = 0; i < PFRES_MAX; i++) 3746 counter_u64_free(V_pf_status.counters[i]); 3747 for (int i = 0; i < LCNT_MAX; i++) 3748 counter_u64_free(V_pf_status.lcounters[i]); 3749 for (int i = 0; i < FCNT_MAX; i++) 3750 counter_u64_free(V_pf_status.fcounters[i]); 3751 for (int i = 0; i < SCNT_MAX; i++) 3752 counter_u64_free(V_pf_status.scounters[i]); 3753 } while(0); 3754 3755 return (error); 3756 } 3757 3758 #ifdef INET 3759 static int 3760 pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags, 3761 struct inpcb *inp) 3762 { 3763 int chk; 3764 3765 chk = pf_test(PF_IN, flags, ifp, m, inp); 3766 if (chk && *m) { 3767 m_freem(*m); 3768 *m = NULL; 3769 } 3770 3771 if (chk != PF_PASS) 3772 return (EACCES); 3773 return (0); 3774 } 3775 3776 static int 3777 pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags, 3778 struct inpcb *inp) 3779 { 3780 int chk; 3781 3782 chk = pf_test(PF_OUT, flags, ifp, m, inp); 3783 if (chk && *m) { 3784 m_freem(*m); 3785 *m = NULL; 3786 } 3787 3788 if (chk != PF_PASS) 3789 return (EACCES); 3790 return (0); 3791 } 3792 #endif 3793 3794 #ifdef INET6 3795 static int 3796 pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags, 3797 struct inpcb *inp) 3798 { 3799 int chk; 3800 3801 /* 3802 * In case of loopback traffic IPv6 uses the real interface in 3803 * order to support scoped addresses. In order to support stateful 3804 * filtering we have change this to lo0 as it is the case in IPv4. 3805 */ 3806 CURVNET_SET(ifp->if_vnet); 3807 chk = pf_test6(PF_IN, flags, (*m)->m_flags & M_LOOP ? V_loif : ifp, m, inp); 3808 CURVNET_RESTORE(); 3809 if (chk && *m) { 3810 m_freem(*m); 3811 *m = NULL; 3812 } 3813 if (chk != PF_PASS) 3814 return (EACCES); 3815 return (0); 3816 } 3817 3818 static int 3819 pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags, 3820 struct inpcb *inp) 3821 { 3822 int chk; 3823 3824 CURVNET_SET(ifp->if_vnet); 3825 chk = pf_test6(PF_OUT, flags, ifp, m, inp); 3826 CURVNET_RESTORE(); 3827 if (chk && *m) { 3828 m_freem(*m); 3829 *m = NULL; 3830 } 3831 if (chk != PF_PASS) 3832 return (EACCES); 3833 return (0); 3834 } 3835 #endif /* INET6 */ 3836 3837 static int 3838 hook_pf(void) 3839 { 3840 #ifdef INET 3841 struct pfil_head *pfh_inet; 3842 #endif 3843 #ifdef INET6 3844 struct pfil_head *pfh_inet6; 3845 #endif 3846 3847 if (V_pf_pfil_hooked) 3848 return (0); 3849 3850 #ifdef INET 3851 pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3852 if (pfh_inet == NULL) 3853 return (ESRCH); /* XXX */ 3854 pfil_add_hook_flags(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet); 3855 pfil_add_hook_flags(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet); 3856 #endif 3857 #ifdef INET6 3858 pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3859 if (pfh_inet6 == NULL) { 3860 #ifdef INET 3861 pfil_remove_hook_flags(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, 3862 pfh_inet); 3863 pfil_remove_hook_flags(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, 3864 pfh_inet); 3865 #endif 3866 return (ESRCH); /* XXX */ 3867 } 3868 pfil_add_hook_flags(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet6); 3869 pfil_add_hook_flags(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet6); 3870 #endif 3871 3872 V_pf_pfil_hooked = 1; 3873 return (0); 3874 } 3875 3876 static int 3877 dehook_pf(void) 3878 { 3879 #ifdef INET 3880 struct pfil_head *pfh_inet; 3881 #endif 3882 #ifdef INET6 3883 struct pfil_head *pfh_inet6; 3884 #endif 3885 3886 if (V_pf_pfil_hooked == 0) 3887 return (0); 3888 3889 #ifdef INET 3890 pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 3891 if (pfh_inet == NULL) 3892 return (ESRCH); /* XXX */ 3893 pfil_remove_hook_flags(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, 3894 pfh_inet); 3895 pfil_remove_hook_flags(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, 3896 pfh_inet); 3897 #endif 3898 #ifdef INET6 3899 pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 3900 if (pfh_inet6 == NULL) 3901 return (ESRCH); /* XXX */ 3902 pfil_remove_hook_flags(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK, 3903 pfh_inet6); 3904 pfil_remove_hook_flags(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK, 3905 pfh_inet6); 3906 #endif 3907 3908 V_pf_pfil_hooked = 0; 3909 return (0); 3910 } 3911 3912 static void 3913 pf_load_vnet(void) 3914 { 3915 TAILQ_INIT(&V_pf_tags); 3916 TAILQ_INIT(&V_pf_qids); 3917 3918 pfattach_vnet(); 3919 V_pf_vnet_active = 1; 3920 } 3921 3922 static int 3923 pf_load(void) 3924 { 3925 int error; 3926 3927 rm_init(&pf_rules_lock, "pf rulesets"); 3928 sx_init(&pf_ioctl_lock, "pf ioctl"); 3929 sx_init(&pf_end_lock, "pf end thread"); 3930 3931 pf_mtag_initialize(); 3932 3933 pf_dev = make_dev(&pf_cdevsw, 0, 0, 0, 0600, PF_NAME); 3934 if (pf_dev == NULL) 3935 return (ENOMEM); 3936 3937 pf_end_threads = 0; 3938 error = kproc_create(pf_purge_thread, NULL, &pf_purge_proc, 0, 0, "pf purge"); 3939 if (error != 0) 3940 return (error); 3941 3942 pfi_initialize(); 3943 3944 return (0); 3945 } 3946 3947 static void 3948 pf_unload_vnet(void) 3949 { 3950 int error; 3951 3952 V_pf_vnet_active = 0; 3953 V_pf_status.running = 0; 3954 swi_remove(V_pf_swi_cookie); 3955 error = dehook_pf(); 3956 if (error) { 3957 /* 3958 * Should not happen! 3959 * XXX Due to error code ESRCH, kldunload will show 3960 * a message like 'No such process'. 3961 */ 3962 printf("%s : pfil unregisteration fail\n", __FUNCTION__); 3963 return; 3964 } 3965 3966 PF_RULES_WLOCK(); 3967 shutdown_pf(); 3968 PF_RULES_WUNLOCK(); 3969 3970 pf_unload_vnet_purge(); 3971 3972 pf_normalize_cleanup(); 3973 PF_RULES_WLOCK(); 3974 pfi_cleanup_vnet(); 3975 PF_RULES_WUNLOCK(); 3976 pfr_cleanup(); 3977 pf_osfp_flush(); 3978 pf_cleanup(); 3979 if (IS_DEFAULT_VNET(curvnet)) 3980 pf_mtag_cleanup(); 3981 } 3982 3983 static void 3984 pf_unload(void) 3985 { 3986 3987 sx_xlock(&pf_end_lock); 3988 pf_end_threads = 1; 3989 while (pf_end_threads < 2) { 3990 wakeup_one(pf_purge_thread); 3991 sx_sleep(pf_purge_proc, &pf_end_lock, 0, "pftmo", 0); 3992 } 3993 sx_xunlock(&pf_end_lock); 3994 3995 if (pf_dev != NULL) 3996 destroy_dev(pf_dev); 3997 3998 pfi_cleanup(); 3999 4000 rm_destroy(&pf_rules_lock); 4001 sx_destroy(&pf_ioctl_lock); 4002 sx_destroy(&pf_end_lock); 4003 } 4004 4005 static void 4006 vnet_pf_init(void *unused __unused) 4007 { 4008 4009 pf_load_vnet(); 4010 } 4011 VNET_SYSINIT(vnet_pf_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD, 4012 vnet_pf_init, NULL); 4013 4014 static void 4015 vnet_pf_uninit(const void *unused __unused) 4016 { 4017 4018 pf_unload_vnet(); 4019 } 4020 SYSUNINIT(pf_unload, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND, pf_unload, NULL); 4021 VNET_SYSUNINIT(vnet_pf_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD, 4022 vnet_pf_uninit, NULL); 4023 4024 4025 static int 4026 pf_modevent(module_t mod, int type, void *data) 4027 { 4028 int error = 0; 4029 4030 switch(type) { 4031 case MOD_LOAD: 4032 error = pf_load(); 4033 break; 4034 case MOD_UNLOAD: 4035 /* Handled in SYSUNINIT(pf_unload) to ensure it's done after 4036 * the vnet_pf_uninit()s */ 4037 break; 4038 default: 4039 error = EINVAL; 4040 break; 4041 } 4042 4043 return (error); 4044 } 4045 4046 static moduledata_t pf_mod = { 4047 "pf", 4048 pf_modevent, 4049 0 4050 }; 4051 4052 DECLARE_MODULE(pf, pf_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND); 4053 MODULE_VERSION(pf, PF_MODVER); 4054