1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * Effort sponsored in part by the Defense Advanced Research Projects 34 * Agency (DARPA) and Air Force Research Laboratory, Air Force 35 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 36 * 37 * $OpenBSD: pf_ioctl.c,v 1.213 2009/02/15 21:46:12 mbalmer Exp $ 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD$"); 42 43 #include "opt_inet.h" 44 #include "opt_inet6.h" 45 #include "opt_bpf.h" 46 #include "opt_pf.h" 47 48 #include <sys/param.h> 49 #include <sys/_bitset.h> 50 #include <sys/bitset.h> 51 #include <sys/bus.h> 52 #include <sys/conf.h> 53 #include <sys/endian.h> 54 #include <sys/fcntl.h> 55 #include <sys/filio.h> 56 #include <sys/hash.h> 57 #include <sys/interrupt.h> 58 #include <sys/jail.h> 59 #include <sys/kernel.h> 60 #include <sys/kthread.h> 61 #include <sys/lock.h> 62 #include <sys/mbuf.h> 63 #include <sys/module.h> 64 #include <sys/nv.h> 65 #include <sys/proc.h> 66 #include <sys/sdt.h> 67 #include <sys/smp.h> 68 #include <sys/socket.h> 69 #include <sys/sysctl.h> 70 #include <sys/md5.h> 71 #include <sys/ucred.h> 72 73 #include <net/if.h> 74 #include <net/if_var.h> 75 #include <net/vnet.h> 76 #include <net/route.h> 77 #include <net/pfil.h> 78 #include <net/pfvar.h> 79 #include <net/if_pfsync.h> 80 #include <net/if_pflog.h> 81 82 #include <netinet/in.h> 83 #include <netinet/ip.h> 84 #include <netinet/ip_var.h> 85 #include <netinet6/ip6_var.h> 86 #include <netinet/ip_icmp.h> 87 #include <netpfil/pf/pf_nv.h> 88 89 #ifdef INET6 90 #include <netinet/ip6.h> 91 #endif /* INET6 */ 92 93 #ifdef ALTQ 94 #include <net/altq/altq.h> 95 #endif 96 97 SDT_PROBE_DEFINE3(pf, ioctl, ioctl, error, "int", "int", "int"); 98 SDT_PROBE_DEFINE3(pf, ioctl, function, error, "char *", "int", "int"); 99 SDT_PROBE_DEFINE2(pf, ioctl, addrule, error, "int", "int"); 100 SDT_PROBE_DEFINE2(pf, ioctl, nvchk, error, "int", "int"); 101 102 static struct pf_kpool *pf_get_kpool(const char *, u_int32_t, u_int8_t, 103 u_int32_t, u_int8_t, u_int8_t, u_int8_t); 104 105 static void pf_mv_kpool(struct pf_kpalist *, struct pf_kpalist *); 106 static void pf_empty_kpool(struct pf_kpalist *); 107 static int pfioctl(struct cdev *, u_long, caddr_t, int, 108 struct thread *); 109 #ifdef ALTQ 110 static int pf_begin_altq(u_int32_t *); 111 static int pf_rollback_altq(u_int32_t); 112 static int pf_commit_altq(u_int32_t); 113 static int pf_enable_altq(struct pf_altq *); 114 static int pf_disable_altq(struct pf_altq *); 115 static uint16_t pf_qname2qid(const char *); 116 static void pf_qid_unref(uint16_t); 117 #endif /* ALTQ */ 118 static int pf_begin_rules(u_int32_t *, int, const char *); 119 static int pf_rollback_rules(u_int32_t, int, char *); 120 static int pf_setup_pfsync_matching(struct pf_kruleset *); 121 static void pf_hash_rule(MD5_CTX *, struct pf_krule *); 122 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *); 123 static int pf_commit_rules(u_int32_t, int, char *); 124 static int pf_addr_setup(struct pf_kruleset *, 125 struct pf_addr_wrap *, sa_family_t); 126 static void pf_addr_copyout(struct pf_addr_wrap *); 127 static void pf_src_node_copy(const struct pf_ksrc_node *, 128 struct pf_src_node *); 129 #ifdef ALTQ 130 static int pf_export_kaltq(struct pf_altq *, 131 struct pfioc_altq_v1 *, size_t); 132 static int pf_import_kaltq(struct pfioc_altq_v1 *, 133 struct pf_altq *, size_t); 134 #endif /* ALTQ */ 135 136 VNET_DEFINE(struct pf_krule, pf_default_rule); 137 138 #ifdef ALTQ 139 VNET_DEFINE_STATIC(int, pf_altq_running); 140 #define V_pf_altq_running VNET(pf_altq_running) 141 #endif 142 143 #define TAGID_MAX 50000 144 struct pf_tagname { 145 TAILQ_ENTRY(pf_tagname) namehash_entries; 146 TAILQ_ENTRY(pf_tagname) taghash_entries; 147 char name[PF_TAG_NAME_SIZE]; 148 uint16_t tag; 149 int ref; 150 }; 151 152 struct pf_tagset { 153 TAILQ_HEAD(, pf_tagname) *namehash; 154 TAILQ_HEAD(, pf_tagname) *taghash; 155 unsigned int mask; 156 uint32_t seed; 157 BITSET_DEFINE(, TAGID_MAX) avail; 158 }; 159 160 VNET_DEFINE(struct pf_tagset, pf_tags); 161 #define V_pf_tags VNET(pf_tags) 162 static unsigned int pf_rule_tag_hashsize; 163 #define PF_RULE_TAG_HASH_SIZE_DEFAULT 128 164 SYSCTL_UINT(_net_pf, OID_AUTO, rule_tag_hashsize, CTLFLAG_RDTUN, 165 &pf_rule_tag_hashsize, PF_RULE_TAG_HASH_SIZE_DEFAULT, 166 "Size of pf(4) rule tag hashtable"); 167 168 #ifdef ALTQ 169 VNET_DEFINE(struct pf_tagset, pf_qids); 170 #define V_pf_qids VNET(pf_qids) 171 static unsigned int pf_queue_tag_hashsize; 172 #define PF_QUEUE_TAG_HASH_SIZE_DEFAULT 128 173 SYSCTL_UINT(_net_pf, OID_AUTO, queue_tag_hashsize, CTLFLAG_RDTUN, 174 &pf_queue_tag_hashsize, PF_QUEUE_TAG_HASH_SIZE_DEFAULT, 175 "Size of pf(4) queue tag hashtable"); 176 #endif 177 VNET_DEFINE(uma_zone_t, pf_tag_z); 178 #define V_pf_tag_z VNET(pf_tag_z) 179 static MALLOC_DEFINE(M_PFALTQ, "pf_altq", "pf(4) altq configuration db"); 180 static MALLOC_DEFINE(M_PFRULE, "pf_rule", "pf(4) rules"); 181 182 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE) 183 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE 184 #endif 185 186 static void pf_init_tagset(struct pf_tagset *, unsigned int *, 187 unsigned int); 188 static void pf_cleanup_tagset(struct pf_tagset *); 189 static uint16_t tagname2hashindex(const struct pf_tagset *, const char *); 190 static uint16_t tag2hashindex(const struct pf_tagset *, uint16_t); 191 static u_int16_t tagname2tag(struct pf_tagset *, const char *); 192 static u_int16_t pf_tagname2tag(const char *); 193 static void tag_unref(struct pf_tagset *, u_int16_t); 194 195 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x 196 197 struct cdev *pf_dev; 198 199 /* 200 * XXX - These are new and need to be checked when moveing to a new version 201 */ 202 static void pf_clear_all_states(void); 203 static unsigned int pf_clear_states(const struct pf_kstate_kill *); 204 static void pf_killstates(struct pf_kstate_kill *, 205 unsigned int *); 206 static int pf_killstates_row(struct pf_kstate_kill *, 207 struct pf_idhash *); 208 static int pf_killstates_nv(struct pfioc_nv *); 209 static int pf_clearstates_nv(struct pfioc_nv *); 210 static int pf_getstate(struct pfioc_nv *); 211 static int pf_getstatus(struct pfioc_nv *); 212 static int pf_clear_tables(void); 213 static void pf_clear_srcnodes(struct pf_ksrc_node *); 214 static void pf_kill_srcnodes(struct pfioc_src_node_kill *); 215 static int pf_keepcounters(struct pfioc_nv *); 216 static void pf_tbladdr_copyout(struct pf_addr_wrap *); 217 218 /* 219 * Wrapper functions for pfil(9) hooks 220 */ 221 #ifdef INET 222 static pfil_return_t pf_check_in(struct mbuf **m, struct ifnet *ifp, 223 int flags, void *ruleset __unused, struct inpcb *inp); 224 static pfil_return_t pf_check_out(struct mbuf **m, struct ifnet *ifp, 225 int flags, void *ruleset __unused, struct inpcb *inp); 226 #endif 227 #ifdef INET6 228 static pfil_return_t pf_check6_in(struct mbuf **m, struct ifnet *ifp, 229 int flags, void *ruleset __unused, struct inpcb *inp); 230 static pfil_return_t pf_check6_out(struct mbuf **m, struct ifnet *ifp, 231 int flags, void *ruleset __unused, struct inpcb *inp); 232 #endif 233 234 static void hook_pf(void); 235 static void dehook_pf(void); 236 static int shutdown_pf(void); 237 static int pf_load(void); 238 static void pf_unload(void); 239 240 static struct cdevsw pf_cdevsw = { 241 .d_ioctl = pfioctl, 242 .d_name = PF_NAME, 243 .d_version = D_VERSION, 244 }; 245 246 volatile VNET_DEFINE_STATIC(int, pf_pfil_hooked); 247 #define V_pf_pfil_hooked VNET(pf_pfil_hooked) 248 249 /* 250 * We need a flag that is neither hooked nor running to know when 251 * the VNET is "valid". We primarily need this to control (global) 252 * external event, e.g., eventhandlers. 253 */ 254 VNET_DEFINE(int, pf_vnet_active); 255 #define V_pf_vnet_active VNET(pf_vnet_active) 256 257 int pf_end_threads; 258 struct proc *pf_purge_proc; 259 260 struct rmlock pf_rules_lock; 261 struct sx pf_ioctl_lock; 262 struct sx pf_end_lock; 263 264 /* pfsync */ 265 VNET_DEFINE(pfsync_state_import_t *, pfsync_state_import_ptr); 266 VNET_DEFINE(pfsync_insert_state_t *, pfsync_insert_state_ptr); 267 VNET_DEFINE(pfsync_update_state_t *, pfsync_update_state_ptr); 268 VNET_DEFINE(pfsync_delete_state_t *, pfsync_delete_state_ptr); 269 VNET_DEFINE(pfsync_clear_states_t *, pfsync_clear_states_ptr); 270 VNET_DEFINE(pfsync_defer_t *, pfsync_defer_ptr); 271 pfsync_detach_ifnet_t *pfsync_detach_ifnet_ptr; 272 273 /* pflog */ 274 pflog_packet_t *pflog_packet_ptr = NULL; 275 276 extern u_long pf_ioctl_maxcount; 277 278 /* 279 * Copy a user-provided string, returning an error if truncation would occur. 280 * Avoid scanning past "sz" bytes in the source string since there's no 281 * guarantee that it's nul-terminated. 282 */ 283 static int 284 pf_user_strcpy(char *dst, const char *src, size_t sz) 285 { 286 if (strnlen(src, sz) == sz) 287 return (EINVAL); 288 (void)strlcpy(dst, src, sz); 289 return (0); 290 } 291 292 static void 293 pfattach_vnet(void) 294 { 295 u_int32_t *my_timeout = V_pf_default_rule.timeout; 296 297 pf_initialize(); 298 pfr_initialize(); 299 pfi_initialize_vnet(); 300 pf_normalize_init(); 301 pf_syncookies_init(); 302 303 V_pf_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT; 304 V_pf_limits[PF_LIMIT_SRC_NODES].limit = PFSNODE_HIWAT; 305 306 RB_INIT(&V_pf_anchors); 307 pf_init_kruleset(&pf_main_ruleset); 308 309 /* default rule should never be garbage collected */ 310 V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next; 311 #ifdef PF_DEFAULT_TO_DROP 312 V_pf_default_rule.action = PF_DROP; 313 #else 314 V_pf_default_rule.action = PF_PASS; 315 #endif 316 V_pf_default_rule.nr = -1; 317 V_pf_default_rule.rtableid = -1; 318 319 pf_counter_u64_init(&V_pf_default_rule.evaluations, M_WAITOK); 320 for (int i = 0; i < 2; i++) { 321 pf_counter_u64_init(&V_pf_default_rule.packets[i], M_WAITOK); 322 pf_counter_u64_init(&V_pf_default_rule.bytes[i], M_WAITOK); 323 } 324 V_pf_default_rule.states_cur = counter_u64_alloc(M_WAITOK); 325 V_pf_default_rule.states_tot = counter_u64_alloc(M_WAITOK); 326 V_pf_default_rule.src_nodes = counter_u64_alloc(M_WAITOK); 327 328 #ifdef PF_WANT_32_TO_64_COUNTER 329 V_pf_kifmarker = malloc(sizeof(*V_pf_kifmarker), PFI_MTYPE, M_WAITOK | M_ZERO); 330 V_pf_rulemarker = malloc(sizeof(*V_pf_rulemarker), M_PFRULE, M_WAITOK | M_ZERO); 331 PF_RULES_WLOCK(); 332 LIST_INSERT_HEAD(&V_pf_allkiflist, V_pf_kifmarker, pfik_allkiflist); 333 LIST_INSERT_HEAD(&V_pf_allrulelist, &V_pf_default_rule, allrulelist); 334 V_pf_allrulecount++; 335 LIST_INSERT_HEAD(&V_pf_allrulelist, V_pf_rulemarker, allrulelist); 336 PF_RULES_WUNLOCK(); 337 #endif 338 339 /* initialize default timeouts */ 340 my_timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL; 341 my_timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL; 342 my_timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL; 343 my_timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL; 344 my_timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL; 345 my_timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL; 346 my_timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL; 347 my_timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL; 348 my_timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL; 349 my_timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL; 350 my_timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL; 351 my_timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL; 352 my_timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL; 353 my_timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL; 354 my_timeout[PFTM_FRAG] = PFTM_FRAG_VAL; 355 my_timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL; 356 my_timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL; 357 my_timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL; 358 my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START; 359 my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END; 360 361 bzero(&V_pf_status, sizeof(V_pf_status)); 362 V_pf_status.debug = PF_DEBUG_URGENT; 363 364 V_pf_pfil_hooked = 0; 365 366 /* XXX do our best to avoid a conflict */ 367 V_pf_status.hostid = arc4random(); 368 369 for (int i = 0; i < PFRES_MAX; i++) 370 V_pf_status.counters[i] = counter_u64_alloc(M_WAITOK); 371 for (int i = 0; i < KLCNT_MAX; i++) 372 V_pf_status.lcounters[i] = counter_u64_alloc(M_WAITOK); 373 for (int i = 0; i < FCNT_MAX; i++) 374 pf_counter_u64_init(&V_pf_status.fcounters[i], M_WAITOK); 375 for (int i = 0; i < SCNT_MAX; i++) 376 V_pf_status.scounters[i] = counter_u64_alloc(M_WAITOK); 377 378 if (swi_add(&V_pf_swi_ie, "pf send", pf_intr, curvnet, SWI_NET, 379 INTR_MPSAFE, &V_pf_swi_cookie) != 0) 380 /* XXXGL: leaked all above. */ 381 return; 382 } 383 384 static struct pf_kpool * 385 pf_get_kpool(const char *anchor, u_int32_t ticket, u_int8_t rule_action, 386 u_int32_t rule_number, u_int8_t r_last, u_int8_t active, 387 u_int8_t check_ticket) 388 { 389 struct pf_kruleset *ruleset; 390 struct pf_krule *rule; 391 int rs_num; 392 393 ruleset = pf_find_kruleset(anchor); 394 if (ruleset == NULL) 395 return (NULL); 396 rs_num = pf_get_ruleset_number(rule_action); 397 if (rs_num >= PF_RULESET_MAX) 398 return (NULL); 399 if (active) { 400 if (check_ticket && ticket != 401 ruleset->rules[rs_num].active.ticket) 402 return (NULL); 403 if (r_last) 404 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 405 pf_krulequeue); 406 else 407 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 408 } else { 409 if (check_ticket && ticket != 410 ruleset->rules[rs_num].inactive.ticket) 411 return (NULL); 412 if (r_last) 413 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 414 pf_krulequeue); 415 else 416 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr); 417 } 418 if (!r_last) { 419 while ((rule != NULL) && (rule->nr != rule_number)) 420 rule = TAILQ_NEXT(rule, entries); 421 } 422 if (rule == NULL) 423 return (NULL); 424 425 return (&rule->rpool); 426 } 427 428 static void 429 pf_mv_kpool(struct pf_kpalist *poola, struct pf_kpalist *poolb) 430 { 431 struct pf_kpooladdr *mv_pool_pa; 432 433 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) { 434 TAILQ_REMOVE(poola, mv_pool_pa, entries); 435 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries); 436 } 437 } 438 439 static void 440 pf_empty_kpool(struct pf_kpalist *poola) 441 { 442 struct pf_kpooladdr *pa; 443 444 while ((pa = TAILQ_FIRST(poola)) != NULL) { 445 switch (pa->addr.type) { 446 case PF_ADDR_DYNIFTL: 447 pfi_dynaddr_remove(pa->addr.p.dyn); 448 break; 449 case PF_ADDR_TABLE: 450 /* XXX: this could be unfinished pooladdr on pabuf */ 451 if (pa->addr.p.tbl != NULL) 452 pfr_detach_table(pa->addr.p.tbl); 453 break; 454 } 455 if (pa->kif) 456 pfi_kkif_unref(pa->kif); 457 TAILQ_REMOVE(poola, pa, entries); 458 free(pa, M_PFRULE); 459 } 460 } 461 462 static void 463 pf_unlink_rule(struct pf_krulequeue *rulequeue, struct pf_krule *rule) 464 { 465 466 PF_RULES_WASSERT(); 467 468 TAILQ_REMOVE(rulequeue, rule, entries); 469 470 PF_UNLNKDRULES_LOCK(); 471 rule->rule_ref |= PFRULE_REFS; 472 TAILQ_INSERT_TAIL(&V_pf_unlinked_rules, rule, entries); 473 PF_UNLNKDRULES_UNLOCK(); 474 } 475 476 void 477 pf_free_rule(struct pf_krule *rule) 478 { 479 480 PF_RULES_WASSERT(); 481 482 if (rule->tag) 483 tag_unref(&V_pf_tags, rule->tag); 484 if (rule->match_tag) 485 tag_unref(&V_pf_tags, rule->match_tag); 486 #ifdef ALTQ 487 if (rule->pqid != rule->qid) 488 pf_qid_unref(rule->pqid); 489 pf_qid_unref(rule->qid); 490 #endif 491 switch (rule->src.addr.type) { 492 case PF_ADDR_DYNIFTL: 493 pfi_dynaddr_remove(rule->src.addr.p.dyn); 494 break; 495 case PF_ADDR_TABLE: 496 pfr_detach_table(rule->src.addr.p.tbl); 497 break; 498 } 499 switch (rule->dst.addr.type) { 500 case PF_ADDR_DYNIFTL: 501 pfi_dynaddr_remove(rule->dst.addr.p.dyn); 502 break; 503 case PF_ADDR_TABLE: 504 pfr_detach_table(rule->dst.addr.p.tbl); 505 break; 506 } 507 if (rule->overload_tbl) 508 pfr_detach_table(rule->overload_tbl); 509 if (rule->kif) 510 pfi_kkif_unref(rule->kif); 511 pf_kanchor_remove(rule); 512 pf_empty_kpool(&rule->rpool.list); 513 514 pf_krule_free(rule); 515 } 516 517 static void 518 pf_init_tagset(struct pf_tagset *ts, unsigned int *tunable_size, 519 unsigned int default_size) 520 { 521 unsigned int i; 522 unsigned int hashsize; 523 524 if (*tunable_size == 0 || !powerof2(*tunable_size)) 525 *tunable_size = default_size; 526 527 hashsize = *tunable_size; 528 ts->namehash = mallocarray(hashsize, sizeof(*ts->namehash), M_PFHASH, 529 M_WAITOK); 530 ts->taghash = mallocarray(hashsize, sizeof(*ts->taghash), M_PFHASH, 531 M_WAITOK); 532 ts->mask = hashsize - 1; 533 ts->seed = arc4random(); 534 for (i = 0; i < hashsize; i++) { 535 TAILQ_INIT(&ts->namehash[i]); 536 TAILQ_INIT(&ts->taghash[i]); 537 } 538 BIT_FILL(TAGID_MAX, &ts->avail); 539 } 540 541 static void 542 pf_cleanup_tagset(struct pf_tagset *ts) 543 { 544 unsigned int i; 545 unsigned int hashsize; 546 struct pf_tagname *t, *tmp; 547 548 /* 549 * Only need to clean up one of the hashes as each tag is hashed 550 * into each table. 551 */ 552 hashsize = ts->mask + 1; 553 for (i = 0; i < hashsize; i++) 554 TAILQ_FOREACH_SAFE(t, &ts->namehash[i], namehash_entries, tmp) 555 uma_zfree(V_pf_tag_z, t); 556 557 free(ts->namehash, M_PFHASH); 558 free(ts->taghash, M_PFHASH); 559 } 560 561 static uint16_t 562 tagname2hashindex(const struct pf_tagset *ts, const char *tagname) 563 { 564 size_t len; 565 566 len = strnlen(tagname, PF_TAG_NAME_SIZE - 1); 567 return (murmur3_32_hash(tagname, len, ts->seed) & ts->mask); 568 } 569 570 static uint16_t 571 tag2hashindex(const struct pf_tagset *ts, uint16_t tag) 572 { 573 574 return (tag & ts->mask); 575 } 576 577 static u_int16_t 578 tagname2tag(struct pf_tagset *ts, const char *tagname) 579 { 580 struct pf_tagname *tag; 581 u_int32_t index; 582 u_int16_t new_tagid; 583 584 PF_RULES_WASSERT(); 585 586 index = tagname2hashindex(ts, tagname); 587 TAILQ_FOREACH(tag, &ts->namehash[index], namehash_entries) 588 if (strcmp(tagname, tag->name) == 0) { 589 tag->ref++; 590 return (tag->tag); 591 } 592 593 /* 594 * new entry 595 * 596 * to avoid fragmentation, we do a linear search from the beginning 597 * and take the first free slot we find. 598 */ 599 new_tagid = BIT_FFS(TAGID_MAX, &ts->avail); 600 /* 601 * Tags are 1-based, with valid tags in the range [1..TAGID_MAX]. 602 * BIT_FFS() returns a 1-based bit number, with 0 indicating no bits 603 * set. It may also return a bit number greater than TAGID_MAX due 604 * to rounding of the number of bits in the vector up to a multiple 605 * of the vector word size at declaration/allocation time. 606 */ 607 if ((new_tagid == 0) || (new_tagid > TAGID_MAX)) 608 return (0); 609 610 /* Mark the tag as in use. Bits are 0-based for BIT_CLR() */ 611 BIT_CLR(TAGID_MAX, new_tagid - 1, &ts->avail); 612 613 /* allocate and fill new struct pf_tagname */ 614 tag = uma_zalloc(V_pf_tag_z, M_NOWAIT); 615 if (tag == NULL) 616 return (0); 617 strlcpy(tag->name, tagname, sizeof(tag->name)); 618 tag->tag = new_tagid; 619 tag->ref = 1; 620 621 /* Insert into namehash */ 622 TAILQ_INSERT_TAIL(&ts->namehash[index], tag, namehash_entries); 623 624 /* Insert into taghash */ 625 index = tag2hashindex(ts, new_tagid); 626 TAILQ_INSERT_TAIL(&ts->taghash[index], tag, taghash_entries); 627 628 return (tag->tag); 629 } 630 631 static void 632 tag_unref(struct pf_tagset *ts, u_int16_t tag) 633 { 634 struct pf_tagname *t; 635 uint16_t index; 636 637 PF_RULES_WASSERT(); 638 639 index = tag2hashindex(ts, tag); 640 TAILQ_FOREACH(t, &ts->taghash[index], taghash_entries) 641 if (tag == t->tag) { 642 if (--t->ref == 0) { 643 TAILQ_REMOVE(&ts->taghash[index], t, 644 taghash_entries); 645 index = tagname2hashindex(ts, t->name); 646 TAILQ_REMOVE(&ts->namehash[index], t, 647 namehash_entries); 648 /* Bits are 0-based for BIT_SET() */ 649 BIT_SET(TAGID_MAX, tag - 1, &ts->avail); 650 uma_zfree(V_pf_tag_z, t); 651 } 652 break; 653 } 654 } 655 656 static uint16_t 657 pf_tagname2tag(const char *tagname) 658 { 659 return (tagname2tag(&V_pf_tags, tagname)); 660 } 661 662 #ifdef ALTQ 663 static uint16_t 664 pf_qname2qid(const char *qname) 665 { 666 return (tagname2tag(&V_pf_qids, qname)); 667 } 668 669 static void 670 pf_qid_unref(uint16_t qid) 671 { 672 tag_unref(&V_pf_qids, qid); 673 } 674 675 static int 676 pf_begin_altq(u_int32_t *ticket) 677 { 678 struct pf_altq *altq, *tmp; 679 int error = 0; 680 681 PF_RULES_WASSERT(); 682 683 /* Purge the old altq lists */ 684 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) { 685 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 686 /* detach and destroy the discipline */ 687 error = altq_remove(altq); 688 } 689 free(altq, M_PFALTQ); 690 } 691 TAILQ_INIT(V_pf_altq_ifs_inactive); 692 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) { 693 pf_qid_unref(altq->qid); 694 free(altq, M_PFALTQ); 695 } 696 TAILQ_INIT(V_pf_altqs_inactive); 697 if (error) 698 return (error); 699 *ticket = ++V_ticket_altqs_inactive; 700 V_altqs_inactive_open = 1; 701 return (0); 702 } 703 704 static int 705 pf_rollback_altq(u_int32_t ticket) 706 { 707 struct pf_altq *altq, *tmp; 708 int error = 0; 709 710 PF_RULES_WASSERT(); 711 712 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 713 return (0); 714 /* Purge the old altq lists */ 715 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) { 716 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 717 /* detach and destroy the discipline */ 718 error = altq_remove(altq); 719 } 720 free(altq, M_PFALTQ); 721 } 722 TAILQ_INIT(V_pf_altq_ifs_inactive); 723 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) { 724 pf_qid_unref(altq->qid); 725 free(altq, M_PFALTQ); 726 } 727 TAILQ_INIT(V_pf_altqs_inactive); 728 V_altqs_inactive_open = 0; 729 return (error); 730 } 731 732 static int 733 pf_commit_altq(u_int32_t ticket) 734 { 735 struct pf_altqqueue *old_altqs, *old_altq_ifs; 736 struct pf_altq *altq, *tmp; 737 int err, error = 0; 738 739 PF_RULES_WASSERT(); 740 741 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive) 742 return (EBUSY); 743 744 /* swap altqs, keep the old. */ 745 old_altqs = V_pf_altqs_active; 746 old_altq_ifs = V_pf_altq_ifs_active; 747 V_pf_altqs_active = V_pf_altqs_inactive; 748 V_pf_altq_ifs_active = V_pf_altq_ifs_inactive; 749 V_pf_altqs_inactive = old_altqs; 750 V_pf_altq_ifs_inactive = old_altq_ifs; 751 V_ticket_altqs_active = V_ticket_altqs_inactive; 752 753 /* Attach new disciplines */ 754 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 755 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 756 /* attach the discipline */ 757 error = altq_pfattach(altq); 758 if (error == 0 && V_pf_altq_running) 759 error = pf_enable_altq(altq); 760 if (error != 0) 761 return (error); 762 } 763 } 764 765 /* Purge the old altq lists */ 766 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) { 767 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 768 /* detach and destroy the discipline */ 769 if (V_pf_altq_running) 770 error = pf_disable_altq(altq); 771 err = altq_pfdetach(altq); 772 if (err != 0 && error == 0) 773 error = err; 774 err = altq_remove(altq); 775 if (err != 0 && error == 0) 776 error = err; 777 } 778 free(altq, M_PFALTQ); 779 } 780 TAILQ_INIT(V_pf_altq_ifs_inactive); 781 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) { 782 pf_qid_unref(altq->qid); 783 free(altq, M_PFALTQ); 784 } 785 TAILQ_INIT(V_pf_altqs_inactive); 786 787 V_altqs_inactive_open = 0; 788 return (error); 789 } 790 791 static int 792 pf_enable_altq(struct pf_altq *altq) 793 { 794 struct ifnet *ifp; 795 struct tb_profile tb; 796 int error = 0; 797 798 if ((ifp = ifunit(altq->ifname)) == NULL) 799 return (EINVAL); 800 801 if (ifp->if_snd.altq_type != ALTQT_NONE) 802 error = altq_enable(&ifp->if_snd); 803 804 /* set tokenbucket regulator */ 805 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) { 806 tb.rate = altq->ifbandwidth; 807 tb.depth = altq->tbrsize; 808 error = tbr_set(&ifp->if_snd, &tb); 809 } 810 811 return (error); 812 } 813 814 static int 815 pf_disable_altq(struct pf_altq *altq) 816 { 817 struct ifnet *ifp; 818 struct tb_profile tb; 819 int error; 820 821 if ((ifp = ifunit(altq->ifname)) == NULL) 822 return (EINVAL); 823 824 /* 825 * when the discipline is no longer referenced, it was overridden 826 * by a new one. if so, just return. 827 */ 828 if (altq->altq_disc != ifp->if_snd.altq_disc) 829 return (0); 830 831 error = altq_disable(&ifp->if_snd); 832 833 if (error == 0) { 834 /* clear tokenbucket regulator */ 835 tb.rate = 0; 836 error = tbr_set(&ifp->if_snd, &tb); 837 } 838 839 return (error); 840 } 841 842 static int 843 pf_altq_ifnet_event_add(struct ifnet *ifp, int remove, u_int32_t ticket, 844 struct pf_altq *altq) 845 { 846 struct ifnet *ifp1; 847 int error = 0; 848 849 /* Deactivate the interface in question */ 850 altq->local_flags &= ~PFALTQ_FLAG_IF_REMOVED; 851 if ((ifp1 = ifunit(altq->ifname)) == NULL || 852 (remove && ifp1 == ifp)) { 853 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED; 854 } else { 855 error = altq_add(ifp1, altq); 856 857 if (ticket != V_ticket_altqs_inactive) 858 error = EBUSY; 859 860 if (error) 861 free(altq, M_PFALTQ); 862 } 863 864 return (error); 865 } 866 867 void 868 pf_altq_ifnet_event(struct ifnet *ifp, int remove) 869 { 870 struct pf_altq *a1, *a2, *a3; 871 u_int32_t ticket; 872 int error = 0; 873 874 /* 875 * No need to re-evaluate the configuration for events on interfaces 876 * that do not support ALTQ, as it's not possible for such 877 * interfaces to be part of the configuration. 878 */ 879 if (!ALTQ_IS_READY(&ifp->if_snd)) 880 return; 881 882 /* Interrupt userland queue modifications */ 883 if (V_altqs_inactive_open) 884 pf_rollback_altq(V_ticket_altqs_inactive); 885 886 /* Start new altq ruleset */ 887 if (pf_begin_altq(&ticket)) 888 return; 889 890 /* Copy the current active set */ 891 TAILQ_FOREACH(a1, V_pf_altq_ifs_active, entries) { 892 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT); 893 if (a2 == NULL) { 894 error = ENOMEM; 895 break; 896 } 897 bcopy(a1, a2, sizeof(struct pf_altq)); 898 899 error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2); 900 if (error) 901 break; 902 903 TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, a2, entries); 904 } 905 if (error) 906 goto out; 907 TAILQ_FOREACH(a1, V_pf_altqs_active, entries) { 908 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT); 909 if (a2 == NULL) { 910 error = ENOMEM; 911 break; 912 } 913 bcopy(a1, a2, sizeof(struct pf_altq)); 914 915 if ((a2->qid = pf_qname2qid(a2->qname)) == 0) { 916 error = EBUSY; 917 free(a2, M_PFALTQ); 918 break; 919 } 920 a2->altq_disc = NULL; 921 TAILQ_FOREACH(a3, V_pf_altq_ifs_inactive, entries) { 922 if (strncmp(a3->ifname, a2->ifname, 923 IFNAMSIZ) == 0) { 924 a2->altq_disc = a3->altq_disc; 925 break; 926 } 927 } 928 error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2); 929 if (error) 930 break; 931 932 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, a2, entries); 933 } 934 935 out: 936 if (error != 0) 937 pf_rollback_altq(ticket); 938 else 939 pf_commit_altq(ticket); 940 } 941 #endif /* ALTQ */ 942 943 static int 944 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor) 945 { 946 struct pf_kruleset *rs; 947 struct pf_krule *rule; 948 949 PF_RULES_WASSERT(); 950 951 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 952 return (EINVAL); 953 rs = pf_find_or_create_kruleset(anchor); 954 if (rs == NULL) 955 return (EINVAL); 956 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 957 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 958 rs->rules[rs_num].inactive.rcount--; 959 } 960 *ticket = ++rs->rules[rs_num].inactive.ticket; 961 rs->rules[rs_num].inactive.open = 1; 962 return (0); 963 } 964 965 static int 966 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor) 967 { 968 struct pf_kruleset *rs; 969 struct pf_krule *rule; 970 971 PF_RULES_WASSERT(); 972 973 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 974 return (EINVAL); 975 rs = pf_find_kruleset(anchor); 976 if (rs == NULL || !rs->rules[rs_num].inactive.open || 977 rs->rules[rs_num].inactive.ticket != ticket) 978 return (0); 979 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) { 980 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule); 981 rs->rules[rs_num].inactive.rcount--; 982 } 983 rs->rules[rs_num].inactive.open = 0; 984 return (0); 985 } 986 987 #define PF_MD5_UPD(st, elm) \ 988 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm)) 989 990 #define PF_MD5_UPD_STR(st, elm) \ 991 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm)) 992 993 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \ 994 (stor) = htonl((st)->elm); \ 995 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\ 996 } while (0) 997 998 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \ 999 (stor) = htons((st)->elm); \ 1000 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\ 1001 } while (0) 1002 1003 static void 1004 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr) 1005 { 1006 PF_MD5_UPD(pfr, addr.type); 1007 switch (pfr->addr.type) { 1008 case PF_ADDR_DYNIFTL: 1009 PF_MD5_UPD(pfr, addr.v.ifname); 1010 PF_MD5_UPD(pfr, addr.iflags); 1011 break; 1012 case PF_ADDR_TABLE: 1013 PF_MD5_UPD(pfr, addr.v.tblname); 1014 break; 1015 case PF_ADDR_ADDRMASK: 1016 /* XXX ignore af? */ 1017 PF_MD5_UPD(pfr, addr.v.a.addr.addr32); 1018 PF_MD5_UPD(pfr, addr.v.a.mask.addr32); 1019 break; 1020 } 1021 1022 PF_MD5_UPD(pfr, port[0]); 1023 PF_MD5_UPD(pfr, port[1]); 1024 PF_MD5_UPD(pfr, neg); 1025 PF_MD5_UPD(pfr, port_op); 1026 } 1027 1028 static void 1029 pf_hash_rule(MD5_CTX *ctx, struct pf_krule *rule) 1030 { 1031 u_int16_t x; 1032 u_int32_t y; 1033 1034 pf_hash_rule_addr(ctx, &rule->src); 1035 pf_hash_rule_addr(ctx, &rule->dst); 1036 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 1037 PF_MD5_UPD_STR(rule, label[i]); 1038 PF_MD5_UPD_STR(rule, ifname); 1039 PF_MD5_UPD_STR(rule, match_tagname); 1040 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */ 1041 PF_MD5_UPD_HTONL(rule, os_fingerprint, y); 1042 PF_MD5_UPD_HTONL(rule, prob, y); 1043 PF_MD5_UPD_HTONL(rule, uid.uid[0], y); 1044 PF_MD5_UPD_HTONL(rule, uid.uid[1], y); 1045 PF_MD5_UPD(rule, uid.op); 1046 PF_MD5_UPD_HTONL(rule, gid.gid[0], y); 1047 PF_MD5_UPD_HTONL(rule, gid.gid[1], y); 1048 PF_MD5_UPD(rule, gid.op); 1049 PF_MD5_UPD_HTONL(rule, rule_flag, y); 1050 PF_MD5_UPD(rule, action); 1051 PF_MD5_UPD(rule, direction); 1052 PF_MD5_UPD(rule, af); 1053 PF_MD5_UPD(rule, quick); 1054 PF_MD5_UPD(rule, ifnot); 1055 PF_MD5_UPD(rule, match_tag_not); 1056 PF_MD5_UPD(rule, natpass); 1057 PF_MD5_UPD(rule, keep_state); 1058 PF_MD5_UPD(rule, proto); 1059 PF_MD5_UPD(rule, type); 1060 PF_MD5_UPD(rule, code); 1061 PF_MD5_UPD(rule, flags); 1062 PF_MD5_UPD(rule, flagset); 1063 PF_MD5_UPD(rule, allow_opts); 1064 PF_MD5_UPD(rule, rt); 1065 PF_MD5_UPD(rule, tos); 1066 } 1067 1068 static bool 1069 pf_krule_compare(struct pf_krule *a, struct pf_krule *b) 1070 { 1071 MD5_CTX ctx[2]; 1072 u_int8_t digest[2][PF_MD5_DIGEST_LENGTH]; 1073 1074 MD5Init(&ctx[0]); 1075 MD5Init(&ctx[1]); 1076 pf_hash_rule(&ctx[0], a); 1077 pf_hash_rule(&ctx[1], b); 1078 MD5Final(digest[0], &ctx[0]); 1079 MD5Final(digest[1], &ctx[1]); 1080 1081 return (memcmp(digest[0], digest[1], PF_MD5_DIGEST_LENGTH) == 0); 1082 } 1083 1084 static int 1085 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor) 1086 { 1087 struct pf_kruleset *rs; 1088 struct pf_krule *rule, **old_array, *tail; 1089 struct pf_krulequeue *old_rules; 1090 int error; 1091 u_int32_t old_rcount; 1092 1093 PF_RULES_WASSERT(); 1094 1095 if (rs_num < 0 || rs_num >= PF_RULESET_MAX) 1096 return (EINVAL); 1097 rs = pf_find_kruleset(anchor); 1098 if (rs == NULL || !rs->rules[rs_num].inactive.open || 1099 ticket != rs->rules[rs_num].inactive.ticket) 1100 return (EBUSY); 1101 1102 /* Calculate checksum for the main ruleset */ 1103 if (rs == &pf_main_ruleset) { 1104 error = pf_setup_pfsync_matching(rs); 1105 if (error != 0) 1106 return (error); 1107 } 1108 1109 /* Swap rules, keep the old. */ 1110 old_rules = rs->rules[rs_num].active.ptr; 1111 old_rcount = rs->rules[rs_num].active.rcount; 1112 old_array = rs->rules[rs_num].active.ptr_array; 1113 1114 rs->rules[rs_num].active.ptr = 1115 rs->rules[rs_num].inactive.ptr; 1116 rs->rules[rs_num].active.ptr_array = 1117 rs->rules[rs_num].inactive.ptr_array; 1118 rs->rules[rs_num].active.rcount = 1119 rs->rules[rs_num].inactive.rcount; 1120 1121 /* Attempt to preserve counter information. */ 1122 if (V_pf_status.keep_counters) { 1123 TAILQ_FOREACH(rule, rs->rules[rs_num].active.ptr, 1124 entries) { 1125 tail = TAILQ_FIRST(old_rules); 1126 while ((tail != NULL) && ! pf_krule_compare(tail, rule)) 1127 tail = TAILQ_NEXT(tail, entries); 1128 if (tail != NULL) { 1129 pf_counter_u64_critical_enter(); 1130 pf_counter_u64_add_protected(&rule->evaluations, 1131 pf_counter_u64_fetch(&tail->evaluations)); 1132 pf_counter_u64_add_protected(&rule->packets[0], 1133 pf_counter_u64_fetch(&tail->packets[0])); 1134 pf_counter_u64_add_protected(&rule->packets[1], 1135 pf_counter_u64_fetch(&tail->packets[1])); 1136 pf_counter_u64_add_protected(&rule->bytes[0], 1137 pf_counter_u64_fetch(&tail->bytes[0])); 1138 pf_counter_u64_add_protected(&rule->bytes[1], 1139 pf_counter_u64_fetch(&tail->bytes[1])); 1140 pf_counter_u64_critical_exit(); 1141 } 1142 } 1143 } 1144 1145 rs->rules[rs_num].inactive.ptr = old_rules; 1146 rs->rules[rs_num].inactive.ptr_array = old_array; 1147 rs->rules[rs_num].inactive.rcount = old_rcount; 1148 1149 rs->rules[rs_num].active.ticket = 1150 rs->rules[rs_num].inactive.ticket; 1151 pf_calc_skip_steps(rs->rules[rs_num].active.ptr); 1152 1153 /* Purge the old rule list. */ 1154 while ((rule = TAILQ_FIRST(old_rules)) != NULL) 1155 pf_unlink_rule(old_rules, rule); 1156 if (rs->rules[rs_num].inactive.ptr_array) 1157 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP); 1158 rs->rules[rs_num].inactive.ptr_array = NULL; 1159 rs->rules[rs_num].inactive.rcount = 0; 1160 rs->rules[rs_num].inactive.open = 0; 1161 pf_remove_if_empty_kruleset(rs); 1162 1163 return (0); 1164 } 1165 1166 static int 1167 pf_setup_pfsync_matching(struct pf_kruleset *rs) 1168 { 1169 MD5_CTX ctx; 1170 struct pf_krule *rule; 1171 int rs_cnt; 1172 u_int8_t digest[PF_MD5_DIGEST_LENGTH]; 1173 1174 MD5Init(&ctx); 1175 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) { 1176 /* XXX PF_RULESET_SCRUB as well? */ 1177 if (rs_cnt == PF_RULESET_SCRUB) 1178 continue; 1179 1180 if (rs->rules[rs_cnt].inactive.ptr_array) 1181 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP); 1182 rs->rules[rs_cnt].inactive.ptr_array = NULL; 1183 1184 if (rs->rules[rs_cnt].inactive.rcount) { 1185 rs->rules[rs_cnt].inactive.ptr_array = 1186 malloc(sizeof(caddr_t) * 1187 rs->rules[rs_cnt].inactive.rcount, 1188 M_TEMP, M_NOWAIT); 1189 1190 if (!rs->rules[rs_cnt].inactive.ptr_array) 1191 return (ENOMEM); 1192 } 1193 1194 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr, 1195 entries) { 1196 pf_hash_rule(&ctx, rule); 1197 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule; 1198 } 1199 } 1200 1201 MD5Final(digest, &ctx); 1202 memcpy(V_pf_status.pf_chksum, digest, sizeof(V_pf_status.pf_chksum)); 1203 return (0); 1204 } 1205 1206 static int 1207 pf_addr_setup(struct pf_kruleset *ruleset, struct pf_addr_wrap *addr, 1208 sa_family_t af) 1209 { 1210 int error = 0; 1211 1212 switch (addr->type) { 1213 case PF_ADDR_TABLE: 1214 addr->p.tbl = pfr_attach_table(ruleset, addr->v.tblname); 1215 if (addr->p.tbl == NULL) 1216 error = ENOMEM; 1217 break; 1218 case PF_ADDR_DYNIFTL: 1219 error = pfi_dynaddr_setup(addr, af); 1220 break; 1221 } 1222 1223 return (error); 1224 } 1225 1226 static void 1227 pf_addr_copyout(struct pf_addr_wrap *addr) 1228 { 1229 1230 switch (addr->type) { 1231 case PF_ADDR_DYNIFTL: 1232 pfi_dynaddr_copyout(addr); 1233 break; 1234 case PF_ADDR_TABLE: 1235 pf_tbladdr_copyout(addr); 1236 break; 1237 } 1238 } 1239 1240 static void 1241 pf_src_node_copy(const struct pf_ksrc_node *in, struct pf_src_node *out) 1242 { 1243 int secs = time_uptime, diff; 1244 1245 bzero(out, sizeof(struct pf_src_node)); 1246 1247 bcopy(&in->addr, &out->addr, sizeof(struct pf_addr)); 1248 bcopy(&in->raddr, &out->raddr, sizeof(struct pf_addr)); 1249 1250 if (in->rule.ptr != NULL) 1251 out->rule.nr = in->rule.ptr->nr; 1252 1253 for (int i = 0; i < 2; i++) { 1254 out->bytes[i] = counter_u64_fetch(in->bytes[i]); 1255 out->packets[i] = counter_u64_fetch(in->packets[i]); 1256 } 1257 1258 out->states = in->states; 1259 out->conn = in->conn; 1260 out->af = in->af; 1261 out->ruletype = in->ruletype; 1262 1263 out->creation = secs - in->creation; 1264 if (out->expire > secs) 1265 out->expire -= secs; 1266 else 1267 out->expire = 0; 1268 1269 /* Adjust the connection rate estimate. */ 1270 diff = secs - in->conn_rate.last; 1271 if (diff >= in->conn_rate.seconds) 1272 out->conn_rate.count = 0; 1273 else 1274 out->conn_rate.count -= 1275 in->conn_rate.count * diff / 1276 in->conn_rate.seconds; 1277 } 1278 1279 #ifdef ALTQ 1280 /* 1281 * Handle export of struct pf_kaltq to user binaries that may be using any 1282 * version of struct pf_altq. 1283 */ 1284 static int 1285 pf_export_kaltq(struct pf_altq *q, struct pfioc_altq_v1 *pa, size_t ioc_size) 1286 { 1287 u_int32_t version; 1288 1289 if (ioc_size == sizeof(struct pfioc_altq_v0)) 1290 version = 0; 1291 else 1292 version = pa->version; 1293 1294 if (version > PFIOC_ALTQ_VERSION) 1295 return (EINVAL); 1296 1297 #define ASSIGN(x) exported_q->x = q->x 1298 #define COPY(x) \ 1299 bcopy(&q->x, &exported_q->x, min(sizeof(q->x), sizeof(exported_q->x))) 1300 #define SATU16(x) (u_int32_t)uqmin((x), USHRT_MAX) 1301 #define SATU32(x) (u_int32_t)uqmin((x), UINT_MAX) 1302 1303 switch (version) { 1304 case 0: { 1305 struct pf_altq_v0 *exported_q = 1306 &((struct pfioc_altq_v0 *)pa)->altq; 1307 1308 COPY(ifname); 1309 1310 ASSIGN(scheduler); 1311 ASSIGN(tbrsize); 1312 exported_q->tbrsize = SATU16(q->tbrsize); 1313 exported_q->ifbandwidth = SATU32(q->ifbandwidth); 1314 1315 COPY(qname); 1316 COPY(parent); 1317 ASSIGN(parent_qid); 1318 exported_q->bandwidth = SATU32(q->bandwidth); 1319 ASSIGN(priority); 1320 ASSIGN(local_flags); 1321 1322 ASSIGN(qlimit); 1323 ASSIGN(flags); 1324 1325 if (q->scheduler == ALTQT_HFSC) { 1326 #define ASSIGN_OPT(x) exported_q->pq_u.hfsc_opts.x = q->pq_u.hfsc_opts.x 1327 #define ASSIGN_OPT_SATU32(x) exported_q->pq_u.hfsc_opts.x = \ 1328 SATU32(q->pq_u.hfsc_opts.x) 1329 1330 ASSIGN_OPT_SATU32(rtsc_m1); 1331 ASSIGN_OPT(rtsc_d); 1332 ASSIGN_OPT_SATU32(rtsc_m2); 1333 1334 ASSIGN_OPT_SATU32(lssc_m1); 1335 ASSIGN_OPT(lssc_d); 1336 ASSIGN_OPT_SATU32(lssc_m2); 1337 1338 ASSIGN_OPT_SATU32(ulsc_m1); 1339 ASSIGN_OPT(ulsc_d); 1340 ASSIGN_OPT_SATU32(ulsc_m2); 1341 1342 ASSIGN_OPT(flags); 1343 1344 #undef ASSIGN_OPT 1345 #undef ASSIGN_OPT_SATU32 1346 } else 1347 COPY(pq_u); 1348 1349 ASSIGN(qid); 1350 break; 1351 } 1352 case 1: { 1353 struct pf_altq_v1 *exported_q = 1354 &((struct pfioc_altq_v1 *)pa)->altq; 1355 1356 COPY(ifname); 1357 1358 ASSIGN(scheduler); 1359 ASSIGN(tbrsize); 1360 ASSIGN(ifbandwidth); 1361 1362 COPY(qname); 1363 COPY(parent); 1364 ASSIGN(parent_qid); 1365 ASSIGN(bandwidth); 1366 ASSIGN(priority); 1367 ASSIGN(local_flags); 1368 1369 ASSIGN(qlimit); 1370 ASSIGN(flags); 1371 COPY(pq_u); 1372 1373 ASSIGN(qid); 1374 break; 1375 } 1376 default: 1377 panic("%s: unhandled struct pfioc_altq version", __func__); 1378 break; 1379 } 1380 1381 #undef ASSIGN 1382 #undef COPY 1383 #undef SATU16 1384 #undef SATU32 1385 1386 return (0); 1387 } 1388 1389 /* 1390 * Handle import to struct pf_kaltq of struct pf_altq from user binaries 1391 * that may be using any version of it. 1392 */ 1393 static int 1394 pf_import_kaltq(struct pfioc_altq_v1 *pa, struct pf_altq *q, size_t ioc_size) 1395 { 1396 u_int32_t version; 1397 1398 if (ioc_size == sizeof(struct pfioc_altq_v0)) 1399 version = 0; 1400 else 1401 version = pa->version; 1402 1403 if (version > PFIOC_ALTQ_VERSION) 1404 return (EINVAL); 1405 1406 #define ASSIGN(x) q->x = imported_q->x 1407 #define COPY(x) \ 1408 bcopy(&imported_q->x, &q->x, min(sizeof(imported_q->x), sizeof(q->x))) 1409 1410 switch (version) { 1411 case 0: { 1412 struct pf_altq_v0 *imported_q = 1413 &((struct pfioc_altq_v0 *)pa)->altq; 1414 1415 COPY(ifname); 1416 1417 ASSIGN(scheduler); 1418 ASSIGN(tbrsize); /* 16-bit -> 32-bit */ 1419 ASSIGN(ifbandwidth); /* 32-bit -> 64-bit */ 1420 1421 COPY(qname); 1422 COPY(parent); 1423 ASSIGN(parent_qid); 1424 ASSIGN(bandwidth); /* 32-bit -> 64-bit */ 1425 ASSIGN(priority); 1426 ASSIGN(local_flags); 1427 1428 ASSIGN(qlimit); 1429 ASSIGN(flags); 1430 1431 if (imported_q->scheduler == ALTQT_HFSC) { 1432 #define ASSIGN_OPT(x) q->pq_u.hfsc_opts.x = imported_q->pq_u.hfsc_opts.x 1433 1434 /* 1435 * The m1 and m2 parameters are being copied from 1436 * 32-bit to 64-bit. 1437 */ 1438 ASSIGN_OPT(rtsc_m1); 1439 ASSIGN_OPT(rtsc_d); 1440 ASSIGN_OPT(rtsc_m2); 1441 1442 ASSIGN_OPT(lssc_m1); 1443 ASSIGN_OPT(lssc_d); 1444 ASSIGN_OPT(lssc_m2); 1445 1446 ASSIGN_OPT(ulsc_m1); 1447 ASSIGN_OPT(ulsc_d); 1448 ASSIGN_OPT(ulsc_m2); 1449 1450 ASSIGN_OPT(flags); 1451 1452 #undef ASSIGN_OPT 1453 } else 1454 COPY(pq_u); 1455 1456 ASSIGN(qid); 1457 break; 1458 } 1459 case 1: { 1460 struct pf_altq_v1 *imported_q = 1461 &((struct pfioc_altq_v1 *)pa)->altq; 1462 1463 COPY(ifname); 1464 1465 ASSIGN(scheduler); 1466 ASSIGN(tbrsize); 1467 ASSIGN(ifbandwidth); 1468 1469 COPY(qname); 1470 COPY(parent); 1471 ASSIGN(parent_qid); 1472 ASSIGN(bandwidth); 1473 ASSIGN(priority); 1474 ASSIGN(local_flags); 1475 1476 ASSIGN(qlimit); 1477 ASSIGN(flags); 1478 COPY(pq_u); 1479 1480 ASSIGN(qid); 1481 break; 1482 } 1483 default: 1484 panic("%s: unhandled struct pfioc_altq version", __func__); 1485 break; 1486 } 1487 1488 #undef ASSIGN 1489 #undef COPY 1490 1491 return (0); 1492 } 1493 1494 static struct pf_altq * 1495 pf_altq_get_nth_active(u_int32_t n) 1496 { 1497 struct pf_altq *altq; 1498 u_int32_t nr; 1499 1500 nr = 0; 1501 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 1502 if (nr == n) 1503 return (altq); 1504 nr++; 1505 } 1506 1507 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) { 1508 if (nr == n) 1509 return (altq); 1510 nr++; 1511 } 1512 1513 return (NULL); 1514 } 1515 #endif /* ALTQ */ 1516 1517 void 1518 pf_krule_free(struct pf_krule *rule) 1519 { 1520 #ifdef PF_WANT_32_TO_64_COUNTER 1521 bool wowned; 1522 #endif 1523 1524 if (rule == NULL) 1525 return; 1526 1527 #ifdef PF_WANT_32_TO_64_COUNTER 1528 if (rule->allrulelinked) { 1529 wowned = PF_RULES_WOWNED(); 1530 if (!wowned) 1531 PF_RULES_WLOCK(); 1532 LIST_REMOVE(rule, allrulelist); 1533 V_pf_allrulecount--; 1534 if (!wowned) 1535 PF_RULES_WUNLOCK(); 1536 } 1537 #endif 1538 1539 pf_counter_u64_deinit(&rule->evaluations); 1540 for (int i = 0; i < 2; i++) { 1541 pf_counter_u64_deinit(&rule->packets[i]); 1542 pf_counter_u64_deinit(&rule->bytes[i]); 1543 } 1544 counter_u64_free(rule->states_cur); 1545 counter_u64_free(rule->states_tot); 1546 counter_u64_free(rule->src_nodes); 1547 free(rule, M_PFRULE); 1548 } 1549 1550 static void 1551 pf_kpooladdr_to_pooladdr(const struct pf_kpooladdr *kpool, 1552 struct pf_pooladdr *pool) 1553 { 1554 1555 bzero(pool, sizeof(*pool)); 1556 bcopy(&kpool->addr, &pool->addr, sizeof(pool->addr)); 1557 strlcpy(pool->ifname, kpool->ifname, sizeof(pool->ifname)); 1558 } 1559 1560 static int 1561 pf_pooladdr_to_kpooladdr(const struct pf_pooladdr *pool, 1562 struct pf_kpooladdr *kpool) 1563 { 1564 int ret; 1565 1566 bzero(kpool, sizeof(*kpool)); 1567 bcopy(&pool->addr, &kpool->addr, sizeof(kpool->addr)); 1568 ret = pf_user_strcpy(kpool->ifname, pool->ifname, 1569 sizeof(kpool->ifname)); 1570 return (ret); 1571 } 1572 1573 static void 1574 pf_kpool_to_pool(const struct pf_kpool *kpool, struct pf_pool *pool) 1575 { 1576 bzero(pool, sizeof(*pool)); 1577 1578 bcopy(&kpool->key, &pool->key, sizeof(pool->key)); 1579 bcopy(&kpool->counter, &pool->counter, sizeof(pool->counter)); 1580 1581 pool->tblidx = kpool->tblidx; 1582 pool->proxy_port[0] = kpool->proxy_port[0]; 1583 pool->proxy_port[1] = kpool->proxy_port[1]; 1584 pool->opts = kpool->opts; 1585 } 1586 1587 static int 1588 pf_pool_to_kpool(const struct pf_pool *pool, struct pf_kpool *kpool) 1589 { 1590 _Static_assert(sizeof(pool->key) == sizeof(kpool->key), ""); 1591 _Static_assert(sizeof(pool->counter) == sizeof(kpool->counter), ""); 1592 1593 bzero(kpool, sizeof(*kpool)); 1594 1595 bcopy(&pool->key, &kpool->key, sizeof(kpool->key)); 1596 bcopy(&pool->counter, &kpool->counter, sizeof(kpool->counter)); 1597 1598 kpool->tblidx = pool->tblidx; 1599 kpool->proxy_port[0] = pool->proxy_port[0]; 1600 kpool->proxy_port[1] = pool->proxy_port[1]; 1601 kpool->opts = pool->opts; 1602 1603 return (0); 1604 } 1605 1606 static void 1607 pf_krule_to_rule(struct pf_krule *krule, struct pf_rule *rule) 1608 { 1609 1610 bzero(rule, sizeof(*rule)); 1611 1612 bcopy(&krule->src, &rule->src, sizeof(rule->src)); 1613 bcopy(&krule->dst, &rule->dst, sizeof(rule->dst)); 1614 1615 for (int i = 0; i < PF_SKIP_COUNT; ++i) { 1616 if (rule->skip[i].ptr == NULL) 1617 rule->skip[i].nr = -1; 1618 else 1619 rule->skip[i].nr = krule->skip[i].ptr->nr; 1620 } 1621 1622 strlcpy(rule->label, krule->label[0], sizeof(rule->label)); 1623 strlcpy(rule->ifname, krule->ifname, sizeof(rule->ifname)); 1624 strlcpy(rule->qname, krule->qname, sizeof(rule->qname)); 1625 strlcpy(rule->pqname, krule->pqname, sizeof(rule->pqname)); 1626 strlcpy(rule->tagname, krule->tagname, sizeof(rule->tagname)); 1627 strlcpy(rule->match_tagname, krule->match_tagname, 1628 sizeof(rule->match_tagname)); 1629 strlcpy(rule->overload_tblname, krule->overload_tblname, 1630 sizeof(rule->overload_tblname)); 1631 1632 pf_kpool_to_pool(&krule->rpool, &rule->rpool); 1633 1634 rule->evaluations = pf_counter_u64_fetch(&krule->evaluations); 1635 for (int i = 0; i < 2; i++) { 1636 rule->packets[i] = pf_counter_u64_fetch(&krule->packets[i]); 1637 rule->bytes[i] = pf_counter_u64_fetch(&krule->bytes[i]); 1638 } 1639 1640 /* kif, anchor, overload_tbl are not copied over. */ 1641 1642 rule->os_fingerprint = krule->os_fingerprint; 1643 1644 rule->rtableid = krule->rtableid; 1645 bcopy(krule->timeout, rule->timeout, sizeof(krule->timeout)); 1646 rule->max_states = krule->max_states; 1647 rule->max_src_nodes = krule->max_src_nodes; 1648 rule->max_src_states = krule->max_src_states; 1649 rule->max_src_conn = krule->max_src_conn; 1650 rule->max_src_conn_rate.limit = krule->max_src_conn_rate.limit; 1651 rule->max_src_conn_rate.seconds = krule->max_src_conn_rate.seconds; 1652 rule->qid = krule->qid; 1653 rule->pqid = krule->pqid; 1654 rule->nr = krule->nr; 1655 rule->prob = krule->prob; 1656 rule->cuid = krule->cuid; 1657 rule->cpid = krule->cpid; 1658 1659 rule->return_icmp = krule->return_icmp; 1660 rule->return_icmp6 = krule->return_icmp6; 1661 rule->max_mss = krule->max_mss; 1662 rule->tag = krule->tag; 1663 rule->match_tag = krule->match_tag; 1664 rule->scrub_flags = krule->scrub_flags; 1665 1666 bcopy(&krule->uid, &rule->uid, sizeof(krule->uid)); 1667 bcopy(&krule->gid, &rule->gid, sizeof(krule->gid)); 1668 1669 rule->rule_flag = krule->rule_flag; 1670 rule->action = krule->action; 1671 rule->direction = krule->direction; 1672 rule->log = krule->log; 1673 rule->logif = krule->logif; 1674 rule->quick = krule->quick; 1675 rule->ifnot = krule->ifnot; 1676 rule->match_tag_not = krule->match_tag_not; 1677 rule->natpass = krule->natpass; 1678 1679 rule->keep_state = krule->keep_state; 1680 rule->af = krule->af; 1681 rule->proto = krule->proto; 1682 rule->type = krule->type; 1683 rule->code = krule->code; 1684 rule->flags = krule->flags; 1685 rule->flagset = krule->flagset; 1686 rule->min_ttl = krule->min_ttl; 1687 rule->allow_opts = krule->allow_opts; 1688 rule->rt = krule->rt; 1689 rule->return_ttl = krule->return_ttl; 1690 rule->tos = krule->tos; 1691 rule->set_tos = krule->set_tos; 1692 rule->anchor_relative = krule->anchor_relative; 1693 rule->anchor_wildcard = krule->anchor_wildcard; 1694 1695 rule->flush = krule->flush; 1696 rule->prio = krule->prio; 1697 rule->set_prio[0] = krule->set_prio[0]; 1698 rule->set_prio[1] = krule->set_prio[1]; 1699 1700 bcopy(&krule->divert, &rule->divert, sizeof(krule->divert)); 1701 1702 rule->u_states_cur = counter_u64_fetch(krule->states_cur); 1703 rule->u_states_tot = counter_u64_fetch(krule->states_tot); 1704 rule->u_src_nodes = counter_u64_fetch(krule->src_nodes); 1705 } 1706 1707 static int 1708 pf_rule_to_krule(const struct pf_rule *rule, struct pf_krule *krule) 1709 { 1710 int ret; 1711 1712 #ifndef INET 1713 if (rule->af == AF_INET) { 1714 return (EAFNOSUPPORT); 1715 } 1716 #endif /* INET */ 1717 #ifndef INET6 1718 if (rule->af == AF_INET6) { 1719 return (EAFNOSUPPORT); 1720 } 1721 #endif /* INET6 */ 1722 1723 ret = pf_check_rule_addr(&rule->src); 1724 if (ret != 0) 1725 return (ret); 1726 ret = pf_check_rule_addr(&rule->dst); 1727 if (ret != 0) 1728 return (ret); 1729 1730 bzero(krule, sizeof(*krule)); 1731 1732 bcopy(&rule->src, &krule->src, sizeof(rule->src)); 1733 bcopy(&rule->dst, &krule->dst, sizeof(rule->dst)); 1734 1735 ret = pf_user_strcpy(krule->label[0], rule->label, sizeof(rule->label)); 1736 if (ret != 0) 1737 return (ret); 1738 ret = pf_user_strcpy(krule->ifname, rule->ifname, sizeof(rule->ifname)); 1739 if (ret != 0) 1740 return (ret); 1741 ret = pf_user_strcpy(krule->qname, rule->qname, sizeof(rule->qname)); 1742 if (ret != 0) 1743 return (ret); 1744 ret = pf_user_strcpy(krule->pqname, rule->pqname, sizeof(rule->pqname)); 1745 if (ret != 0) 1746 return (ret); 1747 ret = pf_user_strcpy(krule->tagname, rule->tagname, 1748 sizeof(rule->tagname)); 1749 if (ret != 0) 1750 return (ret); 1751 ret = pf_user_strcpy(krule->match_tagname, rule->match_tagname, 1752 sizeof(rule->match_tagname)); 1753 if (ret != 0) 1754 return (ret); 1755 ret = pf_user_strcpy(krule->overload_tblname, rule->overload_tblname, 1756 sizeof(rule->overload_tblname)); 1757 if (ret != 0) 1758 return (ret); 1759 1760 ret = pf_pool_to_kpool(&rule->rpool, &krule->rpool); 1761 if (ret != 0) 1762 return (ret); 1763 1764 /* Don't allow userspace to set evaulations, packets or bytes. */ 1765 /* kif, anchor, overload_tbl are not copied over. */ 1766 1767 krule->os_fingerprint = rule->os_fingerprint; 1768 1769 krule->rtableid = rule->rtableid; 1770 bcopy(rule->timeout, krule->timeout, sizeof(krule->timeout)); 1771 krule->max_states = rule->max_states; 1772 krule->max_src_nodes = rule->max_src_nodes; 1773 krule->max_src_states = rule->max_src_states; 1774 krule->max_src_conn = rule->max_src_conn; 1775 krule->max_src_conn_rate.limit = rule->max_src_conn_rate.limit; 1776 krule->max_src_conn_rate.seconds = rule->max_src_conn_rate.seconds; 1777 krule->qid = rule->qid; 1778 krule->pqid = rule->pqid; 1779 krule->nr = rule->nr; 1780 krule->prob = rule->prob; 1781 krule->cuid = rule->cuid; 1782 krule->cpid = rule->cpid; 1783 1784 krule->return_icmp = rule->return_icmp; 1785 krule->return_icmp6 = rule->return_icmp6; 1786 krule->max_mss = rule->max_mss; 1787 krule->tag = rule->tag; 1788 krule->match_tag = rule->match_tag; 1789 krule->scrub_flags = rule->scrub_flags; 1790 1791 bcopy(&rule->uid, &krule->uid, sizeof(krule->uid)); 1792 bcopy(&rule->gid, &krule->gid, sizeof(krule->gid)); 1793 1794 krule->rule_flag = rule->rule_flag; 1795 krule->action = rule->action; 1796 krule->direction = rule->direction; 1797 krule->log = rule->log; 1798 krule->logif = rule->logif; 1799 krule->quick = rule->quick; 1800 krule->ifnot = rule->ifnot; 1801 krule->match_tag_not = rule->match_tag_not; 1802 krule->natpass = rule->natpass; 1803 1804 krule->keep_state = rule->keep_state; 1805 krule->af = rule->af; 1806 krule->proto = rule->proto; 1807 krule->type = rule->type; 1808 krule->code = rule->code; 1809 krule->flags = rule->flags; 1810 krule->flagset = rule->flagset; 1811 krule->min_ttl = rule->min_ttl; 1812 krule->allow_opts = rule->allow_opts; 1813 krule->rt = rule->rt; 1814 krule->return_ttl = rule->return_ttl; 1815 krule->tos = rule->tos; 1816 krule->set_tos = rule->set_tos; 1817 krule->anchor_relative = rule->anchor_relative; 1818 krule->anchor_wildcard = rule->anchor_wildcard; 1819 1820 krule->flush = rule->flush; 1821 krule->prio = rule->prio; 1822 krule->set_prio[0] = rule->set_prio[0]; 1823 krule->set_prio[1] = rule->set_prio[1]; 1824 1825 bcopy(&rule->divert, &krule->divert, sizeof(krule->divert)); 1826 1827 return (0); 1828 } 1829 1830 static int 1831 pf_state_kill_to_kstate_kill(const struct pfioc_state_kill *psk, 1832 struct pf_kstate_kill *kill) 1833 { 1834 int ret; 1835 1836 bzero(kill, sizeof(*kill)); 1837 1838 bcopy(&psk->psk_pfcmp, &kill->psk_pfcmp, sizeof(kill->psk_pfcmp)); 1839 kill->psk_af = psk->psk_af; 1840 kill->psk_proto = psk->psk_proto; 1841 bcopy(&psk->psk_src, &kill->psk_src, sizeof(kill->psk_src)); 1842 bcopy(&psk->psk_dst, &kill->psk_dst, sizeof(kill->psk_dst)); 1843 ret = pf_user_strcpy(kill->psk_ifname, psk->psk_ifname, 1844 sizeof(kill->psk_ifname)); 1845 if (ret != 0) 1846 return (ret); 1847 ret = pf_user_strcpy(kill->psk_label, psk->psk_label, 1848 sizeof(kill->psk_label)); 1849 if (ret != 0) 1850 return (ret); 1851 1852 return (0); 1853 } 1854 1855 static int 1856 pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket, 1857 uint32_t pool_ticket, const char *anchor, const char *anchor_call, 1858 struct thread *td) 1859 { 1860 struct pf_kruleset *ruleset; 1861 struct pf_krule *tail; 1862 struct pf_kpooladdr *pa; 1863 struct pfi_kkif *kif = NULL; 1864 int rs_num; 1865 int error = 0; 1866 1867 if ((rule->return_icmp >> 8) > ICMP_MAXTYPE) { 1868 error = EINVAL; 1869 goto errout_unlocked; 1870 } 1871 1872 #define ERROUT(x) ERROUT_FUNCTION(errout, x) 1873 1874 if (rule->ifname[0]) 1875 kif = pf_kkif_create(M_WAITOK); 1876 pf_counter_u64_init(&rule->evaluations, M_WAITOK); 1877 for (int i = 0; i < 2; i++) { 1878 pf_counter_u64_init(&rule->packets[i], M_WAITOK); 1879 pf_counter_u64_init(&rule->bytes[i], M_WAITOK); 1880 } 1881 rule->states_cur = counter_u64_alloc(M_WAITOK); 1882 rule->states_tot = counter_u64_alloc(M_WAITOK); 1883 rule->src_nodes = counter_u64_alloc(M_WAITOK); 1884 rule->cuid = td->td_ucred->cr_ruid; 1885 rule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 1886 TAILQ_INIT(&rule->rpool.list); 1887 1888 PF_RULES_WLOCK(); 1889 #ifdef PF_WANT_32_TO_64_COUNTER 1890 LIST_INSERT_HEAD(&V_pf_allrulelist, rule, allrulelist); 1891 MPASS(!rule->allrulelinked); 1892 rule->allrulelinked = true; 1893 V_pf_allrulecount++; 1894 #endif 1895 ruleset = pf_find_kruleset(anchor); 1896 if (ruleset == NULL) 1897 ERROUT(EINVAL); 1898 rs_num = pf_get_ruleset_number(rule->action); 1899 if (rs_num >= PF_RULESET_MAX) 1900 ERROUT(EINVAL); 1901 if (ticket != ruleset->rules[rs_num].inactive.ticket) { 1902 DPFPRINTF(PF_DEBUG_MISC, 1903 ("ticket: %d != [%d]%d\n", ticket, rs_num, 1904 ruleset->rules[rs_num].inactive.ticket)); 1905 ERROUT(EBUSY); 1906 } 1907 if (pool_ticket != V_ticket_pabuf) { 1908 DPFPRINTF(PF_DEBUG_MISC, 1909 ("pool_ticket: %d != %d\n", pool_ticket, 1910 V_ticket_pabuf)); 1911 ERROUT(EBUSY); 1912 } 1913 1914 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr, 1915 pf_krulequeue); 1916 if (tail) 1917 rule->nr = tail->nr + 1; 1918 else 1919 rule->nr = 0; 1920 if (rule->ifname[0]) { 1921 rule->kif = pfi_kkif_attach(kif, rule->ifname); 1922 kif = NULL; 1923 pfi_kkif_ref(rule->kif); 1924 } else 1925 rule->kif = NULL; 1926 1927 if (rule->rtableid > 0 && rule->rtableid >= rt_numfibs) 1928 error = EBUSY; 1929 1930 #ifdef ALTQ 1931 /* set queue IDs */ 1932 if (rule->qname[0] != 0) { 1933 if ((rule->qid = pf_qname2qid(rule->qname)) == 0) 1934 error = EBUSY; 1935 else if (rule->pqname[0] != 0) { 1936 if ((rule->pqid = 1937 pf_qname2qid(rule->pqname)) == 0) 1938 error = EBUSY; 1939 } else 1940 rule->pqid = rule->qid; 1941 } 1942 #endif 1943 if (rule->tagname[0]) 1944 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0) 1945 error = EBUSY; 1946 if (rule->match_tagname[0]) 1947 if ((rule->match_tag = 1948 pf_tagname2tag(rule->match_tagname)) == 0) 1949 error = EBUSY; 1950 if (rule->rt && !rule->direction) 1951 error = EINVAL; 1952 if (!rule->log) 1953 rule->logif = 0; 1954 if (rule->logif >= PFLOGIFS_MAX) 1955 error = EINVAL; 1956 if (pf_addr_setup(ruleset, &rule->src.addr, rule->af)) 1957 error = ENOMEM; 1958 if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af)) 1959 error = ENOMEM; 1960 if (pf_kanchor_setup(rule, ruleset, anchor_call)) 1961 error = EINVAL; 1962 if (rule->scrub_flags & PFSTATE_SETPRIO && 1963 (rule->set_prio[0] > PF_PRIO_MAX || 1964 rule->set_prio[1] > PF_PRIO_MAX)) 1965 error = EINVAL; 1966 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 1967 if (pa->addr.type == PF_ADDR_TABLE) { 1968 pa->addr.p.tbl = pfr_attach_table(ruleset, 1969 pa->addr.v.tblname); 1970 if (pa->addr.p.tbl == NULL) 1971 error = ENOMEM; 1972 } 1973 1974 rule->overload_tbl = NULL; 1975 if (rule->overload_tblname[0]) { 1976 if ((rule->overload_tbl = pfr_attach_table(ruleset, 1977 rule->overload_tblname)) == NULL) 1978 error = EINVAL; 1979 else 1980 rule->overload_tbl->pfrkt_flags |= 1981 PFR_TFLAG_ACTIVE; 1982 } 1983 1984 pf_mv_kpool(&V_pf_pabuf, &rule->rpool.list); 1985 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) || 1986 (rule->action == PF_BINAT)) && rule->anchor == NULL) || 1987 (rule->rt > PF_NOPFROUTE)) && 1988 (TAILQ_FIRST(&rule->rpool.list) == NULL)) 1989 error = EINVAL; 1990 1991 if (error) { 1992 pf_free_rule(rule); 1993 rule = NULL; 1994 ERROUT(error); 1995 } 1996 1997 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list); 1998 pf_counter_u64_zero(&rule->evaluations); 1999 for (int i = 0; i < 2; i++) { 2000 pf_counter_u64_zero(&rule->packets[i]); 2001 pf_counter_u64_zero(&rule->bytes[i]); 2002 } 2003 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr, 2004 rule, entries); 2005 ruleset->rules[rs_num].inactive.rcount++; 2006 PF_RULES_WUNLOCK(); 2007 2008 return (0); 2009 2010 #undef ERROUT 2011 errout: 2012 PF_RULES_WUNLOCK(); 2013 errout_unlocked: 2014 pf_kkif_free(kif); 2015 pf_krule_free(rule); 2016 return (error); 2017 } 2018 2019 static bool 2020 pf_label_match(const struct pf_krule *rule, const char *label) 2021 { 2022 int i = 0; 2023 2024 while (*rule->label[i]) { 2025 if (strcmp(rule->label[i], label) == 0) 2026 return (true); 2027 i++; 2028 } 2029 2030 return (false); 2031 } 2032 2033 static unsigned int 2034 pf_kill_matching_state(struct pf_state_key_cmp *key, int dir) 2035 { 2036 struct pf_kstate *match; 2037 int more = 0; 2038 unsigned int killed = 0; 2039 2040 /* Call with unlocked hashrow */ 2041 2042 match = pf_find_state_all(key, dir, &more); 2043 if (match && !more) { 2044 pf_unlink_state(match, 0); 2045 killed++; 2046 } 2047 2048 return (killed); 2049 } 2050 2051 static int 2052 pf_killstates_row(struct pf_kstate_kill *psk, struct pf_idhash *ih) 2053 { 2054 struct pf_kstate *s; 2055 struct pf_state_key *sk; 2056 struct pf_addr *srcaddr, *dstaddr; 2057 struct pf_state_key_cmp match_key; 2058 int idx, killed = 0; 2059 unsigned int dir; 2060 u_int16_t srcport, dstport; 2061 struct pfi_kkif *kif; 2062 2063 relock_DIOCKILLSTATES: 2064 PF_HASHROW_LOCK(ih); 2065 LIST_FOREACH(s, &ih->states, entry) { 2066 /* For floating states look at the original kif. */ 2067 kif = s->kif == V_pfi_all ? s->orig_kif : s->kif; 2068 2069 sk = s->key[PF_SK_WIRE]; 2070 if (s->direction == PF_OUT) { 2071 srcaddr = &sk->addr[1]; 2072 dstaddr = &sk->addr[0]; 2073 srcport = sk->port[1]; 2074 dstport = sk->port[0]; 2075 } else { 2076 srcaddr = &sk->addr[0]; 2077 dstaddr = &sk->addr[1]; 2078 srcport = sk->port[0]; 2079 dstport = sk->port[1]; 2080 } 2081 2082 if (psk->psk_af && sk->af != psk->psk_af) 2083 continue; 2084 2085 if (psk->psk_proto && psk->psk_proto != sk->proto) 2086 continue; 2087 2088 if (! PF_MATCHA(psk->psk_src.neg, &psk->psk_src.addr.v.a.addr, 2089 &psk->psk_src.addr.v.a.mask, srcaddr, sk->af)) 2090 continue; 2091 2092 if (! PF_MATCHA(psk->psk_dst.neg, &psk->psk_dst.addr.v.a.addr, 2093 &psk->psk_dst.addr.v.a.mask, dstaddr, sk->af)) 2094 continue; 2095 2096 if (! PF_MATCHA(psk->psk_rt_addr.neg, 2097 &psk->psk_rt_addr.addr.v.a.addr, 2098 &psk->psk_rt_addr.addr.v.a.mask, 2099 &s->rt_addr, sk->af)) 2100 continue; 2101 2102 if (psk->psk_src.port_op != 0 && 2103 ! pf_match_port(psk->psk_src.port_op, 2104 psk->psk_src.port[0], psk->psk_src.port[1], srcport)) 2105 continue; 2106 2107 if (psk->psk_dst.port_op != 0 && 2108 ! pf_match_port(psk->psk_dst.port_op, 2109 psk->psk_dst.port[0], psk->psk_dst.port[1], dstport)) 2110 continue; 2111 2112 if (psk->psk_label[0] && 2113 ! pf_label_match(s->rule.ptr, psk->psk_label)) 2114 continue; 2115 2116 if (psk->psk_ifname[0] && strcmp(psk->psk_ifname, 2117 kif->pfik_name)) 2118 continue; 2119 2120 if (psk->psk_kill_match) { 2121 /* Create the key to find matching states, with lock 2122 * held. */ 2123 2124 bzero(&match_key, sizeof(match_key)); 2125 2126 if (s->direction == PF_OUT) { 2127 dir = PF_IN; 2128 idx = PF_SK_STACK; 2129 } else { 2130 dir = PF_OUT; 2131 idx = PF_SK_WIRE; 2132 } 2133 2134 match_key.af = s->key[idx]->af; 2135 match_key.proto = s->key[idx]->proto; 2136 PF_ACPY(&match_key.addr[0], 2137 &s->key[idx]->addr[1], match_key.af); 2138 match_key.port[0] = s->key[idx]->port[1]; 2139 PF_ACPY(&match_key.addr[1], 2140 &s->key[idx]->addr[0], match_key.af); 2141 match_key.port[1] = s->key[idx]->port[0]; 2142 } 2143 2144 pf_unlink_state(s, PF_ENTER_LOCKED); 2145 killed++; 2146 2147 if (psk->psk_kill_match) 2148 killed += pf_kill_matching_state(&match_key, dir); 2149 2150 goto relock_DIOCKILLSTATES; 2151 } 2152 PF_HASHROW_UNLOCK(ih); 2153 2154 return (killed); 2155 } 2156 2157 static int 2158 pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td) 2159 { 2160 int error = 0; 2161 PF_RULES_RLOCK_TRACKER; 2162 2163 #define ERROUT_IOCTL(target, x) \ 2164 do { \ 2165 error = (x); \ 2166 SDT_PROBE3(pf, ioctl, ioctl, error, cmd, error, __LINE__); \ 2167 goto target; \ 2168 } while (0) 2169 2170 2171 /* XXX keep in sync with switch() below */ 2172 if (securelevel_gt(td->td_ucred, 2)) 2173 switch (cmd) { 2174 case DIOCGETRULES: 2175 case DIOCGETRULE: 2176 case DIOCGETRULENV: 2177 case DIOCGETADDRS: 2178 case DIOCGETADDR: 2179 case DIOCGETSTATE: 2180 case DIOCGETSTATENV: 2181 case DIOCSETSTATUSIF: 2182 case DIOCGETSTATUS: 2183 case DIOCGETSTATUSNV: 2184 case DIOCCLRSTATUS: 2185 case DIOCNATLOOK: 2186 case DIOCSETDEBUG: 2187 case DIOCGETSTATES: 2188 case DIOCGETSTATESV2: 2189 case DIOCGETTIMEOUT: 2190 case DIOCCLRRULECTRS: 2191 case DIOCGETLIMIT: 2192 case DIOCGETALTQSV0: 2193 case DIOCGETALTQSV1: 2194 case DIOCGETALTQV0: 2195 case DIOCGETALTQV1: 2196 case DIOCGETQSTATSV0: 2197 case DIOCGETQSTATSV1: 2198 case DIOCGETRULESETS: 2199 case DIOCGETRULESET: 2200 case DIOCRGETTABLES: 2201 case DIOCRGETTSTATS: 2202 case DIOCRCLRTSTATS: 2203 case DIOCRCLRADDRS: 2204 case DIOCRADDADDRS: 2205 case DIOCRDELADDRS: 2206 case DIOCRSETADDRS: 2207 case DIOCRGETADDRS: 2208 case DIOCRGETASTATS: 2209 case DIOCRCLRASTATS: 2210 case DIOCRTSTADDRS: 2211 case DIOCOSFPGET: 2212 case DIOCGETSRCNODES: 2213 case DIOCCLRSRCNODES: 2214 case DIOCGETSYNCOOKIES: 2215 case DIOCIGETIFACES: 2216 case DIOCGIFSPEEDV0: 2217 case DIOCGIFSPEEDV1: 2218 case DIOCSETIFFLAG: 2219 case DIOCCLRIFFLAG: 2220 break; 2221 case DIOCRCLRTABLES: 2222 case DIOCRADDTABLES: 2223 case DIOCRDELTABLES: 2224 case DIOCRSETTFLAGS: 2225 if (((struct pfioc_table *)addr)->pfrio_flags & 2226 PFR_FLAG_DUMMY) 2227 break; /* dummy operation ok */ 2228 return (EPERM); 2229 default: 2230 return (EPERM); 2231 } 2232 2233 if (!(flags & FWRITE)) 2234 switch (cmd) { 2235 case DIOCGETRULES: 2236 case DIOCGETADDRS: 2237 case DIOCGETADDR: 2238 case DIOCGETSTATE: 2239 case DIOCGETSTATENV: 2240 case DIOCGETSTATUS: 2241 case DIOCGETSTATUSNV: 2242 case DIOCGETSTATES: 2243 case DIOCGETSTATESV2: 2244 case DIOCGETTIMEOUT: 2245 case DIOCGETLIMIT: 2246 case DIOCGETALTQSV0: 2247 case DIOCGETALTQSV1: 2248 case DIOCGETALTQV0: 2249 case DIOCGETALTQV1: 2250 case DIOCGETQSTATSV0: 2251 case DIOCGETQSTATSV1: 2252 case DIOCGETRULESETS: 2253 case DIOCGETRULESET: 2254 case DIOCNATLOOK: 2255 case DIOCRGETTABLES: 2256 case DIOCRGETTSTATS: 2257 case DIOCRGETADDRS: 2258 case DIOCRGETASTATS: 2259 case DIOCRTSTADDRS: 2260 case DIOCOSFPGET: 2261 case DIOCGETSRCNODES: 2262 case DIOCGETSYNCOOKIES: 2263 case DIOCIGETIFACES: 2264 case DIOCGIFSPEEDV1: 2265 case DIOCGIFSPEEDV0: 2266 case DIOCGETRULENV: 2267 break; 2268 case DIOCRCLRTABLES: 2269 case DIOCRADDTABLES: 2270 case DIOCRDELTABLES: 2271 case DIOCRCLRTSTATS: 2272 case DIOCRCLRADDRS: 2273 case DIOCRADDADDRS: 2274 case DIOCRDELADDRS: 2275 case DIOCRSETADDRS: 2276 case DIOCRSETTFLAGS: 2277 if (((struct pfioc_table *)addr)->pfrio_flags & 2278 PFR_FLAG_DUMMY) { 2279 flags |= FWRITE; /* need write lock for dummy */ 2280 break; /* dummy operation ok */ 2281 } 2282 return (EACCES); 2283 case DIOCGETRULE: 2284 if (((struct pfioc_rule *)addr)->action == 2285 PF_GET_CLR_CNTR) 2286 return (EACCES); 2287 break; 2288 default: 2289 return (EACCES); 2290 } 2291 2292 CURVNET_SET(TD_TO_VNET(td)); 2293 2294 switch (cmd) { 2295 case DIOCSTART: 2296 sx_xlock(&pf_ioctl_lock); 2297 if (V_pf_status.running) 2298 error = EEXIST; 2299 else { 2300 int cpu; 2301 2302 hook_pf(); 2303 V_pf_status.running = 1; 2304 V_pf_status.since = time_second; 2305 2306 CPU_FOREACH(cpu) 2307 V_pf_stateid[cpu] = time_second; 2308 2309 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n")); 2310 } 2311 break; 2312 2313 case DIOCSTOP: 2314 sx_xlock(&pf_ioctl_lock); 2315 if (!V_pf_status.running) 2316 error = ENOENT; 2317 else { 2318 V_pf_status.running = 0; 2319 dehook_pf(); 2320 V_pf_status.since = time_second; 2321 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n")); 2322 } 2323 break; 2324 2325 case DIOCADDRULENV: { 2326 struct pfioc_nv *nv = (struct pfioc_nv *)addr; 2327 nvlist_t *nvl = NULL; 2328 void *nvlpacked = NULL; 2329 struct pf_krule *rule = NULL; 2330 const char *anchor = "", *anchor_call = ""; 2331 uint32_t ticket = 0, pool_ticket = 0; 2332 2333 #define ERROUT(x) ERROUT_IOCTL(DIOCADDRULENV_error, x) 2334 2335 if (nv->len > pf_ioctl_maxcount) 2336 ERROUT(ENOMEM); 2337 2338 nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK); 2339 error = copyin(nv->data, nvlpacked, nv->len); 2340 if (error) 2341 ERROUT(error); 2342 2343 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 2344 if (nvl == NULL) 2345 ERROUT(EBADMSG); 2346 2347 if (! nvlist_exists_number(nvl, "ticket")) 2348 ERROUT(EINVAL); 2349 ticket = nvlist_get_number(nvl, "ticket"); 2350 2351 if (! nvlist_exists_number(nvl, "pool_ticket")) 2352 ERROUT(EINVAL); 2353 pool_ticket = nvlist_get_number(nvl, "pool_ticket"); 2354 2355 if (! nvlist_exists_nvlist(nvl, "rule")) 2356 ERROUT(EINVAL); 2357 2358 rule = malloc(sizeof(*rule), M_PFRULE, M_WAITOK | M_ZERO); 2359 error = pf_nvrule_to_krule(nvlist_get_nvlist(nvl, "rule"), 2360 rule); 2361 if (error) 2362 ERROUT(error); 2363 2364 if (nvlist_exists_string(nvl, "anchor")) 2365 anchor = nvlist_get_string(nvl, "anchor"); 2366 if (nvlist_exists_string(nvl, "anchor_call")) 2367 anchor_call = nvlist_get_string(nvl, "anchor_call"); 2368 2369 if ((error = nvlist_error(nvl))) 2370 ERROUT(error); 2371 2372 /* Frees rule on error */ 2373 error = pf_ioctl_addrule(rule, ticket, pool_ticket, anchor, 2374 anchor_call, td); 2375 2376 nvlist_destroy(nvl); 2377 free(nvlpacked, M_TEMP); 2378 break; 2379 #undef ERROUT 2380 DIOCADDRULENV_error: 2381 pf_krule_free(rule); 2382 nvlist_destroy(nvl); 2383 free(nvlpacked, M_TEMP); 2384 2385 break; 2386 } 2387 case DIOCADDRULE: { 2388 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 2389 struct pf_krule *rule; 2390 2391 rule = malloc(sizeof(*rule), M_PFRULE, M_WAITOK | M_ZERO); 2392 error = pf_rule_to_krule(&pr->rule, rule); 2393 if (error != 0) { 2394 free(rule, M_PFRULE); 2395 break; 2396 } 2397 2398 pr->anchor[sizeof(pr->anchor) - 1] = 0; 2399 2400 /* Frees rule on error */ 2401 error = pf_ioctl_addrule(rule, pr->ticket, pr->pool_ticket, 2402 pr->anchor, pr->anchor_call, td); 2403 break; 2404 } 2405 2406 case DIOCGETRULES: { 2407 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 2408 struct pf_kruleset *ruleset; 2409 struct pf_krule *tail; 2410 int rs_num; 2411 2412 pr->anchor[sizeof(pr->anchor) - 1] = 0; 2413 2414 PF_RULES_WLOCK(); 2415 ruleset = pf_find_kruleset(pr->anchor); 2416 if (ruleset == NULL) { 2417 PF_RULES_WUNLOCK(); 2418 error = EINVAL; 2419 break; 2420 } 2421 rs_num = pf_get_ruleset_number(pr->rule.action); 2422 if (rs_num >= PF_RULESET_MAX) { 2423 PF_RULES_WUNLOCK(); 2424 error = EINVAL; 2425 break; 2426 } 2427 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr, 2428 pf_krulequeue); 2429 if (tail) 2430 pr->nr = tail->nr + 1; 2431 else 2432 pr->nr = 0; 2433 pr->ticket = ruleset->rules[rs_num].active.ticket; 2434 PF_RULES_WUNLOCK(); 2435 break; 2436 } 2437 2438 case DIOCGETRULE: { 2439 struct pfioc_rule *pr = (struct pfioc_rule *)addr; 2440 struct pf_kruleset *ruleset; 2441 struct pf_krule *rule; 2442 int rs_num; 2443 2444 pr->anchor[sizeof(pr->anchor) - 1] = 0; 2445 2446 PF_RULES_WLOCK(); 2447 ruleset = pf_find_kruleset(pr->anchor); 2448 if (ruleset == NULL) { 2449 PF_RULES_WUNLOCK(); 2450 error = EINVAL; 2451 break; 2452 } 2453 rs_num = pf_get_ruleset_number(pr->rule.action); 2454 if (rs_num >= PF_RULESET_MAX) { 2455 PF_RULES_WUNLOCK(); 2456 error = EINVAL; 2457 break; 2458 } 2459 if (pr->ticket != ruleset->rules[rs_num].active.ticket) { 2460 PF_RULES_WUNLOCK(); 2461 error = EBUSY; 2462 break; 2463 } 2464 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 2465 while ((rule != NULL) && (rule->nr != pr->nr)) 2466 rule = TAILQ_NEXT(rule, entries); 2467 if (rule == NULL) { 2468 PF_RULES_WUNLOCK(); 2469 error = EBUSY; 2470 break; 2471 } 2472 2473 pf_krule_to_rule(rule, &pr->rule); 2474 2475 if (pf_kanchor_copyout(ruleset, rule, pr)) { 2476 PF_RULES_WUNLOCK(); 2477 error = EBUSY; 2478 break; 2479 } 2480 pf_addr_copyout(&pr->rule.src.addr); 2481 pf_addr_copyout(&pr->rule.dst.addr); 2482 2483 if (pr->action == PF_GET_CLR_CNTR) { 2484 pf_counter_u64_zero(&rule->evaluations); 2485 for (int i = 0; i < 2; i++) { 2486 pf_counter_u64_zero(&rule->packets[i]); 2487 pf_counter_u64_zero(&rule->bytes[i]); 2488 } 2489 counter_u64_zero(rule->states_tot); 2490 } 2491 PF_RULES_WUNLOCK(); 2492 break; 2493 } 2494 2495 case DIOCGETRULENV: { 2496 struct pfioc_nv *nv = (struct pfioc_nv *)addr; 2497 nvlist_t *nvrule = NULL; 2498 nvlist_t *nvl = NULL; 2499 struct pf_kruleset *ruleset; 2500 struct pf_krule *rule; 2501 void *nvlpacked = NULL; 2502 int rs_num, nr; 2503 bool clear_counter = false; 2504 2505 #define ERROUT(x) ERROUT_IOCTL(DIOCGETRULENV_error, x) 2506 2507 if (nv->len > pf_ioctl_maxcount) 2508 ERROUT(ENOMEM); 2509 2510 /* Copy the request in */ 2511 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 2512 if (nvlpacked == NULL) 2513 ERROUT(ENOMEM); 2514 2515 error = copyin(nv->data, nvlpacked, nv->len); 2516 if (error) 2517 ERROUT(error); 2518 2519 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 2520 if (nvl == NULL) 2521 ERROUT(EBADMSG); 2522 2523 if (! nvlist_exists_string(nvl, "anchor")) 2524 ERROUT(EBADMSG); 2525 if (! nvlist_exists_number(nvl, "ruleset")) 2526 ERROUT(EBADMSG); 2527 if (! nvlist_exists_number(nvl, "ticket")) 2528 ERROUT(EBADMSG); 2529 if (! nvlist_exists_number(nvl, "nr")) 2530 ERROUT(EBADMSG); 2531 2532 if (nvlist_exists_bool(nvl, "clear_counter")) 2533 clear_counter = nvlist_get_bool(nvl, "clear_counter"); 2534 2535 if (clear_counter && !(flags & FWRITE)) 2536 ERROUT(EACCES); 2537 2538 nr = nvlist_get_number(nvl, "nr"); 2539 2540 PF_RULES_WLOCK(); 2541 ruleset = pf_find_kruleset(nvlist_get_string(nvl, "anchor")); 2542 if (ruleset == NULL) { 2543 PF_RULES_WUNLOCK(); 2544 ERROUT(ENOENT); 2545 } 2546 2547 rs_num = pf_get_ruleset_number(nvlist_get_number(nvl, "ruleset")); 2548 if (rs_num >= PF_RULESET_MAX) { 2549 PF_RULES_WUNLOCK(); 2550 ERROUT(EINVAL); 2551 } 2552 2553 if (nvlist_get_number(nvl, "ticket") != 2554 ruleset->rules[rs_num].active.ticket) { 2555 PF_RULES_WUNLOCK(); 2556 ERROUT(EBUSY); 2557 } 2558 2559 if ((error = nvlist_error(nvl))) { 2560 PF_RULES_WUNLOCK(); 2561 ERROUT(error); 2562 } 2563 2564 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 2565 while ((rule != NULL) && (rule->nr != nr)) 2566 rule = TAILQ_NEXT(rule, entries); 2567 if (rule == NULL) { 2568 PF_RULES_WUNLOCK(); 2569 ERROUT(EBUSY); 2570 } 2571 2572 nvrule = pf_krule_to_nvrule(rule); 2573 2574 nvlist_destroy(nvl); 2575 nvl = nvlist_create(0); 2576 if (nvl == NULL) { 2577 PF_RULES_WUNLOCK(); 2578 ERROUT(ENOMEM); 2579 } 2580 nvlist_add_number(nvl, "nr", nr); 2581 nvlist_add_nvlist(nvl, "rule", nvrule); 2582 nvlist_destroy(nvrule); 2583 nvrule = NULL; 2584 if (pf_kanchor_nvcopyout(ruleset, rule, nvl)) { 2585 PF_RULES_WUNLOCK(); 2586 ERROUT(EBUSY); 2587 } 2588 2589 free(nvlpacked, M_NVLIST); 2590 nvlpacked = nvlist_pack(nvl, &nv->len); 2591 if (nvlpacked == NULL) { 2592 PF_RULES_WUNLOCK(); 2593 ERROUT(ENOMEM); 2594 } 2595 2596 if (nv->size == 0) { 2597 PF_RULES_WUNLOCK(); 2598 ERROUT(0); 2599 } 2600 else if (nv->size < nv->len) { 2601 PF_RULES_WUNLOCK(); 2602 ERROUT(ENOSPC); 2603 } 2604 2605 if (clear_counter) { 2606 pf_counter_u64_zero(&rule->evaluations); 2607 for (int i = 0; i < 2; i++) { 2608 pf_counter_u64_zero(&rule->packets[i]); 2609 pf_counter_u64_zero(&rule->bytes[i]); 2610 } 2611 counter_u64_zero(rule->states_tot); 2612 } 2613 PF_RULES_WUNLOCK(); 2614 2615 error = copyout(nvlpacked, nv->data, nv->len); 2616 2617 #undef ERROUT 2618 DIOCGETRULENV_error: 2619 free(nvlpacked, M_NVLIST); 2620 nvlist_destroy(nvrule); 2621 nvlist_destroy(nvl); 2622 2623 break; 2624 } 2625 2626 case DIOCCHANGERULE: { 2627 struct pfioc_rule *pcr = (struct pfioc_rule *)addr; 2628 struct pf_kruleset *ruleset; 2629 struct pf_krule *oldrule = NULL, *newrule = NULL; 2630 struct pfi_kkif *kif = NULL; 2631 struct pf_kpooladdr *pa; 2632 u_int32_t nr = 0; 2633 int rs_num; 2634 2635 pcr->anchor[sizeof(pcr->anchor) - 1] = 0; 2636 2637 if (pcr->action < PF_CHANGE_ADD_HEAD || 2638 pcr->action > PF_CHANGE_GET_TICKET) { 2639 error = EINVAL; 2640 break; 2641 } 2642 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) { 2643 error = EINVAL; 2644 break; 2645 } 2646 2647 if (pcr->action != PF_CHANGE_REMOVE) { 2648 newrule = malloc(sizeof(*newrule), M_PFRULE, M_WAITOK | M_ZERO); 2649 error = pf_rule_to_krule(&pcr->rule, newrule); 2650 if (error != 0) { 2651 free(newrule, M_PFRULE); 2652 break; 2653 } 2654 2655 if (newrule->ifname[0]) 2656 kif = pf_kkif_create(M_WAITOK); 2657 pf_counter_u64_init(&newrule->evaluations, M_WAITOK); 2658 for (int i = 0; i < 2; i++) { 2659 pf_counter_u64_init(&newrule->packets[i], M_WAITOK); 2660 pf_counter_u64_init(&newrule->bytes[i], M_WAITOK); 2661 } 2662 newrule->states_cur = counter_u64_alloc(M_WAITOK); 2663 newrule->states_tot = counter_u64_alloc(M_WAITOK); 2664 newrule->src_nodes = counter_u64_alloc(M_WAITOK); 2665 newrule->cuid = td->td_ucred->cr_ruid; 2666 newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0; 2667 TAILQ_INIT(&newrule->rpool.list); 2668 } 2669 #define ERROUT(x) { error = (x); goto DIOCCHANGERULE_error; } 2670 2671 PF_RULES_WLOCK(); 2672 #ifdef PF_WANT_32_TO_64_COUNTER 2673 if (newrule != NULL) { 2674 LIST_INSERT_HEAD(&V_pf_allrulelist, newrule, allrulelist); 2675 newrule->allrulelinked = true; 2676 V_pf_allrulecount++; 2677 } 2678 #endif 2679 2680 if (!(pcr->action == PF_CHANGE_REMOVE || 2681 pcr->action == PF_CHANGE_GET_TICKET) && 2682 pcr->pool_ticket != V_ticket_pabuf) 2683 ERROUT(EBUSY); 2684 2685 ruleset = pf_find_kruleset(pcr->anchor); 2686 if (ruleset == NULL) 2687 ERROUT(EINVAL); 2688 2689 rs_num = pf_get_ruleset_number(pcr->rule.action); 2690 if (rs_num >= PF_RULESET_MAX) 2691 ERROUT(EINVAL); 2692 2693 if (pcr->action == PF_CHANGE_GET_TICKET) { 2694 pcr->ticket = ++ruleset->rules[rs_num].active.ticket; 2695 ERROUT(0); 2696 } else if (pcr->ticket != 2697 ruleset->rules[rs_num].active.ticket) 2698 ERROUT(EINVAL); 2699 2700 if (pcr->action != PF_CHANGE_REMOVE) { 2701 if (newrule->ifname[0]) { 2702 newrule->kif = pfi_kkif_attach(kif, 2703 newrule->ifname); 2704 kif = NULL; 2705 pfi_kkif_ref(newrule->kif); 2706 } else 2707 newrule->kif = NULL; 2708 2709 if (newrule->rtableid > 0 && 2710 newrule->rtableid >= rt_numfibs) 2711 error = EBUSY; 2712 2713 #ifdef ALTQ 2714 /* set queue IDs */ 2715 if (newrule->qname[0] != 0) { 2716 if ((newrule->qid = 2717 pf_qname2qid(newrule->qname)) == 0) 2718 error = EBUSY; 2719 else if (newrule->pqname[0] != 0) { 2720 if ((newrule->pqid = 2721 pf_qname2qid(newrule->pqname)) == 0) 2722 error = EBUSY; 2723 } else 2724 newrule->pqid = newrule->qid; 2725 } 2726 #endif /* ALTQ */ 2727 if (newrule->tagname[0]) 2728 if ((newrule->tag = 2729 pf_tagname2tag(newrule->tagname)) == 0) 2730 error = EBUSY; 2731 if (newrule->match_tagname[0]) 2732 if ((newrule->match_tag = pf_tagname2tag( 2733 newrule->match_tagname)) == 0) 2734 error = EBUSY; 2735 if (newrule->rt && !newrule->direction) 2736 error = EINVAL; 2737 if (!newrule->log) 2738 newrule->logif = 0; 2739 if (newrule->logif >= PFLOGIFS_MAX) 2740 error = EINVAL; 2741 if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af)) 2742 error = ENOMEM; 2743 if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af)) 2744 error = ENOMEM; 2745 if (pf_kanchor_setup(newrule, ruleset, pcr->anchor_call)) 2746 error = EINVAL; 2747 TAILQ_FOREACH(pa, &V_pf_pabuf, entries) 2748 if (pa->addr.type == PF_ADDR_TABLE) { 2749 pa->addr.p.tbl = 2750 pfr_attach_table(ruleset, 2751 pa->addr.v.tblname); 2752 if (pa->addr.p.tbl == NULL) 2753 error = ENOMEM; 2754 } 2755 2756 newrule->overload_tbl = NULL; 2757 if (newrule->overload_tblname[0]) { 2758 if ((newrule->overload_tbl = pfr_attach_table( 2759 ruleset, newrule->overload_tblname)) == 2760 NULL) 2761 error = EINVAL; 2762 else 2763 newrule->overload_tbl->pfrkt_flags |= 2764 PFR_TFLAG_ACTIVE; 2765 } 2766 2767 pf_mv_kpool(&V_pf_pabuf, &newrule->rpool.list); 2768 if (((((newrule->action == PF_NAT) || 2769 (newrule->action == PF_RDR) || 2770 (newrule->action == PF_BINAT) || 2771 (newrule->rt > PF_NOPFROUTE)) && 2772 !newrule->anchor)) && 2773 (TAILQ_FIRST(&newrule->rpool.list) == NULL)) 2774 error = EINVAL; 2775 2776 if (error) { 2777 pf_free_rule(newrule); 2778 PF_RULES_WUNLOCK(); 2779 break; 2780 } 2781 2782 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list); 2783 } 2784 pf_empty_kpool(&V_pf_pabuf); 2785 2786 if (pcr->action == PF_CHANGE_ADD_HEAD) 2787 oldrule = TAILQ_FIRST( 2788 ruleset->rules[rs_num].active.ptr); 2789 else if (pcr->action == PF_CHANGE_ADD_TAIL) 2790 oldrule = TAILQ_LAST( 2791 ruleset->rules[rs_num].active.ptr, pf_krulequeue); 2792 else { 2793 oldrule = TAILQ_FIRST( 2794 ruleset->rules[rs_num].active.ptr); 2795 while ((oldrule != NULL) && (oldrule->nr != pcr->nr)) 2796 oldrule = TAILQ_NEXT(oldrule, entries); 2797 if (oldrule == NULL) { 2798 if (newrule != NULL) 2799 pf_free_rule(newrule); 2800 PF_RULES_WUNLOCK(); 2801 error = EINVAL; 2802 break; 2803 } 2804 } 2805 2806 if (pcr->action == PF_CHANGE_REMOVE) { 2807 pf_unlink_rule(ruleset->rules[rs_num].active.ptr, 2808 oldrule); 2809 ruleset->rules[rs_num].active.rcount--; 2810 } else { 2811 if (oldrule == NULL) 2812 TAILQ_INSERT_TAIL( 2813 ruleset->rules[rs_num].active.ptr, 2814 newrule, entries); 2815 else if (pcr->action == PF_CHANGE_ADD_HEAD || 2816 pcr->action == PF_CHANGE_ADD_BEFORE) 2817 TAILQ_INSERT_BEFORE(oldrule, newrule, entries); 2818 else 2819 TAILQ_INSERT_AFTER( 2820 ruleset->rules[rs_num].active.ptr, 2821 oldrule, newrule, entries); 2822 ruleset->rules[rs_num].active.rcount++; 2823 } 2824 2825 nr = 0; 2826 TAILQ_FOREACH(oldrule, 2827 ruleset->rules[rs_num].active.ptr, entries) 2828 oldrule->nr = nr++; 2829 2830 ruleset->rules[rs_num].active.ticket++; 2831 2832 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr); 2833 pf_remove_if_empty_kruleset(ruleset); 2834 2835 PF_RULES_WUNLOCK(); 2836 break; 2837 2838 #undef ERROUT 2839 DIOCCHANGERULE_error: 2840 PF_RULES_WUNLOCK(); 2841 pf_krule_free(newrule); 2842 pf_kkif_free(kif); 2843 break; 2844 } 2845 2846 case DIOCCLRSTATES: { 2847 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 2848 struct pf_kstate_kill kill; 2849 2850 error = pf_state_kill_to_kstate_kill(psk, &kill); 2851 if (error) 2852 break; 2853 2854 psk->psk_killed = pf_clear_states(&kill); 2855 break; 2856 } 2857 2858 case DIOCCLRSTATESNV: { 2859 error = pf_clearstates_nv((struct pfioc_nv *)addr); 2860 break; 2861 } 2862 2863 case DIOCKILLSTATES: { 2864 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr; 2865 struct pf_kstate_kill kill; 2866 2867 error = pf_state_kill_to_kstate_kill(psk, &kill); 2868 if (error) 2869 break; 2870 2871 psk->psk_killed = 0; 2872 pf_killstates(&kill, &psk->psk_killed); 2873 break; 2874 } 2875 2876 case DIOCKILLSTATESNV: { 2877 error = pf_killstates_nv((struct pfioc_nv *)addr); 2878 break; 2879 } 2880 2881 case DIOCADDSTATE: { 2882 struct pfioc_state *ps = (struct pfioc_state *)addr; 2883 struct pfsync_state *sp = &ps->state; 2884 2885 if (sp->timeout >= PFTM_MAX) { 2886 error = EINVAL; 2887 break; 2888 } 2889 if (V_pfsync_state_import_ptr != NULL) { 2890 PF_RULES_RLOCK(); 2891 error = V_pfsync_state_import_ptr(sp, PFSYNC_SI_IOCTL); 2892 PF_RULES_RUNLOCK(); 2893 } else 2894 error = EOPNOTSUPP; 2895 break; 2896 } 2897 2898 case DIOCGETSTATE: { 2899 struct pfioc_state *ps = (struct pfioc_state *)addr; 2900 struct pf_kstate *s; 2901 2902 s = pf_find_state_byid(ps->state.id, ps->state.creatorid); 2903 if (s == NULL) { 2904 error = ENOENT; 2905 break; 2906 } 2907 2908 pfsync_state_export(&ps->state, s); 2909 PF_STATE_UNLOCK(s); 2910 break; 2911 } 2912 2913 case DIOCGETSTATENV: { 2914 error = pf_getstate((struct pfioc_nv *)addr); 2915 break; 2916 } 2917 2918 case DIOCGETSTATES: { 2919 struct pfioc_states *ps = (struct pfioc_states *)addr; 2920 struct pf_kstate *s; 2921 struct pfsync_state *pstore, *p; 2922 int i, nr; 2923 size_t slice_count = 16, count; 2924 void *out; 2925 2926 if (ps->ps_len <= 0) { 2927 nr = uma_zone_get_cur(V_pf_state_z); 2928 ps->ps_len = sizeof(struct pfsync_state) * nr; 2929 break; 2930 } 2931 2932 out = ps->ps_states; 2933 pstore = mallocarray(slice_count, 2934 sizeof(struct pfsync_state), M_TEMP, M_WAITOK | M_ZERO); 2935 nr = 0; 2936 2937 for (i = 0; i <= pf_hashmask; i++) { 2938 struct pf_idhash *ih = &V_pf_idhash[i]; 2939 2940 DIOCGETSTATES_retry: 2941 p = pstore; 2942 2943 if (LIST_EMPTY(&ih->states)) 2944 continue; 2945 2946 PF_HASHROW_LOCK(ih); 2947 count = 0; 2948 LIST_FOREACH(s, &ih->states, entry) { 2949 if (s->timeout == PFTM_UNLINKED) 2950 continue; 2951 count++; 2952 } 2953 2954 if (count > slice_count) { 2955 PF_HASHROW_UNLOCK(ih); 2956 free(pstore, M_TEMP); 2957 slice_count = count * 2; 2958 pstore = mallocarray(slice_count, 2959 sizeof(struct pfsync_state), M_TEMP, 2960 M_WAITOK | M_ZERO); 2961 goto DIOCGETSTATES_retry; 2962 } 2963 2964 if ((nr+count) * sizeof(*p) > ps->ps_len) { 2965 PF_HASHROW_UNLOCK(ih); 2966 goto DIOCGETSTATES_full; 2967 } 2968 2969 LIST_FOREACH(s, &ih->states, entry) { 2970 if (s->timeout == PFTM_UNLINKED) 2971 continue; 2972 2973 pfsync_state_export(p, s); 2974 p++; 2975 nr++; 2976 } 2977 PF_HASHROW_UNLOCK(ih); 2978 error = copyout(pstore, out, 2979 sizeof(struct pfsync_state) * count); 2980 if (error) 2981 break; 2982 out = ps->ps_states + nr; 2983 } 2984 DIOCGETSTATES_full: 2985 ps->ps_len = sizeof(struct pfsync_state) * nr; 2986 free(pstore, M_TEMP); 2987 2988 break; 2989 } 2990 2991 case DIOCGETSTATESV2: { 2992 struct pfioc_states_v2 *ps = (struct pfioc_states_v2 *)addr; 2993 struct pf_kstate *s; 2994 struct pf_state_export *pstore, *p; 2995 int i, nr; 2996 size_t slice_count = 16, count; 2997 void *out; 2998 2999 if (ps->ps_req_version > PF_STATE_VERSION) { 3000 error = ENOTSUP; 3001 break; 3002 } 3003 3004 if (ps->ps_len <= 0) { 3005 nr = uma_zone_get_cur(V_pf_state_z); 3006 ps->ps_len = sizeof(struct pf_state_export) * nr; 3007 break; 3008 } 3009 3010 out = ps->ps_states; 3011 pstore = mallocarray(slice_count, 3012 sizeof(struct pf_state_export), M_TEMP, M_WAITOK | M_ZERO); 3013 nr = 0; 3014 3015 for (i = 0; i <= pf_hashmask; i++) { 3016 struct pf_idhash *ih = &V_pf_idhash[i]; 3017 3018 DIOCGETSTATESV2_retry: 3019 p = pstore; 3020 3021 if (LIST_EMPTY(&ih->states)) 3022 continue; 3023 3024 PF_HASHROW_LOCK(ih); 3025 count = 0; 3026 LIST_FOREACH(s, &ih->states, entry) { 3027 if (s->timeout == PFTM_UNLINKED) 3028 continue; 3029 count++; 3030 } 3031 3032 if (count > slice_count) { 3033 PF_HASHROW_UNLOCK(ih); 3034 free(pstore, M_TEMP); 3035 slice_count = count * 2; 3036 pstore = mallocarray(slice_count, 3037 sizeof(struct pf_state_export), M_TEMP, 3038 M_WAITOK | M_ZERO); 3039 goto DIOCGETSTATESV2_retry; 3040 } 3041 3042 if ((nr+count) * sizeof(*p) > ps->ps_len) { 3043 PF_HASHROW_UNLOCK(ih); 3044 goto DIOCGETSTATESV2_full; 3045 } 3046 3047 LIST_FOREACH(s, &ih->states, entry) { 3048 if (s->timeout == PFTM_UNLINKED) 3049 continue; 3050 3051 pf_state_export(p, s); 3052 p++; 3053 nr++; 3054 } 3055 PF_HASHROW_UNLOCK(ih); 3056 error = copyout(pstore, out, 3057 sizeof(struct pf_state_export) * count); 3058 if (error) 3059 break; 3060 out = ps->ps_states + nr; 3061 } 3062 DIOCGETSTATESV2_full: 3063 ps->ps_len = nr * sizeof(struct pf_state_export); 3064 free(pstore, M_TEMP); 3065 3066 break; 3067 } 3068 3069 case DIOCGETSTATUS: { 3070 struct pf_status *s = (struct pf_status *)addr; 3071 3072 PF_RULES_RLOCK(); 3073 s->running = V_pf_status.running; 3074 s->since = V_pf_status.since; 3075 s->debug = V_pf_status.debug; 3076 s->hostid = V_pf_status.hostid; 3077 s->states = V_pf_status.states; 3078 s->src_nodes = V_pf_status.src_nodes; 3079 3080 for (int i = 0; i < PFRES_MAX; i++) 3081 s->counters[i] = 3082 counter_u64_fetch(V_pf_status.counters[i]); 3083 for (int i = 0; i < LCNT_MAX; i++) 3084 s->lcounters[i] = 3085 counter_u64_fetch(V_pf_status.lcounters[i]); 3086 for (int i = 0; i < FCNT_MAX; i++) 3087 s->fcounters[i] = 3088 pf_counter_u64_fetch(&V_pf_status.fcounters[i]); 3089 for (int i = 0; i < SCNT_MAX; i++) 3090 s->scounters[i] = 3091 counter_u64_fetch(V_pf_status.scounters[i]); 3092 3093 bcopy(V_pf_status.ifname, s->ifname, IFNAMSIZ); 3094 bcopy(V_pf_status.pf_chksum, s->pf_chksum, 3095 PF_MD5_DIGEST_LENGTH); 3096 3097 pfi_update_status(s->ifname, s); 3098 PF_RULES_RUNLOCK(); 3099 break; 3100 } 3101 3102 case DIOCGETSTATUSNV: { 3103 error = pf_getstatus((struct pfioc_nv *)addr); 3104 break; 3105 } 3106 3107 case DIOCSETSTATUSIF: { 3108 struct pfioc_if *pi = (struct pfioc_if *)addr; 3109 3110 if (pi->ifname[0] == 0) { 3111 bzero(V_pf_status.ifname, IFNAMSIZ); 3112 break; 3113 } 3114 PF_RULES_WLOCK(); 3115 error = pf_user_strcpy(V_pf_status.ifname, pi->ifname, IFNAMSIZ); 3116 PF_RULES_WUNLOCK(); 3117 break; 3118 } 3119 3120 case DIOCCLRSTATUS: { 3121 PF_RULES_WLOCK(); 3122 for (int i = 0; i < PFRES_MAX; i++) 3123 counter_u64_zero(V_pf_status.counters[i]); 3124 for (int i = 0; i < FCNT_MAX; i++) 3125 pf_counter_u64_zero(&V_pf_status.fcounters[i]); 3126 for (int i = 0; i < SCNT_MAX; i++) 3127 counter_u64_zero(V_pf_status.scounters[i]); 3128 for (int i = 0; i < KLCNT_MAX; i++) 3129 counter_u64_zero(V_pf_status.lcounters[i]); 3130 V_pf_status.since = time_second; 3131 if (*V_pf_status.ifname) 3132 pfi_update_status(V_pf_status.ifname, NULL); 3133 PF_RULES_WUNLOCK(); 3134 break; 3135 } 3136 3137 case DIOCNATLOOK: { 3138 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr; 3139 struct pf_state_key *sk; 3140 struct pf_kstate *state; 3141 struct pf_state_key_cmp key; 3142 int m = 0, direction = pnl->direction; 3143 int sidx, didx; 3144 3145 /* NATLOOK src and dst are reversed, so reverse sidx/didx */ 3146 sidx = (direction == PF_IN) ? 1 : 0; 3147 didx = (direction == PF_IN) ? 0 : 1; 3148 3149 if (!pnl->proto || 3150 PF_AZERO(&pnl->saddr, pnl->af) || 3151 PF_AZERO(&pnl->daddr, pnl->af) || 3152 ((pnl->proto == IPPROTO_TCP || 3153 pnl->proto == IPPROTO_UDP) && 3154 (!pnl->dport || !pnl->sport))) 3155 error = EINVAL; 3156 else { 3157 bzero(&key, sizeof(key)); 3158 key.af = pnl->af; 3159 key.proto = pnl->proto; 3160 PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af); 3161 key.port[sidx] = pnl->sport; 3162 PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af); 3163 key.port[didx] = pnl->dport; 3164 3165 state = pf_find_state_all(&key, direction, &m); 3166 3167 if (m > 1) 3168 error = E2BIG; /* more than one state */ 3169 else if (state != NULL) { 3170 /* XXXGL: not locked read */ 3171 sk = state->key[sidx]; 3172 PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af); 3173 pnl->rsport = sk->port[sidx]; 3174 PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af); 3175 pnl->rdport = sk->port[didx]; 3176 } else 3177 error = ENOENT; 3178 } 3179 break; 3180 } 3181 3182 case DIOCSETTIMEOUT: { 3183 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 3184 int old; 3185 3186 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX || 3187 pt->seconds < 0) { 3188 error = EINVAL; 3189 break; 3190 } 3191 PF_RULES_WLOCK(); 3192 old = V_pf_default_rule.timeout[pt->timeout]; 3193 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0) 3194 pt->seconds = 1; 3195 V_pf_default_rule.timeout[pt->timeout] = pt->seconds; 3196 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old) 3197 wakeup(pf_purge_thread); 3198 pt->seconds = old; 3199 PF_RULES_WUNLOCK(); 3200 break; 3201 } 3202 3203 case DIOCGETTIMEOUT: { 3204 struct pfioc_tm *pt = (struct pfioc_tm *)addr; 3205 3206 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) { 3207 error = EINVAL; 3208 break; 3209 } 3210 PF_RULES_RLOCK(); 3211 pt->seconds = V_pf_default_rule.timeout[pt->timeout]; 3212 PF_RULES_RUNLOCK(); 3213 break; 3214 } 3215 3216 case DIOCGETLIMIT: { 3217 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 3218 3219 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) { 3220 error = EINVAL; 3221 break; 3222 } 3223 PF_RULES_RLOCK(); 3224 pl->limit = V_pf_limits[pl->index].limit; 3225 PF_RULES_RUNLOCK(); 3226 break; 3227 } 3228 3229 case DIOCSETLIMIT: { 3230 struct pfioc_limit *pl = (struct pfioc_limit *)addr; 3231 int old_limit; 3232 3233 PF_RULES_WLOCK(); 3234 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX || 3235 V_pf_limits[pl->index].zone == NULL) { 3236 PF_RULES_WUNLOCK(); 3237 error = EINVAL; 3238 break; 3239 } 3240 uma_zone_set_max(V_pf_limits[pl->index].zone, pl->limit); 3241 old_limit = V_pf_limits[pl->index].limit; 3242 V_pf_limits[pl->index].limit = pl->limit; 3243 pl->limit = old_limit; 3244 PF_RULES_WUNLOCK(); 3245 break; 3246 } 3247 3248 case DIOCSETDEBUG: { 3249 u_int32_t *level = (u_int32_t *)addr; 3250 3251 PF_RULES_WLOCK(); 3252 V_pf_status.debug = *level; 3253 PF_RULES_WUNLOCK(); 3254 break; 3255 } 3256 3257 case DIOCCLRRULECTRS: { 3258 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */ 3259 struct pf_kruleset *ruleset = &pf_main_ruleset; 3260 struct pf_krule *rule; 3261 3262 PF_RULES_WLOCK(); 3263 TAILQ_FOREACH(rule, 3264 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) { 3265 pf_counter_u64_zero(&rule->evaluations); 3266 for (int i = 0; i < 2; i++) { 3267 pf_counter_u64_zero(&rule->packets[i]); 3268 pf_counter_u64_zero(&rule->bytes[i]); 3269 } 3270 } 3271 PF_RULES_WUNLOCK(); 3272 break; 3273 } 3274 3275 case DIOCGIFSPEEDV0: 3276 case DIOCGIFSPEEDV1: { 3277 struct pf_ifspeed_v1 *psp = (struct pf_ifspeed_v1 *)addr; 3278 struct pf_ifspeed_v1 ps; 3279 struct ifnet *ifp; 3280 3281 if (psp->ifname[0] == '\0') { 3282 error = EINVAL; 3283 break; 3284 } 3285 3286 error = pf_user_strcpy(ps.ifname, psp->ifname, IFNAMSIZ); 3287 if (error != 0) 3288 break; 3289 ifp = ifunit(ps.ifname); 3290 if (ifp != NULL) { 3291 psp->baudrate32 = 3292 (u_int32_t)uqmin(ifp->if_baudrate, UINT_MAX); 3293 if (cmd == DIOCGIFSPEEDV1) 3294 psp->baudrate = ifp->if_baudrate; 3295 } else { 3296 error = EINVAL; 3297 } 3298 break; 3299 } 3300 3301 #ifdef ALTQ 3302 case DIOCSTARTALTQ: { 3303 struct pf_altq *altq; 3304 3305 PF_RULES_WLOCK(); 3306 /* enable all altq interfaces on active list */ 3307 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 3308 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 3309 error = pf_enable_altq(altq); 3310 if (error != 0) 3311 break; 3312 } 3313 } 3314 if (error == 0) 3315 V_pf_altq_running = 1; 3316 PF_RULES_WUNLOCK(); 3317 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n")); 3318 break; 3319 } 3320 3321 case DIOCSTOPALTQ: { 3322 struct pf_altq *altq; 3323 3324 PF_RULES_WLOCK(); 3325 /* disable all altq interfaces on active list */ 3326 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) { 3327 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) { 3328 error = pf_disable_altq(altq); 3329 if (error != 0) 3330 break; 3331 } 3332 } 3333 if (error == 0) 3334 V_pf_altq_running = 0; 3335 PF_RULES_WUNLOCK(); 3336 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n")); 3337 break; 3338 } 3339 3340 case DIOCADDALTQV0: 3341 case DIOCADDALTQV1: { 3342 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr; 3343 struct pf_altq *altq, *a; 3344 struct ifnet *ifp; 3345 3346 altq = malloc(sizeof(*altq), M_PFALTQ, M_WAITOK | M_ZERO); 3347 error = pf_import_kaltq(pa, altq, IOCPARM_LEN(cmd)); 3348 if (error) 3349 break; 3350 altq->local_flags = 0; 3351 3352 PF_RULES_WLOCK(); 3353 if (pa->ticket != V_ticket_altqs_inactive) { 3354 PF_RULES_WUNLOCK(); 3355 free(altq, M_PFALTQ); 3356 error = EBUSY; 3357 break; 3358 } 3359 3360 /* 3361 * if this is for a queue, find the discipline and 3362 * copy the necessary fields 3363 */ 3364 if (altq->qname[0] != 0) { 3365 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) { 3366 PF_RULES_WUNLOCK(); 3367 error = EBUSY; 3368 free(altq, M_PFALTQ); 3369 break; 3370 } 3371 altq->altq_disc = NULL; 3372 TAILQ_FOREACH(a, V_pf_altq_ifs_inactive, entries) { 3373 if (strncmp(a->ifname, altq->ifname, 3374 IFNAMSIZ) == 0) { 3375 altq->altq_disc = a->altq_disc; 3376 break; 3377 } 3378 } 3379 } 3380 3381 if ((ifp = ifunit(altq->ifname)) == NULL) 3382 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED; 3383 else 3384 error = altq_add(ifp, altq); 3385 3386 if (error) { 3387 PF_RULES_WUNLOCK(); 3388 free(altq, M_PFALTQ); 3389 break; 3390 } 3391 3392 if (altq->qname[0] != 0) 3393 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, altq, entries); 3394 else 3395 TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, altq, entries); 3396 /* version error check done on import above */ 3397 pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd)); 3398 PF_RULES_WUNLOCK(); 3399 break; 3400 } 3401 3402 case DIOCGETALTQSV0: 3403 case DIOCGETALTQSV1: { 3404 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr; 3405 struct pf_altq *altq; 3406 3407 PF_RULES_RLOCK(); 3408 pa->nr = 0; 3409 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) 3410 pa->nr++; 3411 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) 3412 pa->nr++; 3413 pa->ticket = V_ticket_altqs_active; 3414 PF_RULES_RUNLOCK(); 3415 break; 3416 } 3417 3418 case DIOCGETALTQV0: 3419 case DIOCGETALTQV1: { 3420 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr; 3421 struct pf_altq *altq; 3422 3423 PF_RULES_RLOCK(); 3424 if (pa->ticket != V_ticket_altqs_active) { 3425 PF_RULES_RUNLOCK(); 3426 error = EBUSY; 3427 break; 3428 } 3429 altq = pf_altq_get_nth_active(pa->nr); 3430 if (altq == NULL) { 3431 PF_RULES_RUNLOCK(); 3432 error = EBUSY; 3433 break; 3434 } 3435 pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd)); 3436 PF_RULES_RUNLOCK(); 3437 break; 3438 } 3439 3440 case DIOCCHANGEALTQV0: 3441 case DIOCCHANGEALTQV1: 3442 /* CHANGEALTQ not supported yet! */ 3443 error = ENODEV; 3444 break; 3445 3446 case DIOCGETQSTATSV0: 3447 case DIOCGETQSTATSV1: { 3448 struct pfioc_qstats_v1 *pq = (struct pfioc_qstats_v1 *)addr; 3449 struct pf_altq *altq; 3450 int nbytes; 3451 u_int32_t version; 3452 3453 PF_RULES_RLOCK(); 3454 if (pq->ticket != V_ticket_altqs_active) { 3455 PF_RULES_RUNLOCK(); 3456 error = EBUSY; 3457 break; 3458 } 3459 nbytes = pq->nbytes; 3460 altq = pf_altq_get_nth_active(pq->nr); 3461 if (altq == NULL) { 3462 PF_RULES_RUNLOCK(); 3463 error = EBUSY; 3464 break; 3465 } 3466 3467 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) != 0) { 3468 PF_RULES_RUNLOCK(); 3469 error = ENXIO; 3470 break; 3471 } 3472 PF_RULES_RUNLOCK(); 3473 if (cmd == DIOCGETQSTATSV0) 3474 version = 0; /* DIOCGETQSTATSV0 means stats struct v0 */ 3475 else 3476 version = pq->version; 3477 error = altq_getqstats(altq, pq->buf, &nbytes, version); 3478 if (error == 0) { 3479 pq->scheduler = altq->scheduler; 3480 pq->nbytes = nbytes; 3481 } 3482 break; 3483 } 3484 #endif /* ALTQ */ 3485 3486 case DIOCBEGINADDRS: { 3487 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3488 3489 PF_RULES_WLOCK(); 3490 pf_empty_kpool(&V_pf_pabuf); 3491 pp->ticket = ++V_ticket_pabuf; 3492 PF_RULES_WUNLOCK(); 3493 break; 3494 } 3495 3496 case DIOCADDADDR: { 3497 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3498 struct pf_kpooladdr *pa; 3499 struct pfi_kkif *kif = NULL; 3500 3501 #ifndef INET 3502 if (pp->af == AF_INET) { 3503 error = EAFNOSUPPORT; 3504 break; 3505 } 3506 #endif /* INET */ 3507 #ifndef INET6 3508 if (pp->af == AF_INET6) { 3509 error = EAFNOSUPPORT; 3510 break; 3511 } 3512 #endif /* INET6 */ 3513 if (pp->addr.addr.type != PF_ADDR_ADDRMASK && 3514 pp->addr.addr.type != PF_ADDR_DYNIFTL && 3515 pp->addr.addr.type != PF_ADDR_TABLE) { 3516 error = EINVAL; 3517 break; 3518 } 3519 if (pp->addr.addr.p.dyn != NULL) { 3520 error = EINVAL; 3521 break; 3522 } 3523 pa = malloc(sizeof(*pa), M_PFRULE, M_WAITOK); 3524 error = pf_pooladdr_to_kpooladdr(&pp->addr, pa); 3525 if (error != 0) 3526 break; 3527 if (pa->ifname[0]) 3528 kif = pf_kkif_create(M_WAITOK); 3529 PF_RULES_WLOCK(); 3530 if (pp->ticket != V_ticket_pabuf) { 3531 PF_RULES_WUNLOCK(); 3532 if (pa->ifname[0]) 3533 pf_kkif_free(kif); 3534 free(pa, M_PFRULE); 3535 error = EBUSY; 3536 break; 3537 } 3538 if (pa->ifname[0]) { 3539 pa->kif = pfi_kkif_attach(kif, pa->ifname); 3540 kif = NULL; 3541 pfi_kkif_ref(pa->kif); 3542 } else 3543 pa->kif = NULL; 3544 if (pa->addr.type == PF_ADDR_DYNIFTL && ((error = 3545 pfi_dynaddr_setup(&pa->addr, pp->af)) != 0)) { 3546 if (pa->ifname[0]) 3547 pfi_kkif_unref(pa->kif); 3548 PF_RULES_WUNLOCK(); 3549 free(pa, M_PFRULE); 3550 break; 3551 } 3552 TAILQ_INSERT_TAIL(&V_pf_pabuf, pa, entries); 3553 PF_RULES_WUNLOCK(); 3554 break; 3555 } 3556 3557 case DIOCGETADDRS: { 3558 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3559 struct pf_kpool *pool; 3560 struct pf_kpooladdr *pa; 3561 3562 pp->anchor[sizeof(pp->anchor) - 1] = 0; 3563 pp->nr = 0; 3564 3565 PF_RULES_RLOCK(); 3566 pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, 3567 pp->r_num, 0, 1, 0); 3568 if (pool == NULL) { 3569 PF_RULES_RUNLOCK(); 3570 error = EBUSY; 3571 break; 3572 } 3573 TAILQ_FOREACH(pa, &pool->list, entries) 3574 pp->nr++; 3575 PF_RULES_RUNLOCK(); 3576 break; 3577 } 3578 3579 case DIOCGETADDR: { 3580 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr; 3581 struct pf_kpool *pool; 3582 struct pf_kpooladdr *pa; 3583 u_int32_t nr = 0; 3584 3585 pp->anchor[sizeof(pp->anchor) - 1] = 0; 3586 3587 PF_RULES_RLOCK(); 3588 pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action, 3589 pp->r_num, 0, 1, 1); 3590 if (pool == NULL) { 3591 PF_RULES_RUNLOCK(); 3592 error = EBUSY; 3593 break; 3594 } 3595 pa = TAILQ_FIRST(&pool->list); 3596 while ((pa != NULL) && (nr < pp->nr)) { 3597 pa = TAILQ_NEXT(pa, entries); 3598 nr++; 3599 } 3600 if (pa == NULL) { 3601 PF_RULES_RUNLOCK(); 3602 error = EBUSY; 3603 break; 3604 } 3605 pf_kpooladdr_to_pooladdr(pa, &pp->addr); 3606 pf_addr_copyout(&pp->addr.addr); 3607 PF_RULES_RUNLOCK(); 3608 break; 3609 } 3610 3611 case DIOCCHANGEADDR: { 3612 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr; 3613 struct pf_kpool *pool; 3614 struct pf_kpooladdr *oldpa = NULL, *newpa = NULL; 3615 struct pf_kruleset *ruleset; 3616 struct pfi_kkif *kif = NULL; 3617 3618 pca->anchor[sizeof(pca->anchor) - 1] = 0; 3619 3620 if (pca->action < PF_CHANGE_ADD_HEAD || 3621 pca->action > PF_CHANGE_REMOVE) { 3622 error = EINVAL; 3623 break; 3624 } 3625 if (pca->addr.addr.type != PF_ADDR_ADDRMASK && 3626 pca->addr.addr.type != PF_ADDR_DYNIFTL && 3627 pca->addr.addr.type != PF_ADDR_TABLE) { 3628 error = EINVAL; 3629 break; 3630 } 3631 if (pca->addr.addr.p.dyn != NULL) { 3632 error = EINVAL; 3633 break; 3634 } 3635 3636 if (pca->action != PF_CHANGE_REMOVE) { 3637 #ifndef INET 3638 if (pca->af == AF_INET) { 3639 error = EAFNOSUPPORT; 3640 break; 3641 } 3642 #endif /* INET */ 3643 #ifndef INET6 3644 if (pca->af == AF_INET6) { 3645 error = EAFNOSUPPORT; 3646 break; 3647 } 3648 #endif /* INET6 */ 3649 newpa = malloc(sizeof(*newpa), M_PFRULE, M_WAITOK); 3650 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr)); 3651 if (newpa->ifname[0]) 3652 kif = pf_kkif_create(M_WAITOK); 3653 newpa->kif = NULL; 3654 } 3655 #define ERROUT(x) ERROUT_IOCTL(DIOCCHANGEADDR_error, x) 3656 PF_RULES_WLOCK(); 3657 ruleset = pf_find_kruleset(pca->anchor); 3658 if (ruleset == NULL) 3659 ERROUT(EBUSY); 3660 3661 pool = pf_get_kpool(pca->anchor, pca->ticket, pca->r_action, 3662 pca->r_num, pca->r_last, 1, 1); 3663 if (pool == NULL) 3664 ERROUT(EBUSY); 3665 3666 if (pca->action != PF_CHANGE_REMOVE) { 3667 if (newpa->ifname[0]) { 3668 newpa->kif = pfi_kkif_attach(kif, newpa->ifname); 3669 pfi_kkif_ref(newpa->kif); 3670 kif = NULL; 3671 } 3672 3673 switch (newpa->addr.type) { 3674 case PF_ADDR_DYNIFTL: 3675 error = pfi_dynaddr_setup(&newpa->addr, 3676 pca->af); 3677 break; 3678 case PF_ADDR_TABLE: 3679 newpa->addr.p.tbl = pfr_attach_table(ruleset, 3680 newpa->addr.v.tblname); 3681 if (newpa->addr.p.tbl == NULL) 3682 error = ENOMEM; 3683 break; 3684 } 3685 if (error) 3686 goto DIOCCHANGEADDR_error; 3687 } 3688 3689 switch (pca->action) { 3690 case PF_CHANGE_ADD_HEAD: 3691 oldpa = TAILQ_FIRST(&pool->list); 3692 break; 3693 case PF_CHANGE_ADD_TAIL: 3694 oldpa = TAILQ_LAST(&pool->list, pf_kpalist); 3695 break; 3696 default: 3697 oldpa = TAILQ_FIRST(&pool->list); 3698 for (int i = 0; oldpa && i < pca->nr; i++) 3699 oldpa = TAILQ_NEXT(oldpa, entries); 3700 3701 if (oldpa == NULL) 3702 ERROUT(EINVAL); 3703 } 3704 3705 if (pca->action == PF_CHANGE_REMOVE) { 3706 TAILQ_REMOVE(&pool->list, oldpa, entries); 3707 switch (oldpa->addr.type) { 3708 case PF_ADDR_DYNIFTL: 3709 pfi_dynaddr_remove(oldpa->addr.p.dyn); 3710 break; 3711 case PF_ADDR_TABLE: 3712 pfr_detach_table(oldpa->addr.p.tbl); 3713 break; 3714 } 3715 if (oldpa->kif) 3716 pfi_kkif_unref(oldpa->kif); 3717 free(oldpa, M_PFRULE); 3718 } else { 3719 if (oldpa == NULL) 3720 TAILQ_INSERT_TAIL(&pool->list, newpa, entries); 3721 else if (pca->action == PF_CHANGE_ADD_HEAD || 3722 pca->action == PF_CHANGE_ADD_BEFORE) 3723 TAILQ_INSERT_BEFORE(oldpa, newpa, entries); 3724 else 3725 TAILQ_INSERT_AFTER(&pool->list, oldpa, 3726 newpa, entries); 3727 } 3728 3729 pool->cur = TAILQ_FIRST(&pool->list); 3730 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, pca->af); 3731 PF_RULES_WUNLOCK(); 3732 break; 3733 3734 #undef ERROUT 3735 DIOCCHANGEADDR_error: 3736 if (newpa != NULL) { 3737 if (newpa->kif) 3738 pfi_kkif_unref(newpa->kif); 3739 free(newpa, M_PFRULE); 3740 } 3741 PF_RULES_WUNLOCK(); 3742 pf_kkif_free(kif); 3743 break; 3744 } 3745 3746 case DIOCGETRULESETS: { 3747 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 3748 struct pf_kruleset *ruleset; 3749 struct pf_kanchor *anchor; 3750 3751 pr->path[sizeof(pr->path) - 1] = 0; 3752 3753 PF_RULES_RLOCK(); 3754 if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { 3755 PF_RULES_RUNLOCK(); 3756 error = ENOENT; 3757 break; 3758 } 3759 pr->nr = 0; 3760 if (ruleset->anchor == NULL) { 3761 /* XXX kludge for pf_main_ruleset */ 3762 RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) 3763 if (anchor->parent == NULL) 3764 pr->nr++; 3765 } else { 3766 RB_FOREACH(anchor, pf_kanchor_node, 3767 &ruleset->anchor->children) 3768 pr->nr++; 3769 } 3770 PF_RULES_RUNLOCK(); 3771 break; 3772 } 3773 3774 case DIOCGETRULESET: { 3775 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr; 3776 struct pf_kruleset *ruleset; 3777 struct pf_kanchor *anchor; 3778 u_int32_t nr = 0; 3779 3780 pr->path[sizeof(pr->path) - 1] = 0; 3781 3782 PF_RULES_RLOCK(); 3783 if ((ruleset = pf_find_kruleset(pr->path)) == NULL) { 3784 PF_RULES_RUNLOCK(); 3785 error = ENOENT; 3786 break; 3787 } 3788 pr->name[0] = 0; 3789 if (ruleset->anchor == NULL) { 3790 /* XXX kludge for pf_main_ruleset */ 3791 RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors) 3792 if (anchor->parent == NULL && nr++ == pr->nr) { 3793 strlcpy(pr->name, anchor->name, 3794 sizeof(pr->name)); 3795 break; 3796 } 3797 } else { 3798 RB_FOREACH(anchor, pf_kanchor_node, 3799 &ruleset->anchor->children) 3800 if (nr++ == pr->nr) { 3801 strlcpy(pr->name, anchor->name, 3802 sizeof(pr->name)); 3803 break; 3804 } 3805 } 3806 if (!pr->name[0]) 3807 error = EBUSY; 3808 PF_RULES_RUNLOCK(); 3809 break; 3810 } 3811 3812 case DIOCRCLRTABLES: { 3813 struct pfioc_table *io = (struct pfioc_table *)addr; 3814 3815 if (io->pfrio_esize != 0) { 3816 error = ENODEV; 3817 break; 3818 } 3819 PF_RULES_WLOCK(); 3820 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel, 3821 io->pfrio_flags | PFR_FLAG_USERIOCTL); 3822 PF_RULES_WUNLOCK(); 3823 break; 3824 } 3825 3826 case DIOCRADDTABLES: { 3827 struct pfioc_table *io = (struct pfioc_table *)addr; 3828 struct pfr_table *pfrts; 3829 size_t totlen; 3830 3831 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3832 error = ENODEV; 3833 break; 3834 } 3835 3836 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 3837 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 3838 error = ENOMEM; 3839 break; 3840 } 3841 3842 totlen = io->pfrio_size * sizeof(struct pfr_table); 3843 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3844 M_TEMP, M_WAITOK); 3845 error = copyin(io->pfrio_buffer, pfrts, totlen); 3846 if (error) { 3847 free(pfrts, M_TEMP); 3848 break; 3849 } 3850 PF_RULES_WLOCK(); 3851 error = pfr_add_tables(pfrts, io->pfrio_size, 3852 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3853 PF_RULES_WUNLOCK(); 3854 free(pfrts, M_TEMP); 3855 break; 3856 } 3857 3858 case DIOCRDELTABLES: { 3859 struct pfioc_table *io = (struct pfioc_table *)addr; 3860 struct pfr_table *pfrts; 3861 size_t totlen; 3862 3863 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3864 error = ENODEV; 3865 break; 3866 } 3867 3868 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 3869 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 3870 error = ENOMEM; 3871 break; 3872 } 3873 3874 totlen = io->pfrio_size * sizeof(struct pfr_table); 3875 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3876 M_TEMP, M_WAITOK); 3877 error = copyin(io->pfrio_buffer, pfrts, totlen); 3878 if (error) { 3879 free(pfrts, M_TEMP); 3880 break; 3881 } 3882 PF_RULES_WLOCK(); 3883 error = pfr_del_tables(pfrts, io->pfrio_size, 3884 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3885 PF_RULES_WUNLOCK(); 3886 free(pfrts, M_TEMP); 3887 break; 3888 } 3889 3890 case DIOCRGETTABLES: { 3891 struct pfioc_table *io = (struct pfioc_table *)addr; 3892 struct pfr_table *pfrts; 3893 size_t totlen; 3894 int n; 3895 3896 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3897 error = ENODEV; 3898 break; 3899 } 3900 PF_RULES_RLOCK(); 3901 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 3902 if (n < 0) { 3903 PF_RULES_RUNLOCK(); 3904 error = EINVAL; 3905 break; 3906 } 3907 io->pfrio_size = min(io->pfrio_size, n); 3908 3909 totlen = io->pfrio_size * sizeof(struct pfr_table); 3910 3911 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3912 M_TEMP, M_NOWAIT | M_ZERO); 3913 if (pfrts == NULL) { 3914 error = ENOMEM; 3915 PF_RULES_RUNLOCK(); 3916 break; 3917 } 3918 error = pfr_get_tables(&io->pfrio_table, pfrts, 3919 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3920 PF_RULES_RUNLOCK(); 3921 if (error == 0) 3922 error = copyout(pfrts, io->pfrio_buffer, totlen); 3923 free(pfrts, M_TEMP); 3924 break; 3925 } 3926 3927 case DIOCRGETTSTATS: { 3928 struct pfioc_table *io = (struct pfioc_table *)addr; 3929 struct pfr_tstats *pfrtstats; 3930 size_t totlen; 3931 int n; 3932 3933 if (io->pfrio_esize != sizeof(struct pfr_tstats)) { 3934 error = ENODEV; 3935 break; 3936 } 3937 PF_TABLE_STATS_LOCK(); 3938 PF_RULES_RLOCK(); 3939 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 3940 if (n < 0) { 3941 PF_RULES_RUNLOCK(); 3942 PF_TABLE_STATS_UNLOCK(); 3943 error = EINVAL; 3944 break; 3945 } 3946 io->pfrio_size = min(io->pfrio_size, n); 3947 3948 totlen = io->pfrio_size * sizeof(struct pfr_tstats); 3949 pfrtstats = mallocarray(io->pfrio_size, 3950 sizeof(struct pfr_tstats), M_TEMP, M_NOWAIT | M_ZERO); 3951 if (pfrtstats == NULL) { 3952 error = ENOMEM; 3953 PF_RULES_RUNLOCK(); 3954 PF_TABLE_STATS_UNLOCK(); 3955 break; 3956 } 3957 error = pfr_get_tstats(&io->pfrio_table, pfrtstats, 3958 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3959 PF_RULES_RUNLOCK(); 3960 PF_TABLE_STATS_UNLOCK(); 3961 if (error == 0) 3962 error = copyout(pfrtstats, io->pfrio_buffer, totlen); 3963 free(pfrtstats, M_TEMP); 3964 break; 3965 } 3966 3967 case DIOCRCLRTSTATS: { 3968 struct pfioc_table *io = (struct pfioc_table *)addr; 3969 struct pfr_table *pfrts; 3970 size_t totlen; 3971 3972 if (io->pfrio_esize != sizeof(struct pfr_table)) { 3973 error = ENODEV; 3974 break; 3975 } 3976 3977 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount || 3978 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) { 3979 /* We used to count tables and use the minimum required 3980 * size, so we didn't fail on overly large requests. 3981 * Keep doing so. */ 3982 io->pfrio_size = pf_ioctl_maxcount; 3983 break; 3984 } 3985 3986 totlen = io->pfrio_size * sizeof(struct pfr_table); 3987 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 3988 M_TEMP, M_WAITOK); 3989 error = copyin(io->pfrio_buffer, pfrts, totlen); 3990 if (error) { 3991 free(pfrts, M_TEMP); 3992 break; 3993 } 3994 3995 PF_TABLE_STATS_LOCK(); 3996 PF_RULES_RLOCK(); 3997 error = pfr_clr_tstats(pfrts, io->pfrio_size, 3998 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL); 3999 PF_RULES_RUNLOCK(); 4000 PF_TABLE_STATS_UNLOCK(); 4001 free(pfrts, M_TEMP); 4002 break; 4003 } 4004 4005 case DIOCRSETTFLAGS: { 4006 struct pfioc_table *io = (struct pfioc_table *)addr; 4007 struct pfr_table *pfrts; 4008 size_t totlen; 4009 int n; 4010 4011 if (io->pfrio_esize != sizeof(struct pfr_table)) { 4012 error = ENODEV; 4013 break; 4014 } 4015 4016 PF_RULES_RLOCK(); 4017 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags); 4018 if (n < 0) { 4019 PF_RULES_RUNLOCK(); 4020 error = EINVAL; 4021 break; 4022 } 4023 4024 io->pfrio_size = min(io->pfrio_size, n); 4025 PF_RULES_RUNLOCK(); 4026 4027 totlen = io->pfrio_size * sizeof(struct pfr_table); 4028 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table), 4029 M_TEMP, M_WAITOK); 4030 error = copyin(io->pfrio_buffer, pfrts, totlen); 4031 if (error) { 4032 free(pfrts, M_TEMP); 4033 break; 4034 } 4035 PF_RULES_WLOCK(); 4036 error = pfr_set_tflags(pfrts, io->pfrio_size, 4037 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange, 4038 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4039 PF_RULES_WUNLOCK(); 4040 free(pfrts, M_TEMP); 4041 break; 4042 } 4043 4044 case DIOCRCLRADDRS: { 4045 struct pfioc_table *io = (struct pfioc_table *)addr; 4046 4047 if (io->pfrio_esize != 0) { 4048 error = ENODEV; 4049 break; 4050 } 4051 PF_RULES_WLOCK(); 4052 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel, 4053 io->pfrio_flags | PFR_FLAG_USERIOCTL); 4054 PF_RULES_WUNLOCK(); 4055 break; 4056 } 4057 4058 case DIOCRADDADDRS: { 4059 struct pfioc_table *io = (struct pfioc_table *)addr; 4060 struct pfr_addr *pfras; 4061 size_t totlen; 4062 4063 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4064 error = ENODEV; 4065 break; 4066 } 4067 if (io->pfrio_size < 0 || 4068 io->pfrio_size > pf_ioctl_maxcount || 4069 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4070 error = EINVAL; 4071 break; 4072 } 4073 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4074 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4075 M_TEMP, M_WAITOK); 4076 error = copyin(io->pfrio_buffer, pfras, totlen); 4077 if (error) { 4078 free(pfras, M_TEMP); 4079 break; 4080 } 4081 PF_RULES_WLOCK(); 4082 error = pfr_add_addrs(&io->pfrio_table, pfras, 4083 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags | 4084 PFR_FLAG_USERIOCTL); 4085 PF_RULES_WUNLOCK(); 4086 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4087 error = copyout(pfras, io->pfrio_buffer, totlen); 4088 free(pfras, M_TEMP); 4089 break; 4090 } 4091 4092 case DIOCRDELADDRS: { 4093 struct pfioc_table *io = (struct pfioc_table *)addr; 4094 struct pfr_addr *pfras; 4095 size_t totlen; 4096 4097 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4098 error = ENODEV; 4099 break; 4100 } 4101 if (io->pfrio_size < 0 || 4102 io->pfrio_size > pf_ioctl_maxcount || 4103 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4104 error = EINVAL; 4105 break; 4106 } 4107 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4108 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4109 M_TEMP, M_WAITOK); 4110 error = copyin(io->pfrio_buffer, pfras, totlen); 4111 if (error) { 4112 free(pfras, M_TEMP); 4113 break; 4114 } 4115 PF_RULES_WLOCK(); 4116 error = pfr_del_addrs(&io->pfrio_table, pfras, 4117 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags | 4118 PFR_FLAG_USERIOCTL); 4119 PF_RULES_WUNLOCK(); 4120 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4121 error = copyout(pfras, io->pfrio_buffer, totlen); 4122 free(pfras, M_TEMP); 4123 break; 4124 } 4125 4126 case DIOCRSETADDRS: { 4127 struct pfioc_table *io = (struct pfioc_table *)addr; 4128 struct pfr_addr *pfras; 4129 size_t totlen, count; 4130 4131 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4132 error = ENODEV; 4133 break; 4134 } 4135 if (io->pfrio_size < 0 || io->pfrio_size2 < 0) { 4136 error = EINVAL; 4137 break; 4138 } 4139 count = max(io->pfrio_size, io->pfrio_size2); 4140 if (count > pf_ioctl_maxcount || 4141 WOULD_OVERFLOW(count, sizeof(struct pfr_addr))) { 4142 error = EINVAL; 4143 break; 4144 } 4145 totlen = count * sizeof(struct pfr_addr); 4146 pfras = mallocarray(count, sizeof(struct pfr_addr), M_TEMP, 4147 M_WAITOK); 4148 error = copyin(io->pfrio_buffer, pfras, totlen); 4149 if (error) { 4150 free(pfras, M_TEMP); 4151 break; 4152 } 4153 PF_RULES_WLOCK(); 4154 error = pfr_set_addrs(&io->pfrio_table, pfras, 4155 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd, 4156 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags | 4157 PFR_FLAG_USERIOCTL, 0); 4158 PF_RULES_WUNLOCK(); 4159 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4160 error = copyout(pfras, io->pfrio_buffer, totlen); 4161 free(pfras, M_TEMP); 4162 break; 4163 } 4164 4165 case DIOCRGETADDRS: { 4166 struct pfioc_table *io = (struct pfioc_table *)addr; 4167 struct pfr_addr *pfras; 4168 size_t totlen; 4169 4170 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4171 error = ENODEV; 4172 break; 4173 } 4174 if (io->pfrio_size < 0 || 4175 io->pfrio_size > pf_ioctl_maxcount || 4176 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4177 error = EINVAL; 4178 break; 4179 } 4180 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4181 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4182 M_TEMP, M_WAITOK | M_ZERO); 4183 PF_RULES_RLOCK(); 4184 error = pfr_get_addrs(&io->pfrio_table, pfras, 4185 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4186 PF_RULES_RUNLOCK(); 4187 if (error == 0) 4188 error = copyout(pfras, io->pfrio_buffer, totlen); 4189 free(pfras, M_TEMP); 4190 break; 4191 } 4192 4193 case DIOCRGETASTATS: { 4194 struct pfioc_table *io = (struct pfioc_table *)addr; 4195 struct pfr_astats *pfrastats; 4196 size_t totlen; 4197 4198 if (io->pfrio_esize != sizeof(struct pfr_astats)) { 4199 error = ENODEV; 4200 break; 4201 } 4202 if (io->pfrio_size < 0 || 4203 io->pfrio_size > pf_ioctl_maxcount || 4204 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_astats))) { 4205 error = EINVAL; 4206 break; 4207 } 4208 totlen = io->pfrio_size * sizeof(struct pfr_astats); 4209 pfrastats = mallocarray(io->pfrio_size, 4210 sizeof(struct pfr_astats), M_TEMP, M_WAITOK | M_ZERO); 4211 PF_RULES_RLOCK(); 4212 error = pfr_get_astats(&io->pfrio_table, pfrastats, 4213 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4214 PF_RULES_RUNLOCK(); 4215 if (error == 0) 4216 error = copyout(pfrastats, io->pfrio_buffer, totlen); 4217 free(pfrastats, M_TEMP); 4218 break; 4219 } 4220 4221 case DIOCRCLRASTATS: { 4222 struct pfioc_table *io = (struct pfioc_table *)addr; 4223 struct pfr_addr *pfras; 4224 size_t totlen; 4225 4226 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4227 error = ENODEV; 4228 break; 4229 } 4230 if (io->pfrio_size < 0 || 4231 io->pfrio_size > pf_ioctl_maxcount || 4232 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4233 error = EINVAL; 4234 break; 4235 } 4236 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4237 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4238 M_TEMP, M_WAITOK); 4239 error = copyin(io->pfrio_buffer, pfras, totlen); 4240 if (error) { 4241 free(pfras, M_TEMP); 4242 break; 4243 } 4244 PF_RULES_WLOCK(); 4245 error = pfr_clr_astats(&io->pfrio_table, pfras, 4246 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags | 4247 PFR_FLAG_USERIOCTL); 4248 PF_RULES_WUNLOCK(); 4249 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK) 4250 error = copyout(pfras, io->pfrio_buffer, totlen); 4251 free(pfras, M_TEMP); 4252 break; 4253 } 4254 4255 case DIOCRTSTADDRS: { 4256 struct pfioc_table *io = (struct pfioc_table *)addr; 4257 struct pfr_addr *pfras; 4258 size_t totlen; 4259 4260 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4261 error = ENODEV; 4262 break; 4263 } 4264 if (io->pfrio_size < 0 || 4265 io->pfrio_size > pf_ioctl_maxcount || 4266 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4267 error = EINVAL; 4268 break; 4269 } 4270 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4271 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4272 M_TEMP, M_WAITOK); 4273 error = copyin(io->pfrio_buffer, pfras, totlen); 4274 if (error) { 4275 free(pfras, M_TEMP); 4276 break; 4277 } 4278 PF_RULES_RLOCK(); 4279 error = pfr_tst_addrs(&io->pfrio_table, pfras, 4280 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags | 4281 PFR_FLAG_USERIOCTL); 4282 PF_RULES_RUNLOCK(); 4283 if (error == 0) 4284 error = copyout(pfras, io->pfrio_buffer, totlen); 4285 free(pfras, M_TEMP); 4286 break; 4287 } 4288 4289 case DIOCRINADEFINE: { 4290 struct pfioc_table *io = (struct pfioc_table *)addr; 4291 struct pfr_addr *pfras; 4292 size_t totlen; 4293 4294 if (io->pfrio_esize != sizeof(struct pfr_addr)) { 4295 error = ENODEV; 4296 break; 4297 } 4298 if (io->pfrio_size < 0 || 4299 io->pfrio_size > pf_ioctl_maxcount || 4300 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) { 4301 error = EINVAL; 4302 break; 4303 } 4304 totlen = io->pfrio_size * sizeof(struct pfr_addr); 4305 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr), 4306 M_TEMP, M_WAITOK); 4307 error = copyin(io->pfrio_buffer, pfras, totlen); 4308 if (error) { 4309 free(pfras, M_TEMP); 4310 break; 4311 } 4312 PF_RULES_WLOCK(); 4313 error = pfr_ina_define(&io->pfrio_table, pfras, 4314 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr, 4315 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL); 4316 PF_RULES_WUNLOCK(); 4317 free(pfras, M_TEMP); 4318 break; 4319 } 4320 4321 case DIOCOSFPADD: { 4322 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 4323 PF_RULES_WLOCK(); 4324 error = pf_osfp_add(io); 4325 PF_RULES_WUNLOCK(); 4326 break; 4327 } 4328 4329 case DIOCOSFPGET: { 4330 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr; 4331 PF_RULES_RLOCK(); 4332 error = pf_osfp_get(io); 4333 PF_RULES_RUNLOCK(); 4334 break; 4335 } 4336 4337 case DIOCXBEGIN: { 4338 struct pfioc_trans *io = (struct pfioc_trans *)addr; 4339 struct pfioc_trans_e *ioes, *ioe; 4340 size_t totlen; 4341 int i; 4342 4343 if (io->esize != sizeof(*ioe)) { 4344 error = ENODEV; 4345 break; 4346 } 4347 if (io->size < 0 || 4348 io->size > pf_ioctl_maxcount || 4349 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 4350 error = EINVAL; 4351 break; 4352 } 4353 totlen = sizeof(struct pfioc_trans_e) * io->size; 4354 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 4355 M_TEMP, M_WAITOK); 4356 error = copyin(io->array, ioes, totlen); 4357 if (error) { 4358 free(ioes, M_TEMP); 4359 break; 4360 } 4361 PF_RULES_WLOCK(); 4362 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4363 ioe->anchor[sizeof(ioe->anchor) - 1] = '\0'; 4364 switch (ioe->rs_num) { 4365 #ifdef ALTQ 4366 case PF_RULESET_ALTQ: 4367 if (ioe->anchor[0]) { 4368 PF_RULES_WUNLOCK(); 4369 free(ioes, M_TEMP); 4370 error = EINVAL; 4371 goto fail; 4372 } 4373 if ((error = pf_begin_altq(&ioe->ticket))) { 4374 PF_RULES_WUNLOCK(); 4375 free(ioes, M_TEMP); 4376 goto fail; 4377 } 4378 break; 4379 #endif /* ALTQ */ 4380 case PF_RULESET_TABLE: 4381 { 4382 struct pfr_table table; 4383 4384 bzero(&table, sizeof(table)); 4385 strlcpy(table.pfrt_anchor, ioe->anchor, 4386 sizeof(table.pfrt_anchor)); 4387 if ((error = pfr_ina_begin(&table, 4388 &ioe->ticket, NULL, 0))) { 4389 PF_RULES_WUNLOCK(); 4390 free(ioes, M_TEMP); 4391 goto fail; 4392 } 4393 break; 4394 } 4395 default: 4396 if ((error = pf_begin_rules(&ioe->ticket, 4397 ioe->rs_num, ioe->anchor))) { 4398 PF_RULES_WUNLOCK(); 4399 free(ioes, M_TEMP); 4400 goto fail; 4401 } 4402 break; 4403 } 4404 } 4405 PF_RULES_WUNLOCK(); 4406 error = copyout(ioes, io->array, totlen); 4407 free(ioes, M_TEMP); 4408 break; 4409 } 4410 4411 case DIOCXROLLBACK: { 4412 struct pfioc_trans *io = (struct pfioc_trans *)addr; 4413 struct pfioc_trans_e *ioe, *ioes; 4414 size_t totlen; 4415 int i; 4416 4417 if (io->esize != sizeof(*ioe)) { 4418 error = ENODEV; 4419 break; 4420 } 4421 if (io->size < 0 || 4422 io->size > pf_ioctl_maxcount || 4423 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 4424 error = EINVAL; 4425 break; 4426 } 4427 totlen = sizeof(struct pfioc_trans_e) * io->size; 4428 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 4429 M_TEMP, M_WAITOK); 4430 error = copyin(io->array, ioes, totlen); 4431 if (error) { 4432 free(ioes, M_TEMP); 4433 break; 4434 } 4435 PF_RULES_WLOCK(); 4436 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4437 ioe->anchor[sizeof(ioe->anchor) - 1] = '\0'; 4438 switch (ioe->rs_num) { 4439 #ifdef ALTQ 4440 case PF_RULESET_ALTQ: 4441 if (ioe->anchor[0]) { 4442 PF_RULES_WUNLOCK(); 4443 free(ioes, M_TEMP); 4444 error = EINVAL; 4445 goto fail; 4446 } 4447 if ((error = pf_rollback_altq(ioe->ticket))) { 4448 PF_RULES_WUNLOCK(); 4449 free(ioes, M_TEMP); 4450 goto fail; /* really bad */ 4451 } 4452 break; 4453 #endif /* ALTQ */ 4454 case PF_RULESET_TABLE: 4455 { 4456 struct pfr_table table; 4457 4458 bzero(&table, sizeof(table)); 4459 strlcpy(table.pfrt_anchor, ioe->anchor, 4460 sizeof(table.pfrt_anchor)); 4461 if ((error = pfr_ina_rollback(&table, 4462 ioe->ticket, NULL, 0))) { 4463 PF_RULES_WUNLOCK(); 4464 free(ioes, M_TEMP); 4465 goto fail; /* really bad */ 4466 } 4467 break; 4468 } 4469 default: 4470 if ((error = pf_rollback_rules(ioe->ticket, 4471 ioe->rs_num, ioe->anchor))) { 4472 PF_RULES_WUNLOCK(); 4473 free(ioes, M_TEMP); 4474 goto fail; /* really bad */ 4475 } 4476 break; 4477 } 4478 } 4479 PF_RULES_WUNLOCK(); 4480 free(ioes, M_TEMP); 4481 break; 4482 } 4483 4484 case DIOCXCOMMIT: { 4485 struct pfioc_trans *io = (struct pfioc_trans *)addr; 4486 struct pfioc_trans_e *ioe, *ioes; 4487 struct pf_kruleset *rs; 4488 size_t totlen; 4489 int i; 4490 4491 if (io->esize != sizeof(*ioe)) { 4492 error = ENODEV; 4493 break; 4494 } 4495 4496 if (io->size < 0 || 4497 io->size > pf_ioctl_maxcount || 4498 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) { 4499 error = EINVAL; 4500 break; 4501 } 4502 4503 totlen = sizeof(struct pfioc_trans_e) * io->size; 4504 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e), 4505 M_TEMP, M_WAITOK); 4506 error = copyin(io->array, ioes, totlen); 4507 if (error) { 4508 free(ioes, M_TEMP); 4509 break; 4510 } 4511 PF_RULES_WLOCK(); 4512 /* First makes sure everything will succeed. */ 4513 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4514 ioe->anchor[sizeof(ioe->anchor) - 1] = 0; 4515 switch (ioe->rs_num) { 4516 #ifdef ALTQ 4517 case PF_RULESET_ALTQ: 4518 if (ioe->anchor[0]) { 4519 PF_RULES_WUNLOCK(); 4520 free(ioes, M_TEMP); 4521 error = EINVAL; 4522 goto fail; 4523 } 4524 if (!V_altqs_inactive_open || ioe->ticket != 4525 V_ticket_altqs_inactive) { 4526 PF_RULES_WUNLOCK(); 4527 free(ioes, M_TEMP); 4528 error = EBUSY; 4529 goto fail; 4530 } 4531 break; 4532 #endif /* ALTQ */ 4533 case PF_RULESET_TABLE: 4534 rs = pf_find_kruleset(ioe->anchor); 4535 if (rs == NULL || !rs->topen || ioe->ticket != 4536 rs->tticket) { 4537 PF_RULES_WUNLOCK(); 4538 free(ioes, M_TEMP); 4539 error = EBUSY; 4540 goto fail; 4541 } 4542 break; 4543 default: 4544 if (ioe->rs_num < 0 || ioe->rs_num >= 4545 PF_RULESET_MAX) { 4546 PF_RULES_WUNLOCK(); 4547 free(ioes, M_TEMP); 4548 error = EINVAL; 4549 goto fail; 4550 } 4551 rs = pf_find_kruleset(ioe->anchor); 4552 if (rs == NULL || 4553 !rs->rules[ioe->rs_num].inactive.open || 4554 rs->rules[ioe->rs_num].inactive.ticket != 4555 ioe->ticket) { 4556 PF_RULES_WUNLOCK(); 4557 free(ioes, M_TEMP); 4558 error = EBUSY; 4559 goto fail; 4560 } 4561 break; 4562 } 4563 } 4564 /* Now do the commit - no errors should happen here. */ 4565 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { 4566 switch (ioe->rs_num) { 4567 #ifdef ALTQ 4568 case PF_RULESET_ALTQ: 4569 if ((error = pf_commit_altq(ioe->ticket))) { 4570 PF_RULES_WUNLOCK(); 4571 free(ioes, M_TEMP); 4572 goto fail; /* really bad */ 4573 } 4574 break; 4575 #endif /* ALTQ */ 4576 case PF_RULESET_TABLE: 4577 { 4578 struct pfr_table table; 4579 4580 bzero(&table, sizeof(table)); 4581 (void)strlcpy(table.pfrt_anchor, ioe->anchor, 4582 sizeof(table.pfrt_anchor)); 4583 if ((error = pfr_ina_commit(&table, 4584 ioe->ticket, NULL, NULL, 0))) { 4585 PF_RULES_WUNLOCK(); 4586 free(ioes, M_TEMP); 4587 goto fail; /* really bad */ 4588 } 4589 break; 4590 } 4591 default: 4592 if ((error = pf_commit_rules(ioe->ticket, 4593 ioe->rs_num, ioe->anchor))) { 4594 PF_RULES_WUNLOCK(); 4595 free(ioes, M_TEMP); 4596 goto fail; /* really bad */ 4597 } 4598 break; 4599 } 4600 } 4601 PF_RULES_WUNLOCK(); 4602 free(ioes, M_TEMP); 4603 break; 4604 } 4605 4606 case DIOCGETSRCNODES: { 4607 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr; 4608 struct pf_srchash *sh; 4609 struct pf_ksrc_node *n; 4610 struct pf_src_node *p, *pstore; 4611 uint32_t i, nr = 0; 4612 4613 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 4614 i++, sh++) { 4615 PF_HASHROW_LOCK(sh); 4616 LIST_FOREACH(n, &sh->nodes, entry) 4617 nr++; 4618 PF_HASHROW_UNLOCK(sh); 4619 } 4620 4621 psn->psn_len = min(psn->psn_len, 4622 sizeof(struct pf_src_node) * nr); 4623 4624 if (psn->psn_len == 0) { 4625 psn->psn_len = sizeof(struct pf_src_node) * nr; 4626 break; 4627 } 4628 4629 nr = 0; 4630 4631 p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK | M_ZERO); 4632 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 4633 i++, sh++) { 4634 PF_HASHROW_LOCK(sh); 4635 LIST_FOREACH(n, &sh->nodes, entry) { 4636 4637 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len) 4638 break; 4639 4640 pf_src_node_copy(n, p); 4641 4642 p++; 4643 nr++; 4644 } 4645 PF_HASHROW_UNLOCK(sh); 4646 } 4647 error = copyout(pstore, psn->psn_src_nodes, 4648 sizeof(struct pf_src_node) * nr); 4649 if (error) { 4650 free(pstore, M_TEMP); 4651 break; 4652 } 4653 psn->psn_len = sizeof(struct pf_src_node) * nr; 4654 free(pstore, M_TEMP); 4655 break; 4656 } 4657 4658 case DIOCCLRSRCNODES: { 4659 pf_clear_srcnodes(NULL); 4660 pf_purge_expired_src_nodes(); 4661 break; 4662 } 4663 4664 case DIOCKILLSRCNODES: 4665 pf_kill_srcnodes((struct pfioc_src_node_kill *)addr); 4666 break; 4667 4668 case DIOCKEEPCOUNTERS: 4669 error = pf_keepcounters((struct pfioc_nv *)addr); 4670 break; 4671 4672 case DIOCGETSYNCOOKIES: 4673 error = pf_get_syncookies((struct pfioc_nv *)addr); 4674 break; 4675 4676 case DIOCSETSYNCOOKIES: 4677 error = pf_set_syncookies((struct pfioc_nv *)addr); 4678 break; 4679 4680 case DIOCSETHOSTID: { 4681 u_int32_t *hostid = (u_int32_t *)addr; 4682 4683 PF_RULES_WLOCK(); 4684 if (*hostid == 0) 4685 V_pf_status.hostid = arc4random(); 4686 else 4687 V_pf_status.hostid = *hostid; 4688 PF_RULES_WUNLOCK(); 4689 break; 4690 } 4691 4692 case DIOCOSFPFLUSH: 4693 PF_RULES_WLOCK(); 4694 pf_osfp_flush(); 4695 PF_RULES_WUNLOCK(); 4696 break; 4697 4698 case DIOCIGETIFACES: { 4699 struct pfioc_iface *io = (struct pfioc_iface *)addr; 4700 struct pfi_kif *ifstore; 4701 size_t bufsiz; 4702 4703 if (io->pfiio_esize != sizeof(struct pfi_kif)) { 4704 error = ENODEV; 4705 break; 4706 } 4707 4708 if (io->pfiio_size < 0 || 4709 io->pfiio_size > pf_ioctl_maxcount || 4710 WOULD_OVERFLOW(io->pfiio_size, sizeof(struct pfi_kif))) { 4711 error = EINVAL; 4712 break; 4713 } 4714 4715 bufsiz = io->pfiio_size * sizeof(struct pfi_kif); 4716 ifstore = mallocarray(io->pfiio_size, sizeof(struct pfi_kif), 4717 M_TEMP, M_WAITOK | M_ZERO); 4718 4719 PF_RULES_RLOCK(); 4720 pfi_get_ifaces(io->pfiio_name, ifstore, &io->pfiio_size); 4721 PF_RULES_RUNLOCK(); 4722 error = copyout(ifstore, io->pfiio_buffer, bufsiz); 4723 free(ifstore, M_TEMP); 4724 break; 4725 } 4726 4727 case DIOCSETIFFLAG: { 4728 struct pfioc_iface *io = (struct pfioc_iface *)addr; 4729 4730 PF_RULES_WLOCK(); 4731 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags); 4732 PF_RULES_WUNLOCK(); 4733 break; 4734 } 4735 4736 case DIOCCLRIFFLAG: { 4737 struct pfioc_iface *io = (struct pfioc_iface *)addr; 4738 4739 PF_RULES_WLOCK(); 4740 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags); 4741 PF_RULES_WUNLOCK(); 4742 break; 4743 } 4744 4745 default: 4746 error = ENODEV; 4747 break; 4748 } 4749 fail: 4750 if (sx_xlocked(&pf_ioctl_lock)) 4751 sx_xunlock(&pf_ioctl_lock); 4752 CURVNET_RESTORE(); 4753 4754 #undef ERROUT_IOCTL 4755 4756 return (error); 4757 } 4758 4759 void 4760 pfsync_state_export(struct pfsync_state *sp, struct pf_kstate *st) 4761 { 4762 bzero(sp, sizeof(struct pfsync_state)); 4763 4764 /* copy from state key */ 4765 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; 4766 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1]; 4767 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0]; 4768 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1]; 4769 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0]; 4770 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1]; 4771 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0]; 4772 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1]; 4773 sp->proto = st->key[PF_SK_WIRE]->proto; 4774 sp->af = st->key[PF_SK_WIRE]->af; 4775 4776 /* copy from state */ 4777 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 4778 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr)); 4779 sp->creation = htonl(time_uptime - st->creation); 4780 sp->expire = pf_state_expires(st); 4781 if (sp->expire <= time_uptime) 4782 sp->expire = htonl(0); 4783 else 4784 sp->expire = htonl(sp->expire - time_uptime); 4785 4786 sp->direction = st->direction; 4787 sp->log = st->log; 4788 sp->timeout = st->timeout; 4789 sp->state_flags = st->state_flags; 4790 if (st->src_node) 4791 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 4792 if (st->nat_src_node) 4793 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 4794 4795 sp->id = st->id; 4796 sp->creatorid = st->creatorid; 4797 pf_state_peer_hton(&st->src, &sp->src); 4798 pf_state_peer_hton(&st->dst, &sp->dst); 4799 4800 if (st->rule.ptr == NULL) 4801 sp->rule = htonl(-1); 4802 else 4803 sp->rule = htonl(st->rule.ptr->nr); 4804 if (st->anchor.ptr == NULL) 4805 sp->anchor = htonl(-1); 4806 else 4807 sp->anchor = htonl(st->anchor.ptr->nr); 4808 if (st->nat_rule.ptr == NULL) 4809 sp->nat_rule = htonl(-1); 4810 else 4811 sp->nat_rule = htonl(st->nat_rule.ptr->nr); 4812 4813 pf_state_counter_hton(st->packets[0], sp->packets[0]); 4814 pf_state_counter_hton(st->packets[1], sp->packets[1]); 4815 pf_state_counter_hton(st->bytes[0], sp->bytes[0]); 4816 pf_state_counter_hton(st->bytes[1], sp->bytes[1]); 4817 } 4818 4819 void 4820 pf_state_export(struct pf_state_export *sp, struct pf_kstate *st) 4821 { 4822 bzero(sp, sizeof(*sp)); 4823 4824 sp->version = PF_STATE_VERSION; 4825 4826 /* copy from state key */ 4827 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0]; 4828 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1]; 4829 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0]; 4830 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1]; 4831 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0]; 4832 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1]; 4833 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0]; 4834 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1]; 4835 sp->proto = st->key[PF_SK_WIRE]->proto; 4836 sp->af = st->key[PF_SK_WIRE]->af; 4837 4838 /* copy from state */ 4839 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 4840 strlcpy(sp->orig_ifname, st->orig_kif->pfik_name, 4841 sizeof(sp->orig_ifname)); 4842 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr)); 4843 sp->creation = htonl(time_uptime - st->creation); 4844 sp->expire = pf_state_expires(st); 4845 if (sp->expire <= time_uptime) 4846 sp->expire = htonl(0); 4847 else 4848 sp->expire = htonl(sp->expire - time_uptime); 4849 4850 sp->direction = st->direction; 4851 sp->log = st->log; 4852 sp->timeout = st->timeout; 4853 sp->state_flags = st->state_flags; 4854 if (st->src_node) 4855 sp->sync_flags |= PFSYNC_FLAG_SRCNODE; 4856 if (st->nat_src_node) 4857 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE; 4858 4859 sp->id = st->id; 4860 sp->creatorid = st->creatorid; 4861 pf_state_peer_hton(&st->src, &sp->src); 4862 pf_state_peer_hton(&st->dst, &sp->dst); 4863 4864 if (st->rule.ptr == NULL) 4865 sp->rule = htonl(-1); 4866 else 4867 sp->rule = htonl(st->rule.ptr->nr); 4868 if (st->anchor.ptr == NULL) 4869 sp->anchor = htonl(-1); 4870 else 4871 sp->anchor = htonl(st->anchor.ptr->nr); 4872 if (st->nat_rule.ptr == NULL) 4873 sp->nat_rule = htonl(-1); 4874 else 4875 sp->nat_rule = htonl(st->nat_rule.ptr->nr); 4876 4877 sp->packets[0] = st->packets[0]; 4878 sp->packets[1] = st->packets[1]; 4879 sp->bytes[0] = st->bytes[0]; 4880 sp->bytes[1] = st->bytes[1]; 4881 } 4882 4883 static void 4884 pf_tbladdr_copyout(struct pf_addr_wrap *aw) 4885 { 4886 struct pfr_ktable *kt; 4887 4888 KASSERT(aw->type == PF_ADDR_TABLE, ("%s: type %u", __func__, aw->type)); 4889 4890 kt = aw->p.tbl; 4891 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 4892 kt = kt->pfrkt_root; 4893 aw->p.tbl = NULL; 4894 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ? 4895 kt->pfrkt_cnt : -1; 4896 } 4897 4898 static int 4899 pf_add_status_counters(nvlist_t *nvl, const char *name, counter_u64_t *counters, 4900 size_t number, char **names) 4901 { 4902 nvlist_t *nvc; 4903 4904 nvc = nvlist_create(0); 4905 if (nvc == NULL) 4906 return (ENOMEM); 4907 4908 for (int i = 0; i < number; i++) { 4909 nvlist_append_number_array(nvc, "counters", 4910 counter_u64_fetch(counters[i])); 4911 nvlist_append_string_array(nvc, "names", 4912 names[i]); 4913 nvlist_append_number_array(nvc, "ids", 4914 i); 4915 } 4916 nvlist_add_nvlist(nvl, name, nvc); 4917 nvlist_destroy(nvc); 4918 4919 return (0); 4920 } 4921 4922 static int 4923 pf_getstatus(struct pfioc_nv *nv) 4924 { 4925 nvlist_t *nvl = NULL, *nvc = NULL; 4926 void *nvlpacked = NULL; 4927 int error; 4928 struct pf_status s; 4929 char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES; 4930 char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES; 4931 char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES; 4932 PF_RULES_RLOCK_TRACKER; 4933 4934 #define ERROUT(x) ERROUT_FUNCTION(errout, x) 4935 4936 PF_RULES_RLOCK(); 4937 4938 nvl = nvlist_create(0); 4939 if (nvl == NULL) 4940 ERROUT(ENOMEM); 4941 4942 nvlist_add_bool(nvl, "running", V_pf_status.running); 4943 nvlist_add_number(nvl, "since", V_pf_status.since); 4944 nvlist_add_number(nvl, "debug", V_pf_status.debug); 4945 nvlist_add_number(nvl, "hostid", V_pf_status.hostid); 4946 nvlist_add_number(nvl, "states", V_pf_status.states); 4947 nvlist_add_number(nvl, "src_nodes", V_pf_status.src_nodes); 4948 4949 /* counters */ 4950 error = pf_add_status_counters(nvl, "counters", V_pf_status.counters, 4951 PFRES_MAX, pf_reasons); 4952 if (error != 0) 4953 ERROUT(error); 4954 4955 /* lcounters */ 4956 error = pf_add_status_counters(nvl, "lcounters", V_pf_status.lcounters, 4957 KLCNT_MAX, pf_lcounter); 4958 if (error != 0) 4959 ERROUT(error); 4960 4961 /* fcounters */ 4962 nvc = nvlist_create(0); 4963 if (nvc == NULL) 4964 ERROUT(ENOMEM); 4965 4966 for (int i = 0; i < FCNT_MAX; i++) { 4967 nvlist_append_number_array(nvc, "counters", 4968 pf_counter_u64_fetch(&V_pf_status.fcounters[i])); 4969 nvlist_append_string_array(nvc, "names", 4970 pf_fcounter[i]); 4971 nvlist_append_number_array(nvc, "ids", 4972 i); 4973 } 4974 nvlist_add_nvlist(nvl, "fcounters", nvc); 4975 nvlist_destroy(nvc); 4976 nvc = NULL; 4977 4978 /* scounters */ 4979 error = pf_add_status_counters(nvl, "scounters", V_pf_status.scounters, 4980 SCNT_MAX, pf_fcounter); 4981 if (error != 0) 4982 ERROUT(error); 4983 4984 nvlist_add_string(nvl, "ifname", V_pf_status.ifname); 4985 nvlist_add_binary(nvl, "chksum", V_pf_status.pf_chksum, 4986 PF_MD5_DIGEST_LENGTH); 4987 4988 pfi_update_status(V_pf_status.ifname, &s); 4989 4990 /* pcounters / bcounters */ 4991 for (int i = 0; i < 2; i++) { 4992 for (int j = 0; j < 2; j++) { 4993 for (int k = 0; k < 2; k++) { 4994 nvlist_append_number_array(nvl, "pcounters", 4995 s.pcounters[i][j][k]); 4996 } 4997 nvlist_append_number_array(nvl, "bcounters", 4998 s.bcounters[i][j]); 4999 } 5000 } 5001 5002 nvlpacked = nvlist_pack(nvl, &nv->len); 5003 if (nvlpacked == NULL) 5004 ERROUT(ENOMEM); 5005 5006 if (nv->size == 0) 5007 ERROUT(0); 5008 else if (nv->size < nv->len) 5009 ERROUT(ENOSPC); 5010 5011 error = copyout(nvlpacked, nv->data, nv->len); 5012 5013 #undef ERROUT 5014 errout: 5015 PF_RULES_RUNLOCK(); 5016 free(nvlpacked, M_NVLIST); 5017 nvlist_destroy(nvc); 5018 nvlist_destroy(nvl); 5019 5020 return (error); 5021 } 5022 5023 /* 5024 * XXX - Check for version missmatch!!! 5025 */ 5026 static void 5027 pf_clear_all_states(void) 5028 { 5029 struct pf_kstate *s; 5030 u_int i; 5031 5032 for (i = 0; i <= pf_hashmask; i++) { 5033 struct pf_idhash *ih = &V_pf_idhash[i]; 5034 relock: 5035 PF_HASHROW_LOCK(ih); 5036 LIST_FOREACH(s, &ih->states, entry) { 5037 s->timeout = PFTM_PURGE; 5038 /* Don't send out individual delete messages. */ 5039 s->state_flags |= PFSTATE_NOSYNC; 5040 pf_unlink_state(s, PF_ENTER_LOCKED); 5041 goto relock; 5042 } 5043 PF_HASHROW_UNLOCK(ih); 5044 } 5045 } 5046 5047 static int 5048 pf_clear_tables(void) 5049 { 5050 struct pfioc_table io; 5051 int error; 5052 5053 bzero(&io, sizeof(io)); 5054 5055 error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel, 5056 io.pfrio_flags); 5057 5058 return (error); 5059 } 5060 5061 static void 5062 pf_clear_srcnodes(struct pf_ksrc_node *n) 5063 { 5064 struct pf_kstate *s; 5065 int i; 5066 5067 for (i = 0; i <= pf_hashmask; i++) { 5068 struct pf_idhash *ih = &V_pf_idhash[i]; 5069 5070 PF_HASHROW_LOCK(ih); 5071 LIST_FOREACH(s, &ih->states, entry) { 5072 if (n == NULL || n == s->src_node) 5073 s->src_node = NULL; 5074 if (n == NULL || n == s->nat_src_node) 5075 s->nat_src_node = NULL; 5076 } 5077 PF_HASHROW_UNLOCK(ih); 5078 } 5079 5080 if (n == NULL) { 5081 struct pf_srchash *sh; 5082 5083 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; 5084 i++, sh++) { 5085 PF_HASHROW_LOCK(sh); 5086 LIST_FOREACH(n, &sh->nodes, entry) { 5087 n->expire = 1; 5088 n->states = 0; 5089 } 5090 PF_HASHROW_UNLOCK(sh); 5091 } 5092 } else { 5093 /* XXX: hash slot should already be locked here. */ 5094 n->expire = 1; 5095 n->states = 0; 5096 } 5097 } 5098 5099 static void 5100 pf_kill_srcnodes(struct pfioc_src_node_kill *psnk) 5101 { 5102 struct pf_ksrc_node_list kill; 5103 5104 LIST_INIT(&kill); 5105 for (int i = 0; i <= pf_srchashmask; i++) { 5106 struct pf_srchash *sh = &V_pf_srchash[i]; 5107 struct pf_ksrc_node *sn, *tmp; 5108 5109 PF_HASHROW_LOCK(sh); 5110 LIST_FOREACH_SAFE(sn, &sh->nodes, entry, tmp) 5111 if (PF_MATCHA(psnk->psnk_src.neg, 5112 &psnk->psnk_src.addr.v.a.addr, 5113 &psnk->psnk_src.addr.v.a.mask, 5114 &sn->addr, sn->af) && 5115 PF_MATCHA(psnk->psnk_dst.neg, 5116 &psnk->psnk_dst.addr.v.a.addr, 5117 &psnk->psnk_dst.addr.v.a.mask, 5118 &sn->raddr, sn->af)) { 5119 pf_unlink_src_node(sn); 5120 LIST_INSERT_HEAD(&kill, sn, entry); 5121 sn->expire = 1; 5122 } 5123 PF_HASHROW_UNLOCK(sh); 5124 } 5125 5126 for (int i = 0; i <= pf_hashmask; i++) { 5127 struct pf_idhash *ih = &V_pf_idhash[i]; 5128 struct pf_kstate *s; 5129 5130 PF_HASHROW_LOCK(ih); 5131 LIST_FOREACH(s, &ih->states, entry) { 5132 if (s->src_node && s->src_node->expire == 1) 5133 s->src_node = NULL; 5134 if (s->nat_src_node && s->nat_src_node->expire == 1) 5135 s->nat_src_node = NULL; 5136 } 5137 PF_HASHROW_UNLOCK(ih); 5138 } 5139 5140 psnk->psnk_killed = pf_free_src_nodes(&kill); 5141 } 5142 5143 static int 5144 pf_keepcounters(struct pfioc_nv *nv) 5145 { 5146 nvlist_t *nvl = NULL; 5147 void *nvlpacked = NULL; 5148 int error = 0; 5149 5150 #define ERROUT(x) ERROUT_FUNCTION(on_error, x) 5151 5152 if (nv->len > pf_ioctl_maxcount) 5153 ERROUT(ENOMEM); 5154 5155 nvlpacked = malloc(nv->len, M_TEMP, M_WAITOK); 5156 if (nvlpacked == NULL) 5157 ERROUT(ENOMEM); 5158 5159 error = copyin(nv->data, nvlpacked, nv->len); 5160 if (error) 5161 ERROUT(error); 5162 5163 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5164 if (nvl == NULL) 5165 ERROUT(EBADMSG); 5166 5167 if (! nvlist_exists_bool(nvl, "keep_counters")) 5168 ERROUT(EBADMSG); 5169 5170 V_pf_status.keep_counters = nvlist_get_bool(nvl, "keep_counters"); 5171 5172 on_error: 5173 nvlist_destroy(nvl); 5174 free(nvlpacked, M_TEMP); 5175 return (error); 5176 } 5177 5178 static unsigned int 5179 pf_clear_states(const struct pf_kstate_kill *kill) 5180 { 5181 struct pf_state_key_cmp match_key; 5182 struct pf_kstate *s; 5183 struct pfi_kkif *kif; 5184 int idx; 5185 unsigned int killed = 0, dir; 5186 5187 for (unsigned int i = 0; i <= pf_hashmask; i++) { 5188 struct pf_idhash *ih = &V_pf_idhash[i]; 5189 5190 relock_DIOCCLRSTATES: 5191 PF_HASHROW_LOCK(ih); 5192 LIST_FOREACH(s, &ih->states, entry) { 5193 /* For floating states look at the original kif. */ 5194 kif = s->kif == V_pfi_all ? s->orig_kif : s->kif; 5195 5196 if (kill->psk_ifname[0] && 5197 strcmp(kill->psk_ifname, 5198 kif->pfik_name)) 5199 continue; 5200 5201 if (kill->psk_kill_match) { 5202 bzero(&match_key, sizeof(match_key)); 5203 5204 if (s->direction == PF_OUT) { 5205 dir = PF_IN; 5206 idx = PF_SK_STACK; 5207 } else { 5208 dir = PF_OUT; 5209 idx = PF_SK_WIRE; 5210 } 5211 5212 match_key.af = s->key[idx]->af; 5213 match_key.proto = s->key[idx]->proto; 5214 PF_ACPY(&match_key.addr[0], 5215 &s->key[idx]->addr[1], match_key.af); 5216 match_key.port[0] = s->key[idx]->port[1]; 5217 PF_ACPY(&match_key.addr[1], 5218 &s->key[idx]->addr[0], match_key.af); 5219 match_key.port[1] = s->key[idx]->port[0]; 5220 } 5221 5222 /* 5223 * Don't send out individual 5224 * delete messages. 5225 */ 5226 s->state_flags |= PFSTATE_NOSYNC; 5227 pf_unlink_state(s, PF_ENTER_LOCKED); 5228 killed++; 5229 5230 if (kill->psk_kill_match) 5231 killed += pf_kill_matching_state(&match_key, 5232 dir); 5233 5234 goto relock_DIOCCLRSTATES; 5235 } 5236 PF_HASHROW_UNLOCK(ih); 5237 } 5238 5239 if (V_pfsync_clear_states_ptr != NULL) 5240 V_pfsync_clear_states_ptr(V_pf_status.hostid, kill->psk_ifname); 5241 5242 return (killed); 5243 } 5244 5245 static void 5246 pf_killstates(struct pf_kstate_kill *kill, unsigned int *killed) 5247 { 5248 struct pf_kstate *s; 5249 5250 if (kill->psk_pfcmp.id) { 5251 if (kill->psk_pfcmp.creatorid == 0) 5252 kill->psk_pfcmp.creatorid = V_pf_status.hostid; 5253 if ((s = pf_find_state_byid(kill->psk_pfcmp.id, 5254 kill->psk_pfcmp.creatorid))) { 5255 pf_unlink_state(s, PF_ENTER_LOCKED); 5256 *killed = 1; 5257 } 5258 return; 5259 } 5260 5261 for (unsigned int i = 0; i <= pf_hashmask; i++) 5262 *killed += pf_killstates_row(kill, &V_pf_idhash[i]); 5263 5264 return; 5265 } 5266 5267 static int 5268 pf_killstates_nv(struct pfioc_nv *nv) 5269 { 5270 struct pf_kstate_kill kill; 5271 nvlist_t *nvl = NULL; 5272 void *nvlpacked = NULL; 5273 int error = 0; 5274 unsigned int killed = 0; 5275 5276 #define ERROUT(x) ERROUT_FUNCTION(on_error, x) 5277 5278 if (nv->len > pf_ioctl_maxcount) 5279 ERROUT(ENOMEM); 5280 5281 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 5282 if (nvlpacked == NULL) 5283 ERROUT(ENOMEM); 5284 5285 error = copyin(nv->data, nvlpacked, nv->len); 5286 if (error) 5287 ERROUT(error); 5288 5289 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5290 if (nvl == NULL) 5291 ERROUT(EBADMSG); 5292 5293 error = pf_nvstate_kill_to_kstate_kill(nvl, &kill); 5294 if (error) 5295 ERROUT(error); 5296 5297 pf_killstates(&kill, &killed); 5298 5299 free(nvlpacked, M_NVLIST); 5300 nvlpacked = NULL; 5301 nvlist_destroy(nvl); 5302 nvl = nvlist_create(0); 5303 if (nvl == NULL) 5304 ERROUT(ENOMEM); 5305 5306 nvlist_add_number(nvl, "killed", killed); 5307 5308 nvlpacked = nvlist_pack(nvl, &nv->len); 5309 if (nvlpacked == NULL) 5310 ERROUT(ENOMEM); 5311 5312 if (nv->size == 0) 5313 ERROUT(0); 5314 else if (nv->size < nv->len) 5315 ERROUT(ENOSPC); 5316 5317 error = copyout(nvlpacked, nv->data, nv->len); 5318 5319 on_error: 5320 nvlist_destroy(nvl); 5321 free(nvlpacked, M_NVLIST); 5322 return (error); 5323 } 5324 5325 static int 5326 pf_clearstates_nv(struct pfioc_nv *nv) 5327 { 5328 struct pf_kstate_kill kill; 5329 nvlist_t *nvl = NULL; 5330 void *nvlpacked = NULL; 5331 int error = 0; 5332 unsigned int killed; 5333 5334 #define ERROUT(x) ERROUT_FUNCTION(on_error, x) 5335 5336 if (nv->len > pf_ioctl_maxcount) 5337 ERROUT(ENOMEM); 5338 5339 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 5340 if (nvlpacked == NULL) 5341 ERROUT(ENOMEM); 5342 5343 error = copyin(nv->data, nvlpacked, nv->len); 5344 if (error) 5345 ERROUT(error); 5346 5347 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5348 if (nvl == NULL) 5349 ERROUT(EBADMSG); 5350 5351 error = pf_nvstate_kill_to_kstate_kill(nvl, &kill); 5352 if (error) 5353 ERROUT(error); 5354 5355 killed = pf_clear_states(&kill); 5356 5357 free(nvlpacked, M_NVLIST); 5358 nvlpacked = NULL; 5359 nvlist_destroy(nvl); 5360 nvl = nvlist_create(0); 5361 if (nvl == NULL) 5362 ERROUT(ENOMEM); 5363 5364 nvlist_add_number(nvl, "killed", killed); 5365 5366 nvlpacked = nvlist_pack(nvl, &nv->len); 5367 if (nvlpacked == NULL) 5368 ERROUT(ENOMEM); 5369 5370 if (nv->size == 0) 5371 ERROUT(0); 5372 else if (nv->size < nv->len) 5373 ERROUT(ENOSPC); 5374 5375 error = copyout(nvlpacked, nv->data, nv->len); 5376 5377 #undef ERROUT 5378 on_error: 5379 nvlist_destroy(nvl); 5380 free(nvlpacked, M_NVLIST); 5381 return (error); 5382 } 5383 5384 static int 5385 pf_getstate(struct pfioc_nv *nv) 5386 { 5387 nvlist_t *nvl = NULL, *nvls; 5388 void *nvlpacked = NULL; 5389 struct pf_kstate *s = NULL; 5390 int error = 0; 5391 uint64_t id, creatorid; 5392 5393 #define ERROUT(x) ERROUT_FUNCTION(errout, x) 5394 5395 if (nv->len > pf_ioctl_maxcount) 5396 ERROUT(ENOMEM); 5397 5398 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK); 5399 if (nvlpacked == NULL) 5400 ERROUT(ENOMEM); 5401 5402 error = copyin(nv->data, nvlpacked, nv->len); 5403 if (error) 5404 ERROUT(error); 5405 5406 nvl = nvlist_unpack(nvlpacked, nv->len, 0); 5407 if (nvl == NULL) 5408 ERROUT(EBADMSG); 5409 5410 PFNV_CHK(pf_nvuint64(nvl, "id", &id)); 5411 PFNV_CHK(pf_nvuint64(nvl, "creatorid", &creatorid)); 5412 5413 s = pf_find_state_byid(id, creatorid); 5414 if (s == NULL) 5415 ERROUT(ENOENT); 5416 5417 free(nvlpacked, M_NVLIST); 5418 nvlpacked = NULL; 5419 nvlist_destroy(nvl); 5420 nvl = nvlist_create(0); 5421 if (nvl == NULL) 5422 ERROUT(ENOMEM); 5423 5424 nvls = pf_state_to_nvstate(s); 5425 if (nvls == NULL) 5426 ERROUT(ENOMEM); 5427 5428 nvlist_add_nvlist(nvl, "state", nvls); 5429 nvlist_destroy(nvls); 5430 5431 nvlpacked = nvlist_pack(nvl, &nv->len); 5432 if (nvlpacked == NULL) 5433 ERROUT(ENOMEM); 5434 5435 if (nv->size == 0) 5436 ERROUT(0); 5437 else if (nv->size < nv->len) 5438 ERROUT(ENOSPC); 5439 5440 error = copyout(nvlpacked, nv->data, nv->len); 5441 5442 #undef ERROUT 5443 errout: 5444 if (s != NULL) 5445 PF_STATE_UNLOCK(s); 5446 free(nvlpacked, M_NVLIST); 5447 nvlist_destroy(nvl); 5448 return (error); 5449 } 5450 5451 /* 5452 * XXX - Check for version missmatch!!! 5453 */ 5454 5455 /* 5456 * Duplicate pfctl -Fa operation to get rid of as much as we can. 5457 */ 5458 static int 5459 shutdown_pf(void) 5460 { 5461 int error = 0; 5462 u_int32_t t[5]; 5463 char nn = '\0'; 5464 5465 do { 5466 if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn)) 5467 != 0) { 5468 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n")); 5469 break; 5470 } 5471 if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn)) 5472 != 0) { 5473 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n")); 5474 break; /* XXX: rollback? */ 5475 } 5476 if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn)) 5477 != 0) { 5478 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n")); 5479 break; /* XXX: rollback? */ 5480 } 5481 if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn)) 5482 != 0) { 5483 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n")); 5484 break; /* XXX: rollback? */ 5485 } 5486 if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn)) 5487 != 0) { 5488 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n")); 5489 break; /* XXX: rollback? */ 5490 } 5491 5492 /* XXX: these should always succeed here */ 5493 pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn); 5494 pf_commit_rules(t[1], PF_RULESET_FILTER, &nn); 5495 pf_commit_rules(t[2], PF_RULESET_NAT, &nn); 5496 pf_commit_rules(t[3], PF_RULESET_BINAT, &nn); 5497 pf_commit_rules(t[4], PF_RULESET_RDR, &nn); 5498 5499 if ((error = pf_clear_tables()) != 0) 5500 break; 5501 5502 #ifdef ALTQ 5503 if ((error = pf_begin_altq(&t[0])) != 0) { 5504 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n")); 5505 break; 5506 } 5507 pf_commit_altq(t[0]); 5508 #endif 5509 5510 pf_clear_all_states(); 5511 5512 pf_clear_srcnodes(NULL); 5513 5514 /* status does not use malloced mem so no need to cleanup */ 5515 /* fingerprints and interfaces have their own cleanup code */ 5516 } while(0); 5517 5518 return (error); 5519 } 5520 5521 static pfil_return_t 5522 pf_check_return(int chk, struct mbuf **m) 5523 { 5524 5525 switch (chk) { 5526 case PF_PASS: 5527 if (*m == NULL) 5528 return (PFIL_CONSUMED); 5529 else 5530 return (PFIL_PASS); 5531 break; 5532 default: 5533 if (*m != NULL) { 5534 m_freem(*m); 5535 *m = NULL; 5536 } 5537 return (PFIL_DROPPED); 5538 } 5539 } 5540 5541 #ifdef INET 5542 static pfil_return_t 5543 pf_check_in(struct mbuf **m, struct ifnet *ifp, int flags, 5544 void *ruleset __unused, struct inpcb *inp) 5545 { 5546 int chk; 5547 5548 chk = pf_test(PF_IN, flags, ifp, m, inp); 5549 5550 return (pf_check_return(chk, m)); 5551 } 5552 5553 static pfil_return_t 5554 pf_check_out(struct mbuf **m, struct ifnet *ifp, int flags, 5555 void *ruleset __unused, struct inpcb *inp) 5556 { 5557 int chk; 5558 5559 chk = pf_test(PF_OUT, flags, ifp, m, inp); 5560 5561 return (pf_check_return(chk, m)); 5562 } 5563 #endif 5564 5565 #ifdef INET6 5566 static pfil_return_t 5567 pf_check6_in(struct mbuf **m, struct ifnet *ifp, int flags, 5568 void *ruleset __unused, struct inpcb *inp) 5569 { 5570 int chk; 5571 5572 /* 5573 * In case of loopback traffic IPv6 uses the real interface in 5574 * order to support scoped addresses. In order to support stateful 5575 * filtering we have change this to lo0 as it is the case in IPv4. 5576 */ 5577 CURVNET_SET(ifp->if_vnet); 5578 chk = pf_test6(PF_IN, flags, (*m)->m_flags & M_LOOP ? V_loif : ifp, m, inp); 5579 CURVNET_RESTORE(); 5580 5581 return (pf_check_return(chk, m)); 5582 } 5583 5584 static pfil_return_t 5585 pf_check6_out(struct mbuf **m, struct ifnet *ifp, int flags, 5586 void *ruleset __unused, struct inpcb *inp) 5587 { 5588 int chk; 5589 5590 CURVNET_SET(ifp->if_vnet); 5591 chk = pf_test6(PF_OUT, flags, ifp, m, inp); 5592 CURVNET_RESTORE(); 5593 5594 return (pf_check_return(chk, m)); 5595 } 5596 #endif /* INET6 */ 5597 5598 #ifdef INET 5599 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip4_in_hook); 5600 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip4_out_hook); 5601 #define V_pf_ip4_in_hook VNET(pf_ip4_in_hook) 5602 #define V_pf_ip4_out_hook VNET(pf_ip4_out_hook) 5603 #endif 5604 #ifdef INET6 5605 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip6_in_hook); 5606 VNET_DEFINE_STATIC(pfil_hook_t, pf_ip6_out_hook); 5607 #define V_pf_ip6_in_hook VNET(pf_ip6_in_hook) 5608 #define V_pf_ip6_out_hook VNET(pf_ip6_out_hook) 5609 #endif 5610 5611 static void 5612 hook_pf(void) 5613 { 5614 struct pfil_hook_args pha; 5615 struct pfil_link_args pla; 5616 int ret; 5617 5618 if (V_pf_pfil_hooked) 5619 return; 5620 5621 pha.pa_version = PFIL_VERSION; 5622 pha.pa_modname = "pf"; 5623 pha.pa_ruleset = NULL; 5624 5625 pla.pa_version = PFIL_VERSION; 5626 5627 #ifdef INET 5628 pha.pa_type = PFIL_TYPE_IP4; 5629 pha.pa_func = pf_check_in; 5630 pha.pa_flags = PFIL_IN; 5631 pha.pa_rulname = "default-in"; 5632 V_pf_ip4_in_hook = pfil_add_hook(&pha); 5633 pla.pa_flags = PFIL_IN | PFIL_HEADPTR | PFIL_HOOKPTR; 5634 pla.pa_head = V_inet_pfil_head; 5635 pla.pa_hook = V_pf_ip4_in_hook; 5636 ret = pfil_link(&pla); 5637 MPASS(ret == 0); 5638 pha.pa_func = pf_check_out; 5639 pha.pa_flags = PFIL_OUT; 5640 pha.pa_rulname = "default-out"; 5641 V_pf_ip4_out_hook = pfil_add_hook(&pha); 5642 pla.pa_flags = PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR; 5643 pla.pa_head = V_inet_pfil_head; 5644 pla.pa_hook = V_pf_ip4_out_hook; 5645 ret = pfil_link(&pla); 5646 MPASS(ret == 0); 5647 #endif 5648 #ifdef INET6 5649 pha.pa_type = PFIL_TYPE_IP6; 5650 pha.pa_func = pf_check6_in; 5651 pha.pa_flags = PFIL_IN; 5652 pha.pa_rulname = "default-in6"; 5653 V_pf_ip6_in_hook = pfil_add_hook(&pha); 5654 pla.pa_flags = PFIL_IN | PFIL_HEADPTR | PFIL_HOOKPTR; 5655 pla.pa_head = V_inet6_pfil_head; 5656 pla.pa_hook = V_pf_ip6_in_hook; 5657 ret = pfil_link(&pla); 5658 MPASS(ret == 0); 5659 pha.pa_func = pf_check6_out; 5660 pha.pa_rulname = "default-out6"; 5661 pha.pa_flags = PFIL_OUT; 5662 V_pf_ip6_out_hook = pfil_add_hook(&pha); 5663 pla.pa_flags = PFIL_OUT | PFIL_HEADPTR | PFIL_HOOKPTR; 5664 pla.pa_head = V_inet6_pfil_head; 5665 pla.pa_hook = V_pf_ip6_out_hook; 5666 ret = pfil_link(&pla); 5667 MPASS(ret == 0); 5668 #endif 5669 5670 V_pf_pfil_hooked = 1; 5671 } 5672 5673 static void 5674 dehook_pf(void) 5675 { 5676 5677 if (V_pf_pfil_hooked == 0) 5678 return; 5679 5680 #ifdef INET 5681 pfil_remove_hook(V_pf_ip4_in_hook); 5682 pfil_remove_hook(V_pf_ip4_out_hook); 5683 #endif 5684 #ifdef INET6 5685 pfil_remove_hook(V_pf_ip6_in_hook); 5686 pfil_remove_hook(V_pf_ip6_out_hook); 5687 #endif 5688 5689 V_pf_pfil_hooked = 0; 5690 } 5691 5692 static void 5693 pf_load_vnet(void) 5694 { 5695 V_pf_tag_z = uma_zcreate("pf tags", sizeof(struct pf_tagname), 5696 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0); 5697 5698 pf_init_tagset(&V_pf_tags, &pf_rule_tag_hashsize, 5699 PF_RULE_TAG_HASH_SIZE_DEFAULT); 5700 #ifdef ALTQ 5701 pf_init_tagset(&V_pf_qids, &pf_queue_tag_hashsize, 5702 PF_QUEUE_TAG_HASH_SIZE_DEFAULT); 5703 #endif 5704 5705 pfattach_vnet(); 5706 V_pf_vnet_active = 1; 5707 } 5708 5709 static int 5710 pf_load(void) 5711 { 5712 int error; 5713 5714 rm_init_flags(&pf_rules_lock, "pf rulesets", RM_RECURSE); 5715 sx_init(&pf_ioctl_lock, "pf ioctl"); 5716 sx_init(&pf_end_lock, "pf end thread"); 5717 5718 pf_mtag_initialize(); 5719 5720 pf_dev = make_dev(&pf_cdevsw, 0, UID_ROOT, GID_WHEEL, 0600, PF_NAME); 5721 if (pf_dev == NULL) 5722 return (ENOMEM); 5723 5724 pf_end_threads = 0; 5725 error = kproc_create(pf_purge_thread, NULL, &pf_purge_proc, 0, 0, "pf purge"); 5726 if (error != 0) 5727 return (error); 5728 5729 pfi_initialize(); 5730 5731 return (0); 5732 } 5733 5734 static void 5735 pf_unload_vnet(void) 5736 { 5737 int ret; 5738 5739 V_pf_vnet_active = 0; 5740 V_pf_status.running = 0; 5741 dehook_pf(); 5742 5743 PF_RULES_WLOCK(); 5744 pf_syncookies_cleanup(); 5745 shutdown_pf(); 5746 PF_RULES_WUNLOCK(); 5747 5748 ret = swi_remove(V_pf_swi_cookie); 5749 MPASS(ret == 0); 5750 ret = intr_event_destroy(V_pf_swi_ie); 5751 MPASS(ret == 0); 5752 5753 pf_unload_vnet_purge(); 5754 5755 pf_normalize_cleanup(); 5756 PF_RULES_WLOCK(); 5757 pfi_cleanup_vnet(); 5758 PF_RULES_WUNLOCK(); 5759 pfr_cleanup(); 5760 pf_osfp_flush(); 5761 pf_cleanup(); 5762 if (IS_DEFAULT_VNET(curvnet)) 5763 pf_mtag_cleanup(); 5764 5765 pf_cleanup_tagset(&V_pf_tags); 5766 #ifdef ALTQ 5767 pf_cleanup_tagset(&V_pf_qids); 5768 #endif 5769 uma_zdestroy(V_pf_tag_z); 5770 5771 #ifdef PF_WANT_32_TO_64_COUNTER 5772 PF_RULES_WLOCK(); 5773 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist); 5774 5775 MPASS(LIST_EMPTY(&V_pf_allkiflist)); 5776 MPASS(V_pf_allkifcount == 0); 5777 5778 LIST_REMOVE(&V_pf_default_rule, allrulelist); 5779 V_pf_allrulecount--; 5780 LIST_REMOVE(V_pf_rulemarker, allrulelist); 5781 5782 /* 5783 * There are known pf rule leaks when running the test suite. 5784 */ 5785 #ifdef notyet 5786 MPASS(LIST_EMPTY(&V_pf_allrulelist)); 5787 MPASS(V_pf_allrulecount == 0); 5788 #endif 5789 5790 PF_RULES_WUNLOCK(); 5791 5792 free(V_pf_kifmarker, PFI_MTYPE); 5793 free(V_pf_rulemarker, M_PFRULE); 5794 #endif 5795 5796 /* Free counters last as we updated them during shutdown. */ 5797 pf_counter_u64_deinit(&V_pf_default_rule.evaluations); 5798 for (int i = 0; i < 2; i++) { 5799 pf_counter_u64_deinit(&V_pf_default_rule.packets[i]); 5800 pf_counter_u64_deinit(&V_pf_default_rule.bytes[i]); 5801 } 5802 counter_u64_free(V_pf_default_rule.states_cur); 5803 counter_u64_free(V_pf_default_rule.states_tot); 5804 counter_u64_free(V_pf_default_rule.src_nodes); 5805 5806 for (int i = 0; i < PFRES_MAX; i++) 5807 counter_u64_free(V_pf_status.counters[i]); 5808 for (int i = 0; i < KLCNT_MAX; i++) 5809 counter_u64_free(V_pf_status.lcounters[i]); 5810 for (int i = 0; i < FCNT_MAX; i++) 5811 pf_counter_u64_deinit(&V_pf_status.fcounters[i]); 5812 for (int i = 0; i < SCNT_MAX; i++) 5813 counter_u64_free(V_pf_status.scounters[i]); 5814 } 5815 5816 static void 5817 pf_unload(void) 5818 { 5819 5820 sx_xlock(&pf_end_lock); 5821 pf_end_threads = 1; 5822 while (pf_end_threads < 2) { 5823 wakeup_one(pf_purge_thread); 5824 sx_sleep(pf_purge_proc, &pf_end_lock, 0, "pftmo", 0); 5825 } 5826 sx_xunlock(&pf_end_lock); 5827 5828 if (pf_dev != NULL) 5829 destroy_dev(pf_dev); 5830 5831 pfi_cleanup(); 5832 5833 rm_destroy(&pf_rules_lock); 5834 sx_destroy(&pf_ioctl_lock); 5835 sx_destroy(&pf_end_lock); 5836 } 5837 5838 static void 5839 vnet_pf_init(void *unused __unused) 5840 { 5841 5842 pf_load_vnet(); 5843 } 5844 VNET_SYSINIT(vnet_pf_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD, 5845 vnet_pf_init, NULL); 5846 5847 static void 5848 vnet_pf_uninit(const void *unused __unused) 5849 { 5850 5851 pf_unload_vnet(); 5852 } 5853 SYSUNINIT(pf_unload, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND, pf_unload, NULL); 5854 VNET_SYSUNINIT(vnet_pf_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD, 5855 vnet_pf_uninit, NULL); 5856 5857 static int 5858 pf_modevent(module_t mod, int type, void *data) 5859 { 5860 int error = 0; 5861 5862 switch(type) { 5863 case MOD_LOAD: 5864 error = pf_load(); 5865 break; 5866 case MOD_UNLOAD: 5867 /* Handled in SYSUNINIT(pf_unload) to ensure it's done after 5868 * the vnet_pf_uninit()s */ 5869 break; 5870 default: 5871 error = EINVAL; 5872 break; 5873 } 5874 5875 return (error); 5876 } 5877 5878 static moduledata_t pf_mod = { 5879 "pf", 5880 pf_modevent, 5881 0 5882 }; 5883 5884 DECLARE_MODULE(pf, pf_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND); 5885 MODULE_VERSION(pf, PF_MODVER); 5886