]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/pf_ioctl.c
projects / apple / xnu.git / blob
? search:


5b8461e375d0dd38cb5e601f79cecdf658ecea86
[apple/xnu.git] / bsd / net / pf_ioctl.c
1 /*
2 * Copyright (c) 2008 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $apfw: pf_ioctl.c,v 1.16 2008/08/27 00:01:32 jhw Exp $ */
30 /* $OpenBSD: pf_ioctl.c,v 1.175 2007/02/26 22:47:43 deraadt Exp $ */
31
32 /*
33 * Copyright (c) 2001 Daniel Hartmeier
34 * Copyright (c) 2002,2003 Henning Brauer
35 * All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 *
41 * - Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * - Redistributions in binary form must reproduce the above
44 * copyright notice, this list of conditions and the following
45 * disclaimer in the documentation and/or other materials provided
46 * with the distribution.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
49 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
50 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
51 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
52 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
53 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
54 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
55 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
56 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
58 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
59 * POSSIBILITY OF SUCH DAMAGE.
60 *
61 * Effort sponsored in part by the Defense Advanced Research Projects
62 * Agency (DARPA) and Air Force Research Laboratory, Air Force
63 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
64 *
65 */
66
67 #include <machine/endian.h>
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/mbuf.h>
71 #include <sys/filio.h>
72 #include <sys/fcntl.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/kernel.h>
76 #include <sys/time.h>
77 #include <sys/proc_internal.h>
78 #include <sys/malloc.h>
79 #include <sys/kauth.h>
80 #include <sys/conf.h>
81 #include <sys/mcache.h>
82
83 #include <mach/vm_param.h>
84
85 #include <net/if.h>
86 #include <net/if_types.h>
87 #include <net/route.h>
88
89 #include <netinet/in.h>
90 #include <netinet/in_var.h>
91 #include <netinet/in_systm.h>
92 #include <netinet/ip.h>
93 #include <netinet/ip_var.h>
94 #include <netinet/ip_icmp.h>
95 #include <netinet/if_ether.h>
96
97 #include <libkern/crypto/md5.h>
98
99 #include <miscfs/devfs/devfs.h>
100
101 #include <net/pfvar.h>
102
103 #if NPFSYNC
104 #include <net/if_pfsync.h>
105 #endif /* NPFSYNC */
106
107 #if PFLOG
108 #include <net/if_pflog.h>
109 #endif /* PFLOG */
110
111 #if INET6
112 #include <netinet/ip6.h>
113 #include <netinet/in_pcb.h>
114 #endif /* INET6 */
115
116 #if ALTQ
117 #include <altq/altq.h>
118 #endif /* ALTQ */
119
120 #if 0
121 static void pfdetach(void);
122 #endif
123 static int pfopen(dev_t, int, int, struct proc *);
124 static int pfclose(dev_t, int, int, struct proc *);
125 static int pfioctl(dev_t, u_long, caddr_t, int, struct proc *);
126 static struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
127 u_int8_t, u_int8_t, u_int8_t);
128
129 static void pf_mv_pool(struct pf_palist *, struct pf_palist *);
130 static void pf_empty_pool(struct pf_palist *);
131 #if ALTQ
132 static int pf_begin_altq(u_int32_t *);
133 static int pf_rollback_altq(u_int32_t);
134 static int pf_commit_altq(u_int32_t);
135 static int pf_enable_altq(struct pf_altq *);
136 static int pf_disable_altq(struct pf_altq *);
137 #endif /* ALTQ */
138 static int pf_begin_rules(u_int32_t *, int, const char *);
139 static int pf_rollback_rules(u_int32_t, int, char *);
140 static int pf_setup_pfsync_matching(struct pf_ruleset *);
141 static void pf_hash_rule(MD5_CTX *, struct pf_rule *);
142 #ifndef NO_APPLE_EXTENSIONS
143 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *, u_int8_t);
144 #else
145 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
146 #endif
147 static int pf_commit_rules(u_int32_t, int, char *);
148 static void pf_state_export(struct pfsync_state *, struct pf_state_key *,
149 struct pf_state *);
150 static void pf_state_import(struct pfsync_state *, struct pf_state_key *,
151 struct pf_state *);
152
153 #define PF_CDEV_MAJOR (-1)
154
155 static struct cdevsw pf_cdevsw = {
156 /* open */ pfopen,
157 /* close */ pfclose,
158 /* read */ eno_rdwrt,
159 /* write */ eno_rdwrt,
160 /* ioctl */ pfioctl,
161 /* stop */ eno_stop,
162 /* reset */ eno_reset,
163 /* tty */ NULL,
164 /* select */ eno_select,
165 /* mmap */ eno_mmap,
166 /* strategy */ eno_strat,
167 /* getc */ eno_getc,
168 /* putc */ eno_putc,
169 /* type */ 0
170 };
171
172 static void pf_attach_hooks(void);
173 static void pf_detach_hooks(void);
174 static int pf_hooks_attached = 0;
175
176 struct pf_rule pf_default_rule;
177 #if ALTQ
178 static int pf_altq_running;
179 #endif /* ALTQ */
180
181 #define TAGID_MAX 50000
182 static TAILQ_HEAD(pf_tags, pf_tagname) pf_tags =
183 TAILQ_HEAD_INITIALIZER(pf_tags);
184 #if ALTQ
185 static TAILQ_HEAD(pf_tags, pf_tagname) pf_qids =
186 TAILQ_HEAD_INITIALIZER(pf_qids);
187 #endif /* ALTQ */
188
189 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
190 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
191 #endif
192 static u_int16_t tagname2tag(struct pf_tags *, char *);
193 static void tag2tagname(struct pf_tags *, u_int16_t, char *);
194 static void tag_unref(struct pf_tags *, u_int16_t);
195 static int pf_rtlabel_add(struct pf_addr_wrap *);
196 static void pf_rtlabel_remove(struct pf_addr_wrap *);
197 static void pf_rtlabel_copyout(struct pf_addr_wrap *);
198
199 #if INET
200 static int pf_inet_hook(struct ifnet *, struct mbuf **, int);
201 #endif /* INET */
202 #if INET6
203 static int pf_inet6_hook(struct ifnet *, struct mbuf **, int);
204 #endif /* INET6 */
205
206 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x
207
208 static lck_attr_t *pf_perim_lock_attr;
209 static lck_grp_t *pf_perim_lock_grp;
210 static lck_grp_attr_t *pf_perim_lock_grp_attr;
211
212 static lck_attr_t *pf_lock_attr;
213 static lck_grp_t *pf_lock_grp;
214 static lck_grp_attr_t *pf_lock_grp_attr;
215
216 struct thread *pf_purge_thread;
217
218 extern void pfi_kifaddr_update(void *);
219
220 void
221 pfinit(void)
222 {
223 u_int32_t *t = pf_default_rule.timeout;
224 int maj;
225
226 pf_perim_lock_grp_attr = lck_grp_attr_alloc_init();
227 pf_perim_lock_grp = lck_grp_alloc_init("pf_perim",
228 pf_perim_lock_grp_attr);
229 pf_perim_lock_attr = lck_attr_alloc_init();
230 pf_perim_lock = lck_rw_alloc_init(pf_perim_lock_grp,
231 pf_perim_lock_attr);
232
233 pf_lock_grp_attr = lck_grp_attr_alloc_init();
234 pf_lock_grp = lck_grp_alloc_init("pf", pf_lock_grp_attr);
235 pf_lock_attr = lck_attr_alloc_init();
236 pf_lock = lck_mtx_alloc_init(pf_lock_grp, pf_lock_attr);
237
238 pool_init(&pf_rule_pl, sizeof (struct pf_rule), 0, 0, 0, "pfrulepl",
239 NULL);
240 pool_init(&pf_src_tree_pl, sizeof (struct pf_src_node), 0, 0, 0,
241 "pfsrctrpl", NULL);
242 pool_init(&pf_state_pl, sizeof (struct pf_state), 0, 0, 0, "pfstatepl",
243 NULL);
244 pool_init(&pf_state_key_pl, sizeof (struct pf_state_key), 0, 0, 0,
245 "pfstatekeypl", NULL);
246 #ifndef NO_APPLE_EXTENSIONS
247 pool_init(&pf_app_state_pl, sizeof (struct pf_app_state), 0, 0, 0,
248 "pfappstatepl", NULL);
249 #endif
250 #if ALTQ
251 pool_init(&pf_altq_pl, sizeof (struct pf_altq), 0, 0, 0, "pfaltqpl",
252 NULL);
253 #endif /* ALTQ */
254 pool_init(&pf_pooladdr_pl, sizeof (struct pf_pooladdr), 0, 0, 0,
255 "pfpooladdrpl", NULL);
256 pfr_initialize();
257 pfi_initialize();
258 pf_osfp_initialize();
259
260 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp,
261 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0);
262
263 if (max_mem <= 256*1024*1024)
264 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit =
265 PFR_KENTRY_HIWAT_SMALL;
266
267 RB_INIT(&tree_src_tracking);
268 RB_INIT(&pf_anchors);
269 pf_init_ruleset(&pf_main_ruleset);
270 TAILQ_INIT(&pf_pabuf);
271 TAILQ_INIT(&state_list);
272 #if ALTQ
273 TAILQ_INIT(&pf_altqs[0]);
274 TAILQ_INIT(&pf_altqs[1]);
275 pf_altqs_active = &pf_altqs[0];
276 pf_altqs_inactive = &pf_altqs[1];
277 #endif /* ALTQ */
278
279 /* default rule should never be garbage collected */
280 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next;
281 pf_default_rule.action = PF_PASS;
282 pf_default_rule.nr = -1;
283 pf_default_rule.rtableid = IFSCOPE_NONE;
284
285 /* initialize default timeouts */
286 t[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
287 t[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
288 t[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
289 t[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
290 t[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
291 t[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
292 t[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
293 t[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
294 t[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
295 t[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
296 t[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
297 #ifndef NO_APPLE_EXTENSIONS
298 t[PFTM_GREv1_FIRST_PACKET] = PFTM_GREv1_FIRST_PACKET_VAL;
299 t[PFTM_GREv1_INITIATING] = PFTM_GREv1_INITIATING_VAL;
300 t[PFTM_GREv1_ESTABLISHED] = PFTM_GREv1_ESTABLISHED_VAL;
301 t[PFTM_ESP_FIRST_PACKET] = PFTM_ESP_FIRST_PACKET_VAL;
302 t[PFTM_ESP_INITIATING] = PFTM_ESP_INITIATING_VAL;
303 t[PFTM_ESP_ESTABLISHED] = PFTM_ESP_ESTABLISHED_VAL;
304 #endif
305 t[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
306 t[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
307 t[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
308 t[PFTM_FRAG] = PFTM_FRAG_VAL;
309 t[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
310 t[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
311 t[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
312 t[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
313 t[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
314
315 pf_normalize_init();
316 bzero(&pf_status, sizeof (pf_status));
317 pf_status.debug = PF_DEBUG_URGENT;
318
319 /* XXX do our best to avoid a conflict */
320 pf_status.hostid = random();
321
322 if (kernel_thread_start(pf_purge_thread_fn, NULL,
323 &pf_purge_thread) != 0) {
324 printf("%s: unable to start purge thread!", __func__);
325 return;
326 }
327
328 maj = cdevsw_add(PF_CDEV_MAJOR, &pf_cdevsw);
329 if (maj == -1) {
330 printf("%s: failed to allocate major number!\n", __func__);
331 return;
332 }
333 (void) devfs_make_node(makedev(maj, 0), DEVFS_CHAR,
334 UID_ROOT, GID_WHEEL, 0600, "pf", 0);
335 }
336
337 #if 0
338 static void
339 pfdetach(void)
340 {
341 struct pf_anchor *anchor;
342 struct pf_state *state;
343 struct pf_src_node *node;
344 struct pfioc_table pt;
345 u_int32_t ticket;
346 int i;
347 char r = '\0';
348
349 pf_status.running = 0;
350 wakeup(pf_purge_thread_fn);
351
352 /* clear the rulesets */
353 for (i = 0; i < PF_RULESET_MAX; i++)
354 if (pf_begin_rules(&ticket, i, &r) == 0)
355 pf_commit_rules(ticket, i, &r);
356 #if ALTQ
357 if (pf_begin_altq(&ticket) == 0)
358 pf_commit_altq(ticket);
359 #endif /* ALTQ */
360
361 /* clear states */
362 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
363 state->timeout = PFTM_PURGE;
364 #if NPFSYNC
365 state->sync_flags = PFSTATE_NOSYNC;
366 #endif
367 }
368 pf_purge_expired_states(pf_status.states);
369
370 #if NPFSYNC
371 pfsync_clear_states(pf_status.hostid, NULL);
372 #endif
373
374 /* clear source nodes */
375 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
376 state->src_node = NULL;
377 state->nat_src_node = NULL;
378 }
379 RB_FOREACH(node, pf_src_tree, &tree_src_tracking) {
380 node->expire = 1;
381 node->states = 0;
382 }
383 pf_purge_expired_src_nodes();
384
385 /* clear tables */
386 memset(&pt, '\0', sizeof (pt));
387 pfr_clr_tables(&pt.pfrio_table, &pt.pfrio_ndel, pt.pfrio_flags);
388
389 /* destroy anchors */
390 while ((anchor = RB_MIN(pf_anchor_global, &pf_anchors)) != NULL) {
391 for (i = 0; i < PF_RULESET_MAX; i++)
392 if (pf_begin_rules(&ticket, i, anchor->name) == 0)
393 pf_commit_rules(ticket, i, anchor->name);
394 }
395
396 /* destroy main ruleset */
397 pf_remove_if_empty_ruleset(&pf_main_ruleset);
398
399 /* destroy the pools */
400 pool_destroy(&pf_pooladdr_pl);
401 #if ALTQ
402 pool_destroy(&pf_altq_pl);
403 #endif /* ALTQ */
404 pool_destroy(&pf_state_pl);
405 pool_destroy(&pf_rule_pl);
406 pool_destroy(&pf_src_tree_pl);
407
408 /* destroy subsystems */
409 pf_normalize_destroy();
410 pf_osfp_destroy();
411 pfr_destroy();
412 pfi_destroy();
413 }
414 #endif
415
416 static int
417 pfopen(dev_t dev, int flags, int fmt, struct proc *p)
418 {
419 #pragma unused(flags, fmt, p)
420 if (minor(dev) >= 1)
421 return (ENXIO);
422 return (0);
423 }
424
425 static int
426 pfclose(dev_t dev, int flags, int fmt, struct proc *p)
427 {
428 #pragma unused(flags, fmt, p)
429 if (minor(dev) >= 1)
430 return (ENXIO);
431 return (0);
432 }
433
434 static struct pf_pool *
435 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
436 u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
437 u_int8_t check_ticket)
438 {
439 struct pf_ruleset *ruleset;
440 struct pf_rule *rule;
441 int rs_num;
442
443 ruleset = pf_find_ruleset(anchor);
444 if (ruleset == NULL)
445 return (NULL);
446 rs_num = pf_get_ruleset_number(rule_action);
447 if (rs_num >= PF_RULESET_MAX)
448 return (NULL);
449 if (active) {
450 if (check_ticket && ticket !=
451 ruleset->rules[rs_num].active.ticket)
452 return (NULL);
453 if (r_last)
454 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
455 pf_rulequeue);
456 else
457 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
458 } else {
459 if (check_ticket && ticket !=
460 ruleset->rules[rs_num].inactive.ticket)
461 return (NULL);
462 if (r_last)
463 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
464 pf_rulequeue);
465 else
466 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
467 }
468 if (!r_last) {
469 while ((rule != NULL) && (rule->nr != rule_number))
470 rule = TAILQ_NEXT(rule, entries);
471 }
472 if (rule == NULL)
473 return (NULL);
474
475 return (&rule->rpool);
476 }
477
478 static void
479 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb)
480 {
481 struct pf_pooladdr *mv_pool_pa;
482
483 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
484 TAILQ_REMOVE(poola, mv_pool_pa, entries);
485 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
486 }
487 }
488
489 static void
490 pf_empty_pool(struct pf_palist *poola)
491 {
492 struct pf_pooladdr *empty_pool_pa;
493
494 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) {
495 pfi_dynaddr_remove(&empty_pool_pa->addr);
496 pf_tbladdr_remove(&empty_pool_pa->addr);
497 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE);
498 TAILQ_REMOVE(poola, empty_pool_pa, entries);
499 pool_put(&pf_pooladdr_pl, empty_pool_pa);
500 }
501 }
502
503 void
504 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
505 {
506 if (rulequeue != NULL) {
507 if (rule->states <= 0) {
508 /*
509 * XXX - we need to remove the table *before* detaching
510 * the rule to make sure the table code does not delete
511 * the anchor under our feet.
512 */
513 pf_tbladdr_remove(&rule->src.addr);
514 pf_tbladdr_remove(&rule->dst.addr);
515 if (rule->overload_tbl)
516 pfr_detach_table(rule->overload_tbl);
517 }
518 TAILQ_REMOVE(rulequeue, rule, entries);
519 rule->entries.tqe_prev = NULL;
520 rule->nr = -1;
521 }
522
523 if (rule->states > 0 || rule->src_nodes > 0 ||
524 rule->entries.tqe_prev != NULL)
525 return;
526 pf_tag_unref(rule->tag);
527 pf_tag_unref(rule->match_tag);
528 #if ALTQ
529 if (rule->pqid != rule->qid)
530 pf_qid_unref(rule->pqid);
531 pf_qid_unref(rule->qid);
532 #endif /* ALTQ */
533 pf_rtlabel_remove(&rule->src.addr);
534 pf_rtlabel_remove(&rule->dst.addr);
535 pfi_dynaddr_remove(&rule->src.addr);
536 pfi_dynaddr_remove(&rule->dst.addr);
537 if (rulequeue == NULL) {
538 pf_tbladdr_remove(&rule->src.addr);
539 pf_tbladdr_remove(&rule->dst.addr);
540 if (rule->overload_tbl)
541 pfr_detach_table(rule->overload_tbl);
542 }
543 pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE);
544 pf_anchor_remove(rule);
545 pf_empty_pool(&rule->rpool.list);
546 pool_put(&pf_rule_pl, rule);
547 }
548
549 static u_int16_t
550 tagname2tag(struct pf_tags *head, char *tagname)
551 {
552 struct pf_tagname *tag, *p = NULL;
553 u_int16_t new_tagid = 1;
554
555 TAILQ_FOREACH(tag, head, entries)
556 if (strcmp(tagname, tag->name) == 0) {
557 tag->ref++;
558 return (tag->tag);
559 }
560
561 /*
562 * to avoid fragmentation, we do a linear search from the beginning
563 * and take the first free slot we find. if there is none or the list
564 * is empty, append a new entry at the end.
565 */
566
567 /* new entry */
568 if (!TAILQ_EMPTY(head))
569 for (p = TAILQ_FIRST(head); p != NULL &&
570 p->tag == new_tagid; p = TAILQ_NEXT(p, entries))
571 new_tagid = p->tag + 1;
572
573 if (new_tagid > TAGID_MAX)
574 return (0);
575
576 /* allocate and fill new struct pf_tagname */
577 tag = _MALLOC(sizeof (*tag), M_TEMP, M_WAITOK|M_ZERO);
578 if (tag == NULL)
579 return (0);
580 strlcpy(tag->name, tagname, sizeof (tag->name));
581 tag->tag = new_tagid;
582 tag->ref++;
583
584 if (p != NULL) /* insert new entry before p */
585 TAILQ_INSERT_BEFORE(p, tag, entries);
586 else /* either list empty or no free slot in between */
587 TAILQ_INSERT_TAIL(head, tag, entries);
588
589 return (tag->tag);
590 }
591
592 static void
593 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p)
594 {
595 struct pf_tagname *tag;
596
597 TAILQ_FOREACH(tag, head, entries)
598 if (tag->tag == tagid) {
599 strlcpy(p, tag->name, PF_TAG_NAME_SIZE);
600 return;
601 }
602 }
603
604 static void
605 tag_unref(struct pf_tags *head, u_int16_t tag)
606 {
607 struct pf_tagname *p, *next;
608
609 if (tag == 0)
610 return;
611
612 for (p = TAILQ_FIRST(head); p != NULL; p = next) {
613 next = TAILQ_NEXT(p, entries);
614 if (tag == p->tag) {
615 if (--p->ref == 0) {
616 TAILQ_REMOVE(head, p, entries);
617 _FREE(p, M_TEMP);
618 }
619 break;
620 }
621 }
622 }
623
624 u_int16_t
625 pf_tagname2tag(char *tagname)
626 {
627 return (tagname2tag(&pf_tags, tagname));
628 }
629
630 void
631 pf_tag2tagname(u_int16_t tagid, char *p)
632 {
633 tag2tagname(&pf_tags, tagid, p);
634 }
635
636 void
637 pf_tag_ref(u_int16_t tag)
638 {
639 struct pf_tagname *t;
640
641 TAILQ_FOREACH(t, &pf_tags, entries)
642 if (t->tag == tag)
643 break;
644 if (t != NULL)
645 t->ref++;
646 }
647
648 void
649 pf_tag_unref(u_int16_t tag)
650 {
651 tag_unref(&pf_tags, tag);
652 }
653
654 static int
655 pf_rtlabel_add(struct pf_addr_wrap *a)
656 {
657 #pragma unused(a)
658 return (0);
659 }
660
661 static void
662 pf_rtlabel_remove(struct pf_addr_wrap *a)
663 {
664 #pragma unused(a)
665 }
666
667 static void
668 pf_rtlabel_copyout(struct pf_addr_wrap *a)
669 {
670 #pragma unused(a)
671 }
672
673 #if ALTQ
674 u_int32_t
675 pf_qname2qid(char *qname)
676 {
677 return ((u_int32_t)tagname2tag(&pf_qids, qname));
678 }
679
680 void
681 pf_qid2qname(u_int32_t qid, char *p)
682 {
683 tag2tagname(&pf_qids, (u_int16_t)qid, p);
684 }
685
686 void
687 pf_qid_unref(u_int32_t qid)
688 {
689 tag_unref(&pf_qids, (u_int16_t)qid);
690 }
691
692 static int
693 pf_begin_altq(u_int32_t *ticket)
694 {
695 struct pf_altq *altq;
696 int error = 0;
697
698 /* Purge the old altq list */
699 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
700 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
701 if (altq->qname[0] == 0) {
702 /* detach and destroy the discipline */
703 error = altq_remove(altq);
704 } else
705 pf_qid_unref(altq->qid);
706 pool_put(&pf_altq_pl, altq);
707 }
708 if (error)
709 return (error);
710 *ticket = ++ticket_altqs_inactive;
711 altqs_inactive_open = 1;
712 return (0);
713 }
714
715 static int
716 pf_rollback_altq(u_int32_t ticket)
717 {
718 struct pf_altq *altq;
719 int error = 0;
720
721 if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
722 return (0);
723 /* Purge the old altq list */
724 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
725 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
726 if (altq->qname[0] == 0) {
727 /* detach and destroy the discipline */
728 error = altq_remove(altq);
729 } else
730 pf_qid_unref(altq->qid);
731 pool_put(&pf_altq_pl, altq);
732 }
733 altqs_inactive_open = 0;
734 return (error);
735 }
736
737 static int
738 pf_commit_altq(u_int32_t ticket)
739 {
740 struct pf_altqqueue *old_altqs;
741 struct pf_altq *altq;
742 int s, err, error = 0;
743
744 if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
745 return (EBUSY);
746
747 /* swap altqs, keep the old. */
748 s = splnet();
749 old_altqs = pf_altqs_active;
750 pf_altqs_active = pf_altqs_inactive;
751 pf_altqs_inactive = old_altqs;
752 ticket_altqs_active = ticket_altqs_inactive;
753
754 /* Attach new disciplines */
755 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
756 if (altq->qname[0] == 0) {
757 /* attach the discipline */
758 error = altq_pfattach(altq);
759 if (error == 0 && pf_altq_running)
760 error = pf_enable_altq(altq);
761 if (error != 0) {
762 splx(s);
763 return (error);
764 }
765 }
766 }
767
768 /* Purge the old altq list */
769 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
770 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
771 if (altq->qname[0] == 0) {
772 /* detach and destroy the discipline */
773 if (pf_altq_running)
774 error = pf_disable_altq(altq);
775 err = altq_pfdetach(altq);
776 if (err != 0 && error == 0)
777 error = err;
778 err = altq_remove(altq);
779 if (err != 0 && error == 0)
780 error = err;
781 } else
782 pf_qid_unref(altq->qid);
783 pool_put(&pf_altq_pl, altq);
784 }
785 splx(s);
786
787 altqs_inactive_open = 0;
788 return (error);
789 }
790
791 static int
792 pf_enable_altq(struct pf_altq *altq)
793 {
794 struct ifnet *ifp;
795 struct tb_profile tb;
796 int s, error = 0;
797
798 if ((ifp = ifunit(altq->ifname)) == NULL)
799 return (EINVAL);
800
801 if (ifp->if_snd.altq_type != ALTQT_NONE)
802 error = altq_enable(&ifp->if_snd);
803
804 /* set tokenbucket regulator */
805 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
806 tb.rate = altq->ifbandwidth;
807 tb.depth = altq->tbrsize;
808 s = splnet();
809 error = tbr_set(&ifp->if_snd, &tb);
810 splx(s);
811 }
812
813 return (error);
814 }
815
816 static int
817 pf_disable_altq(struct pf_altq *altq)
818 {
819 struct ifnet *ifp;
820 struct tb_profile tb;
821 int s, error;
822
823 if ((ifp = ifunit(altq->ifname)) == NULL)
824 return (EINVAL);
825
826 /*
827 * when the discipline is no longer referenced, it was overridden
828 * by a new one. if so, just return.
829 */
830 if (altq->altq_disc != ifp->if_snd.altq_disc)
831 return (0);
832
833 error = altq_disable(&ifp->if_snd);
834
835 if (error == 0) {
836 /* clear tokenbucket regulator */
837 tb.rate = 0;
838 s = splnet();
839 error = tbr_set(&ifp->if_snd, &tb);
840 splx(s);
841 }
842
843 return (error);
844 }
845 #endif /* ALTQ */
846
847 static int
848 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
849 {
850 struct pf_ruleset *rs;
851 struct pf_rule *rule;
852
853 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
854 return (EINVAL);
855 rs = pf_find_or_create_ruleset(anchor);
856 if (rs == NULL)
857 return (EINVAL);
858 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
859 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
860 rs->rules[rs_num].inactive.rcount--;
861 }
862 *ticket = ++rs->rules[rs_num].inactive.ticket;
863 rs->rules[rs_num].inactive.open = 1;
864 return (0);
865 }
866
867 static int
868 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
869 {
870 struct pf_ruleset *rs;
871 struct pf_rule *rule;
872
873 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
874 return (EINVAL);
875 rs = pf_find_ruleset(anchor);
876 if (rs == NULL || !rs->rules[rs_num].inactive.open ||
877 rs->rules[rs_num].inactive.ticket != ticket)
878 return (0);
879 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
880 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
881 rs->rules[rs_num].inactive.rcount--;
882 }
883 rs->rules[rs_num].inactive.open = 0;
884 return (0);
885 }
886
887 #define PF_MD5_UPD(st, elm) \
888 MD5Update(ctx, (u_int8_t *)&(st)->elm, sizeof ((st)->elm))
889
890 #define PF_MD5_UPD_STR(st, elm) \
891 MD5Update(ctx, (u_int8_t *)(st)->elm, strlen((st)->elm))
892
893 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \
894 (stor) = htonl((st)->elm); \
895 MD5Update(ctx, (u_int8_t *)&(stor), sizeof (u_int32_t)); \
896 } while (0)
897
898 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \
899 (stor) = htons((st)->elm); \
900 MD5Update(ctx, (u_int8_t *)&(stor), sizeof (u_int16_t)); \
901 } while (0)
902
903 #ifndef NO_APPLE_EXTENSIONS
904 static void
905 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr, u_int8_t proto)
906 #else
907 static void
908 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
909 #endif
910 {
911 PF_MD5_UPD(pfr, addr.type);
912 switch (pfr->addr.type) {
913 case PF_ADDR_DYNIFTL:
914 PF_MD5_UPD(pfr, addr.v.ifname);
915 PF_MD5_UPD(pfr, addr.iflags);
916 break;
917 case PF_ADDR_TABLE:
918 PF_MD5_UPD(pfr, addr.v.tblname);
919 break;
920 case PF_ADDR_ADDRMASK:
921 /* XXX ignore af? */
922 PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
923 PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
924 break;
925 case PF_ADDR_RTLABEL:
926 PF_MD5_UPD(pfr, addr.v.rtlabelname);
927 break;
928 }
929
930 #ifndef NO_APPLE_EXTENSIONS
931 switch (proto) {
932 case IPPROTO_TCP:
933 case IPPROTO_UDP:
934 PF_MD5_UPD(pfr, xport.range.port[0]);
935 PF_MD5_UPD(pfr, xport.range.port[1]);
936 PF_MD5_UPD(pfr, xport.range.op);
937 break;
938
939 default:
940 break;
941 }
942
943 PF_MD5_UPD(pfr, neg);
944 #else
945 PF_MD5_UPD(pfr, port[0]);
946 PF_MD5_UPD(pfr, port[1]);
947 PF_MD5_UPD(pfr, neg);
948 PF_MD5_UPD(pfr, port_op);
949 #endif
950 }
951
952 static void
953 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule)
954 {
955 u_int16_t x;
956 u_int32_t y;
957
958 #ifndef NO_APPLE_EXTENSIONS
959 pf_hash_rule_addr(ctx, &rule->src, rule->proto);
960 pf_hash_rule_addr(ctx, &rule->dst, rule->proto);
961 #else
962 pf_hash_rule_addr(ctx, &rule->src);
963 pf_hash_rule_addr(ctx, &rule->dst);
964 #endif
965 PF_MD5_UPD_STR(rule, label);
966 PF_MD5_UPD_STR(rule, ifname);
967 PF_MD5_UPD_STR(rule, match_tagname);
968 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
969 PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
970 PF_MD5_UPD_HTONL(rule, prob, y);
971 PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
972 PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
973 PF_MD5_UPD(rule, uid.op);
974 PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
975 PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
976 PF_MD5_UPD(rule, gid.op);
977 PF_MD5_UPD_HTONL(rule, rule_flag, y);
978 PF_MD5_UPD(rule, action);
979 PF_MD5_UPD(rule, direction);
980 PF_MD5_UPD(rule, af);
981 PF_MD5_UPD(rule, quick);
982 PF_MD5_UPD(rule, ifnot);
983 PF_MD5_UPD(rule, match_tag_not);
984 PF_MD5_UPD(rule, natpass);
985 PF_MD5_UPD(rule, keep_state);
986 PF_MD5_UPD(rule, proto);
987 PF_MD5_UPD(rule, type);
988 PF_MD5_UPD(rule, code);
989 PF_MD5_UPD(rule, flags);
990 PF_MD5_UPD(rule, flagset);
991 PF_MD5_UPD(rule, allow_opts);
992 PF_MD5_UPD(rule, rt);
993 PF_MD5_UPD(rule, tos);
994 }
995
996 static int
997 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
998 {
999 struct pf_ruleset *rs;
1000 struct pf_rule *rule, **old_array;
1001 struct pf_rulequeue *old_rules;
1002 int error;
1003 u_int32_t old_rcount;
1004
1005 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1006
1007 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
1008 return (EINVAL);
1009 rs = pf_find_ruleset(anchor);
1010 if (rs == NULL || !rs->rules[rs_num].inactive.open ||
1011 ticket != rs->rules[rs_num].inactive.ticket)
1012 return (EBUSY);
1013
1014 /* Calculate checksum for the main ruleset */
1015 if (rs == &pf_main_ruleset) {
1016 error = pf_setup_pfsync_matching(rs);
1017 if (error != 0)
1018 return (error);
1019 }
1020
1021 /* Swap rules, keep the old. */
1022 old_rules = rs->rules[rs_num].active.ptr;
1023 old_rcount = rs->rules[rs_num].active.rcount;
1024 old_array = rs->rules[rs_num].active.ptr_array;
1025
1026 rs->rules[rs_num].active.ptr =
1027 rs->rules[rs_num].inactive.ptr;
1028 rs->rules[rs_num].active.ptr_array =
1029 rs->rules[rs_num].inactive.ptr_array;
1030 rs->rules[rs_num].active.rcount =
1031 rs->rules[rs_num].inactive.rcount;
1032 rs->rules[rs_num].inactive.ptr = old_rules;
1033 rs->rules[rs_num].inactive.ptr_array = old_array;
1034 rs->rules[rs_num].inactive.rcount = old_rcount;
1035
1036 rs->rules[rs_num].active.ticket =
1037 rs->rules[rs_num].inactive.ticket;
1038 pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
1039
1040
1041 /* Purge the old rule list. */
1042 while ((rule = TAILQ_FIRST(old_rules)) != NULL)
1043 pf_rm_rule(old_rules, rule);
1044 if (rs->rules[rs_num].inactive.ptr_array)
1045 _FREE(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
1046 rs->rules[rs_num].inactive.ptr_array = NULL;
1047 rs->rules[rs_num].inactive.rcount = 0;
1048 rs->rules[rs_num].inactive.open = 0;
1049 pf_remove_if_empty_ruleset(rs);
1050 return (0);
1051 }
1052
1053 static void
1054 pf_state_export(struct pfsync_state *sp, struct pf_state_key *sk,
1055 struct pf_state *s)
1056 {
1057 uint64_t secs = pf_time_second();
1058 bzero(sp, sizeof (struct pfsync_state));
1059
1060 /* copy from state key */
1061 #ifndef NO_APPLE_EXTENSIONS
1062 sp->lan.addr = sk->lan.addr;
1063 sp->lan.xport = sk->lan.xport;
1064 sp->gwy.addr = sk->gwy.addr;
1065 sp->gwy.xport = sk->gwy.xport;
1066 sp->ext.addr = sk->ext.addr;
1067 sp->ext.xport = sk->ext.xport;
1068 sp->proto_variant = sk->proto_variant;
1069 sp->tag = s->tag;
1070 #else
1071 sp->lan.addr = sk->lan.addr;
1072 sp->lan.port = sk->lan.port;
1073 sp->gwy.addr = sk->gwy.addr;
1074 sp->gwy.port = sk->gwy.port;
1075 sp->ext.addr = sk->ext.addr;
1076 sp->ext.port = sk->ext.port;
1077 #endif
1078 sp->proto = sk->proto;
1079 sp->af = sk->af;
1080 sp->direction = sk->direction;
1081
1082 /* copy from state */
1083 memcpy(&sp->id, &s->id, sizeof (sp->id));
1084 sp->creatorid = s->creatorid;
1085 strlcpy(sp->ifname, s->kif->pfik_name, sizeof (sp->ifname));
1086 pf_state_peer_to_pfsync(&s->src, &sp->src);
1087 pf_state_peer_to_pfsync(&s->dst, &sp->dst);
1088
1089 sp->rule = s->rule.ptr->nr;
1090 sp->nat_rule = (s->nat_rule.ptr == NULL) ?
1091 (unsigned)-1 : s->nat_rule.ptr->nr;
1092 sp->anchor = (s->anchor.ptr == NULL) ?
1093 (unsigned)-1 : s->anchor.ptr->nr;
1094
1095 pf_state_counter_to_pfsync(s->bytes[0], sp->bytes[0]);
1096 pf_state_counter_to_pfsync(s->bytes[1], sp->bytes[1]);
1097 pf_state_counter_to_pfsync(s->packets[0], sp->packets[0]);
1098 pf_state_counter_to_pfsync(s->packets[1], sp->packets[1]);
1099 sp->creation = secs - s->creation;
1100 sp->expire = pf_state_expires(s);
1101 sp->log = s->log;
1102 sp->allow_opts = s->allow_opts;
1103 sp->timeout = s->timeout;
1104
1105 if (s->src_node)
1106 sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
1107 if (s->nat_src_node)
1108 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
1109
1110 if (sp->expire > secs)
1111 sp->expire -= secs;
1112 else
1113 sp->expire = 0;
1114
1115 }
1116
1117 static void
1118 pf_state_import(struct pfsync_state *sp, struct pf_state_key *sk,
1119 struct pf_state *s)
1120 {
1121 /* copy to state key */
1122 #ifndef NO_APPLE_EXTENSIONS
1123 sk->lan.addr = sp->lan.addr;
1124 sk->lan.xport = sp->lan.xport;
1125 sk->gwy.addr = sp->gwy.addr;
1126 sk->gwy.xport = sp->gwy.xport;
1127 sk->ext.addr = sp->ext.addr;
1128 sk->ext.xport = sp->ext.xport;
1129 sk->proto_variant = sp->proto_variant;
1130 s->tag = sp->tag;
1131 #else
1132 sk->lan.addr = sp->lan.addr;
1133 sk->lan.port = sp->lan.port;
1134 sk->gwy.addr = sp->gwy.addr;
1135 sk->gwy.port = sp->gwy.port;
1136 sk->ext.addr = sp->ext.addr;
1137 sk->ext.port = sp->ext.port;
1138 #endif
1139 sk->proto = sp->proto;
1140 sk->af = sp->af;
1141 sk->direction = sp->direction;
1142
1143 /* copy to state */
1144 memcpy(&s->id, &sp->id, sizeof (sp->id));
1145 s->creatorid = sp->creatorid;
1146 pf_state_peer_from_pfsync(&sp->src, &s->src);
1147 pf_state_peer_from_pfsync(&sp->dst, &s->dst);
1148
1149 s->rule.ptr = &pf_default_rule;
1150 s->nat_rule.ptr = NULL;
1151 s->anchor.ptr = NULL;
1152 s->rt_kif = NULL;
1153 s->creation = pf_time_second();
1154 s->expire = pf_time_second();
1155 if (sp->expire > 0)
1156 s->expire -= pf_default_rule.timeout[sp->timeout] - sp->expire;
1157 s->pfsync_time = 0;
1158 s->packets[0] = s->packets[1] = 0;
1159 s->bytes[0] = s->bytes[1] = 0;
1160 }
1161
1162 static int
1163 pf_setup_pfsync_matching(struct pf_ruleset *rs)
1164 {
1165 MD5_CTX ctx;
1166 struct pf_rule *rule;
1167 int rs_cnt;
1168 u_int8_t digest[PF_MD5_DIGEST_LENGTH];
1169
1170 MD5Init(&ctx);
1171 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
1172 /* XXX PF_RULESET_SCRUB as well? */
1173 if (rs_cnt == PF_RULESET_SCRUB)
1174 continue;
1175
1176 if (rs->rules[rs_cnt].inactive.ptr_array)
1177 _FREE(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
1178 rs->rules[rs_cnt].inactive.ptr_array = NULL;
1179
1180 if (rs->rules[rs_cnt].inactive.rcount) {
1181 rs->rules[rs_cnt].inactive.ptr_array =
1182 _MALLOC(sizeof (caddr_t) *
1183 rs->rules[rs_cnt].inactive.rcount,
1184 M_TEMP, M_WAITOK);
1185
1186 if (!rs->rules[rs_cnt].inactive.ptr_array)
1187 return (ENOMEM);
1188 }
1189
1190 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
1191 entries) {
1192 pf_hash_rule(&ctx, rule);
1193 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
1194 }
1195 }
1196
1197 MD5Final(digest, &ctx);
1198 memcpy(pf_status.pf_chksum, digest, sizeof (pf_status.pf_chksum));
1199 return (0);
1200 }
1201
1202 static int
1203 pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
1204 {
1205 #pragma unused(dev)
1206 struct pf_pooladdr *pa = NULL;
1207 struct pf_pool *pool = NULL;
1208 int error = 0;
1209
1210 if (kauth_cred_issuser(kauth_cred_get()) == 0)
1211 return (EPERM);
1212
1213 /* XXX keep in sync with switch() below */
1214 if (securelevel > 1)
1215 switch (cmd) {
1216 case DIOCGETRULES:
1217 case DIOCGETRULE:
1218 case DIOCGETADDRS:
1219 case DIOCGETADDR:
1220 case DIOCGETSTATE:
1221 case DIOCSETSTATUSIF:
1222 case DIOCGETSTATUS:
1223 case DIOCCLRSTATUS:
1224 case DIOCNATLOOK:
1225 case DIOCSETDEBUG:
1226 case DIOCGETSTATES:
1227 case DIOCGETTIMEOUT:
1228 case DIOCCLRRULECTRS:
1229 case DIOCGETLIMIT:
1230 case DIOCGETALTQS:
1231 case DIOCGETALTQ:
1232 case DIOCGETQSTATS:
1233 case DIOCGETRULESETS:
1234 case DIOCGETRULESET:
1235 case DIOCRGETTABLES:
1236 case DIOCRGETTSTATS:
1237 case DIOCRCLRTSTATS:
1238 case DIOCRCLRADDRS:
1239 case DIOCRADDADDRS:
1240 case DIOCRDELADDRS:
1241 case DIOCRSETADDRS:
1242 case DIOCRGETADDRS:
1243 case DIOCRGETASTATS:
1244 case DIOCRCLRASTATS:
1245 case DIOCRTSTADDRS:
1246 case DIOCOSFPGET:
1247 case DIOCGETSRCNODES:
1248 case DIOCCLRSRCNODES:
1249 case DIOCIGETIFACES:
1250 case DIOCSETIFFLAG:
1251 case DIOCCLRIFFLAG:
1252 break;
1253 case DIOCRCLRTABLES:
1254 case DIOCRADDTABLES:
1255 case DIOCRDELTABLES:
1256 case DIOCRSETTFLAGS:
1257 if (((struct pfioc_table *)addr)->pfrio_flags &
1258 PFR_FLAG_DUMMY)
1259 break; /* dummy operation ok */
1260 return (EPERM);
1261 default:
1262 return (EPERM);
1263 }
1264
1265 if (!(flags & FWRITE))
1266 switch (cmd) {
1267 case DIOCSTART:
1268 case DIOCSTOP:
1269 case DIOCGETRULES:
1270 case DIOCGETADDRS:
1271 case DIOCGETADDR:
1272 case DIOCGETSTATE:
1273 case DIOCGETSTATUS:
1274 case DIOCGETSTATES:
1275 case DIOCGETTIMEOUT:
1276 case DIOCGETLIMIT:
1277 case DIOCGETALTQS:
1278 case DIOCGETALTQ:
1279 case DIOCGETQSTATS:
1280 case DIOCGETRULESETS:
1281 case DIOCGETRULESET:
1282 case DIOCNATLOOK:
1283 case DIOCRGETTABLES:
1284 case DIOCRGETTSTATS:
1285 case DIOCRGETADDRS:
1286 case DIOCRGETASTATS:
1287 case DIOCRTSTADDRS:
1288 case DIOCOSFPGET:
1289 case DIOCGETSRCNODES:
1290 case DIOCIGETIFACES:
1291 break;
1292 case DIOCRCLRTABLES:
1293 case DIOCRADDTABLES:
1294 case DIOCRDELTABLES:
1295 case DIOCRCLRTSTATS:
1296 case DIOCRCLRADDRS:
1297 case DIOCRADDADDRS:
1298 case DIOCRDELADDRS:
1299 case DIOCRSETADDRS:
1300 case DIOCRSETTFLAGS:
1301 if (((struct pfioc_table *)addr)->pfrio_flags &
1302 PFR_FLAG_DUMMY) {
1303 flags |= FWRITE; /* need write lock for dummy */
1304 break; /* dummy operation ok */
1305 }
1306 return (EACCES);
1307 case DIOCGETRULE:
1308 if (((struct pfioc_rule *)addr)->action ==
1309 PF_GET_CLR_CNTR)
1310 return (EACCES);
1311 break;
1312 default:
1313 return (EACCES);
1314 }
1315
1316 if (flags & FWRITE)
1317 lck_rw_lock_exclusive(pf_perim_lock);
1318 else
1319 lck_rw_lock_shared(pf_perim_lock);
1320
1321 lck_mtx_lock(pf_lock);
1322
1323 switch (cmd) {
1324
1325 case DIOCSTART:
1326 if (pf_status.running) {
1327 error = EEXIST;
1328 } else if (pf_purge_thread == NULL) {
1329 error = ENOMEM;
1330 } else {
1331 pf_status.running = 1;
1332 pf_status.since = pf_calendar_time_second();
1333 if (pf_status.stateid == 0) {
1334 pf_status.stateid = pf_time_second();
1335 pf_status.stateid = pf_status.stateid << 32;
1336 }
1337 mbuf_growth_aggressive();
1338 pf_attach_hooks();
1339 wakeup(pf_purge_thread_fn);
1340 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
1341 }
1342 break;
1343
1344 case DIOCSTOP:
1345 if (!pf_status.running) {
1346 error = ENOENT;
1347 } else {
1348 mbuf_growth_normal();
1349 pf_detach_hooks();
1350 pf_status.running = 0;
1351 pf_status.since = pf_calendar_time_second();
1352 wakeup(pf_purge_thread_fn);
1353 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
1354 }
1355 break;
1356
1357 case DIOCADDRULE: {
1358 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
1359 struct pf_ruleset *ruleset;
1360 struct pf_rule *rule, *tail;
1361 struct pf_pooladdr *apa;
1362 int rs_num;
1363
1364 pr->anchor[sizeof (pr->anchor) - 1] = 0;
1365 ruleset = pf_find_ruleset(pr->anchor);
1366 if (ruleset == NULL) {
1367 error = EINVAL;
1368 break;
1369 }
1370 rs_num = pf_get_ruleset_number(pr->rule.action);
1371 if (rs_num >= PF_RULESET_MAX) {
1372 error = EINVAL;
1373 break;
1374 }
1375 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1376 error = EINVAL;
1377 break;
1378 }
1379 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) {
1380 error = EBUSY;
1381 break;
1382 }
1383 if (pr->pool_ticket != ticket_pabuf) {
1384 error = EBUSY;
1385 break;
1386 }
1387 rule = pool_get(&pf_rule_pl, PR_WAITOK);
1388 if (rule == NULL) {
1389 error = ENOMEM;
1390 break;
1391 }
1392 bcopy(&pr->rule, rule, sizeof (struct pf_rule));
1393 rule->cuid = kauth_cred_getuid(p->p_ucred);
1394 rule->cpid = p->p_pid;
1395 rule->anchor = NULL;
1396 rule->kif = NULL;
1397 TAILQ_INIT(&rule->rpool.list);
1398 /* initialize refcounting */
1399 rule->states = 0;
1400 rule->src_nodes = 0;
1401 rule->entries.tqe_prev = NULL;
1402 #if !INET
1403 if (rule->af == AF_INET) {
1404 pool_put(&pf_rule_pl, rule);
1405 error = EAFNOSUPPORT;
1406 break;
1407 }
1408 #endif /* INET */
1409 #if !INET6
1410 if (rule->af == AF_INET6) {
1411 pool_put(&pf_rule_pl, rule);
1412 error = EAFNOSUPPORT;
1413 break;
1414 }
1415 #endif /* INET6 */
1416 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
1417 pf_rulequeue);
1418 if (tail)
1419 rule->nr = tail->nr + 1;
1420 else
1421 rule->nr = 0;
1422 if (rule->ifname[0]) {
1423 rule->kif = pfi_kif_get(rule->ifname);
1424 if (rule->kif == NULL) {
1425 pool_put(&pf_rule_pl, rule);
1426 error = EINVAL;
1427 break;
1428 }
1429 pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE);
1430 }
1431
1432 #if ALTQ
1433 /* set queue IDs */
1434 if (rule->qname[0] != 0) {
1435 if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
1436 error = EBUSY;
1437 else if (rule->pqname[0] != 0) {
1438 if ((rule->pqid =
1439 pf_qname2qid(rule->pqname)) == 0)
1440 error = EBUSY;
1441 } else
1442 rule->pqid = rule->qid;
1443 }
1444 #endif /* ALTQ */
1445 if (rule->tagname[0])
1446 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
1447 error = EBUSY;
1448 if (rule->match_tagname[0])
1449 if ((rule->match_tag =
1450 pf_tagname2tag(rule->match_tagname)) == 0)
1451 error = EBUSY;
1452 if (rule->rt && !rule->direction)
1453 error = EINVAL;
1454 #if PFLOG
1455 if (!rule->log)
1456 rule->logif = 0;
1457 if (rule->logif >= PFLOGIFS_MAX)
1458 error = EINVAL;
1459 #endif /* PFLOG */
1460 if (pf_rtlabel_add(&rule->src.addr) ||
1461 pf_rtlabel_add(&rule->dst.addr))
1462 error = EBUSY;
1463 if (pfi_dynaddr_setup(&rule->src.addr, rule->af))
1464 error = EINVAL;
1465 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af))
1466 error = EINVAL;
1467 if (pf_tbladdr_setup(ruleset, &rule->src.addr))
1468 error = EINVAL;
1469 if (pf_tbladdr_setup(ruleset, &rule->dst.addr))
1470 error = EINVAL;
1471 if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
1472 error = EINVAL;
1473 TAILQ_FOREACH(apa, &pf_pabuf, entries)
1474 if (pf_tbladdr_setup(ruleset, &apa->addr))
1475 error = EINVAL;
1476
1477 if (rule->overload_tblname[0]) {
1478 if ((rule->overload_tbl = pfr_attach_table(ruleset,
1479 rule->overload_tblname)) == NULL)
1480 error = EINVAL;
1481 else
1482 rule->overload_tbl->pfrkt_flags |=
1483 PFR_TFLAG_ACTIVE;
1484 }
1485
1486 pf_mv_pool(&pf_pabuf, &rule->rpool.list);
1487 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
1488 (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
1489 (rule->rt > PF_FASTROUTE)) &&
1490 (TAILQ_FIRST(&rule->rpool.list) == NULL))
1491 error = EINVAL;
1492
1493 if (error) {
1494 pf_rm_rule(NULL, rule);
1495 break;
1496 }
1497 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
1498 rule->evaluations = rule->packets[0] = rule->packets[1] =
1499 rule->bytes[0] = rule->bytes[1] = 0;
1500 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
1501 rule, entries);
1502 ruleset->rules[rs_num].inactive.rcount++;
1503 break;
1504 }
1505
1506 case DIOCGETRULES: {
1507 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
1508 struct pf_ruleset *ruleset;
1509 struct pf_rule *tail;
1510 int rs_num;
1511
1512 pr->anchor[sizeof (pr->anchor) - 1] = 0;
1513 ruleset = pf_find_ruleset(pr->anchor);
1514 if (ruleset == NULL) {
1515 error = EINVAL;
1516 break;
1517 }
1518 rs_num = pf_get_ruleset_number(pr->rule.action);
1519 if (rs_num >= PF_RULESET_MAX) {
1520 error = EINVAL;
1521 break;
1522 }
1523 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
1524 pf_rulequeue);
1525 if (tail)
1526 pr->nr = tail->nr + 1;
1527 else
1528 pr->nr = 0;
1529 pr->ticket = ruleset->rules[rs_num].active.ticket;
1530 break;
1531 }
1532
1533 case DIOCGETRULE: {
1534 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
1535 struct pf_ruleset *ruleset;
1536 struct pf_rule *rule;
1537 int rs_num, i;
1538
1539 pr->anchor[sizeof (pr->anchor) - 1] = 0;
1540 ruleset = pf_find_ruleset(pr->anchor);
1541 if (ruleset == NULL) {
1542 error = EINVAL;
1543 break;
1544 }
1545 rs_num = pf_get_ruleset_number(pr->rule.action);
1546 if (rs_num >= PF_RULESET_MAX) {
1547 error = EINVAL;
1548 break;
1549 }
1550 if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
1551 error = EBUSY;
1552 break;
1553 }
1554 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
1555 while ((rule != NULL) && (rule->nr != pr->nr))
1556 rule = TAILQ_NEXT(rule, entries);
1557 if (rule == NULL) {
1558 error = EBUSY;
1559 break;
1560 }
1561 bcopy(rule, &pr->rule, sizeof (struct pf_rule));
1562 if (pf_anchor_copyout(ruleset, rule, pr)) {
1563 error = EBUSY;
1564 break;
1565 }
1566 pfi_dynaddr_copyout(&pr->rule.src.addr);
1567 pfi_dynaddr_copyout(&pr->rule.dst.addr);
1568 pf_tbladdr_copyout(&pr->rule.src.addr);
1569 pf_tbladdr_copyout(&pr->rule.dst.addr);
1570 pf_rtlabel_copyout(&pr->rule.src.addr);
1571 pf_rtlabel_copyout(&pr->rule.dst.addr);
1572 for (i = 0; i < PF_SKIP_COUNT; ++i)
1573 if (rule->skip[i].ptr == NULL)
1574 pr->rule.skip[i].nr = -1;
1575 else
1576 pr->rule.skip[i].nr =
1577 rule->skip[i].ptr->nr;
1578
1579 if (pr->action == PF_GET_CLR_CNTR) {
1580 rule->evaluations = 0;
1581 rule->packets[0] = rule->packets[1] = 0;
1582 rule->bytes[0] = rule->bytes[1] = 0;
1583 }
1584 break;
1585 }
1586
1587 case DIOCCHANGERULE: {
1588 struct pfioc_rule *pcr = (struct pfioc_rule *)addr;
1589 struct pf_ruleset *ruleset;
1590 struct pf_rule *oldrule = NULL, *newrule = NULL;
1591 u_int32_t nr = 0;
1592 int rs_num;
1593
1594 if (!(pcr->action == PF_CHANGE_REMOVE ||
1595 pcr->action == PF_CHANGE_GET_TICKET) &&
1596 pcr->pool_ticket != ticket_pabuf) {
1597 error = EBUSY;
1598 break;
1599 }
1600
1601 if (pcr->action < PF_CHANGE_ADD_HEAD ||
1602 pcr->action > PF_CHANGE_GET_TICKET) {
1603 error = EINVAL;
1604 break;
1605 }
1606 ruleset = pf_find_ruleset(pcr->anchor);
1607 if (ruleset == NULL) {
1608 error = EINVAL;
1609 break;
1610 }
1611 rs_num = pf_get_ruleset_number(pcr->rule.action);
1612 if (rs_num >= PF_RULESET_MAX) {
1613 error = EINVAL;
1614 break;
1615 }
1616
1617 if (pcr->action == PF_CHANGE_GET_TICKET) {
1618 pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
1619 break;
1620 } else {
1621 if (pcr->ticket !=
1622 ruleset->rules[rs_num].active.ticket) {
1623 error = EINVAL;
1624 break;
1625 }
1626 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1627 error = EINVAL;
1628 break;
1629 }
1630 }
1631
1632 if (pcr->action != PF_CHANGE_REMOVE) {
1633 newrule = pool_get(&pf_rule_pl, PR_WAITOK);
1634 if (newrule == NULL) {
1635 error = ENOMEM;
1636 break;
1637 }
1638 bcopy(&pcr->rule, newrule, sizeof (struct pf_rule));
1639 newrule->cuid = kauth_cred_getuid(p->p_ucred);
1640 newrule->cpid = p->p_pid;
1641 TAILQ_INIT(&newrule->rpool.list);
1642 /* initialize refcounting */
1643 newrule->states = 0;
1644 newrule->entries.tqe_prev = NULL;
1645 #if !INET
1646 if (newrule->af == AF_INET) {
1647 pool_put(&pf_rule_pl, newrule);
1648 error = EAFNOSUPPORT;
1649 break;
1650 }
1651 #endif /* INET */
1652 #if !INET6
1653 if (newrule->af == AF_INET6) {
1654 pool_put(&pf_rule_pl, newrule);
1655 error = EAFNOSUPPORT;
1656 break;
1657 }
1658 #endif /* INET6 */
1659 if (newrule->ifname[0]) {
1660 newrule->kif = pfi_kif_get(newrule->ifname);
1661 if (newrule->kif == NULL) {
1662 pool_put(&pf_rule_pl, newrule);
1663 error = EINVAL;
1664 break;
1665 }
1666 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE);
1667 } else
1668 newrule->kif = NULL;
1669
1670 #if ALTQ
1671 /* set queue IDs */
1672 if (newrule->qname[0] != 0) {
1673 if ((newrule->qid =
1674 pf_qname2qid(newrule->qname)) == 0)
1675 error = EBUSY;
1676 else if (newrule->pqname[0] != 0) {
1677 if ((newrule->pqid =
1678 pf_qname2qid(newrule->pqname)) == 0)
1679 error = EBUSY;
1680 } else
1681 newrule->pqid = newrule->qid;
1682 }
1683 #endif /* ALTQ */
1684 if (newrule->tagname[0])
1685 if ((newrule->tag =
1686 pf_tagname2tag(newrule->tagname)) == 0)
1687 error = EBUSY;
1688 if (newrule->match_tagname[0])
1689 if ((newrule->match_tag = pf_tagname2tag(
1690 newrule->match_tagname)) == 0)
1691 error = EBUSY;
1692 if (newrule->rt && !newrule->direction)
1693 error = EINVAL;
1694 #if PFLOG
1695 if (!newrule->log)
1696 newrule->logif = 0;
1697 if (newrule->logif >= PFLOGIFS_MAX)
1698 error = EINVAL;
1699 #endif /* PFLOG */
1700 if (pf_rtlabel_add(&newrule->src.addr) ||
1701 pf_rtlabel_add(&newrule->dst.addr))
1702 error = EBUSY;
1703 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af))
1704 error = EINVAL;
1705 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af))
1706 error = EINVAL;
1707 if (pf_tbladdr_setup(ruleset, &newrule->src.addr))
1708 error = EINVAL;
1709 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr))
1710 error = EINVAL;
1711 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
1712 error = EINVAL;
1713 TAILQ_FOREACH(pa, &pf_pabuf, entries)
1714 if (pf_tbladdr_setup(ruleset, &pa->addr))
1715 error = EINVAL;
1716
1717 if (newrule->overload_tblname[0]) {
1718 if ((newrule->overload_tbl = pfr_attach_table(
1719 ruleset, newrule->overload_tblname)) ==
1720 NULL)
1721 error = EINVAL;
1722 else
1723 newrule->overload_tbl->pfrkt_flags |=
1724 PFR_TFLAG_ACTIVE;
1725 }
1726
1727 pf_mv_pool(&pf_pabuf, &newrule->rpool.list);
1728 if (((((newrule->action == PF_NAT) ||
1729 (newrule->action == PF_RDR) ||
1730 (newrule->action == PF_BINAT) ||
1731 (newrule->rt > PF_FASTROUTE)) &&
1732 !newrule->anchor)) &&
1733 (TAILQ_FIRST(&newrule->rpool.list) == NULL))
1734 error = EINVAL;
1735
1736 if (error) {
1737 pf_rm_rule(NULL, newrule);
1738 break;
1739 }
1740 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
1741 newrule->evaluations = 0;
1742 newrule->packets[0] = newrule->packets[1] = 0;
1743 newrule->bytes[0] = newrule->bytes[1] = 0;
1744 }
1745 pf_empty_pool(&pf_pabuf);
1746
1747 if (pcr->action == PF_CHANGE_ADD_HEAD)
1748 oldrule = TAILQ_FIRST(
1749 ruleset->rules[rs_num].active.ptr);
1750 else if (pcr->action == PF_CHANGE_ADD_TAIL)
1751 oldrule = TAILQ_LAST(
1752 ruleset->rules[rs_num].active.ptr, pf_rulequeue);
1753 else {
1754 oldrule = TAILQ_FIRST(
1755 ruleset->rules[rs_num].active.ptr);
1756 while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
1757 oldrule = TAILQ_NEXT(oldrule, entries);
1758 if (oldrule == NULL) {
1759 if (newrule != NULL)
1760 pf_rm_rule(NULL, newrule);
1761 error = EINVAL;
1762 break;
1763 }
1764 }
1765
1766 if (pcr->action == PF_CHANGE_REMOVE) {
1767 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule);
1768 ruleset->rules[rs_num].active.rcount--;
1769 } else {
1770 if (oldrule == NULL)
1771 TAILQ_INSERT_TAIL(
1772 ruleset->rules[rs_num].active.ptr,
1773 newrule, entries);
1774 else if (pcr->action == PF_CHANGE_ADD_HEAD ||
1775 pcr->action == PF_CHANGE_ADD_BEFORE)
1776 TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
1777 else
1778 TAILQ_INSERT_AFTER(
1779 ruleset->rules[rs_num].active.ptr,
1780 oldrule, newrule, entries);
1781 ruleset->rules[rs_num].active.rcount++;
1782 }
1783
1784 nr = 0;
1785 TAILQ_FOREACH(oldrule,
1786 ruleset->rules[rs_num].active.ptr, entries)
1787 oldrule->nr = nr++;
1788
1789 ruleset->rules[rs_num].active.ticket++;
1790
1791 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
1792 pf_remove_if_empty_ruleset(ruleset);
1793
1794 break;
1795 }
1796
1797 case DIOCCLRSTATES: {
1798 struct pf_state *s, *nexts;
1799 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1800 int killed = 0;
1801
1802 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) {
1803 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1804
1805 if (!psk->psk_ifname[0] || strcmp(psk->psk_ifname,
1806 s->kif->pfik_name) == 0) {
1807 #if NPFSYNC
1808 /* don't send out individual delete messages */
1809 s->sync_flags = PFSTATE_NOSYNC;
1810 #endif
1811 pf_unlink_state(s);
1812 killed++;
1813 }
1814 }
1815 psk->psk_af = killed;
1816 #if NPFSYNC
1817 pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
1818 #endif
1819 break;
1820 }
1821
1822 case DIOCKILLSTATES: {
1823 struct pf_state *s, *nexts;
1824 struct pf_state_key *sk;
1825 struct pf_state_host *src, *dst;
1826 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1827 int killed = 0;
1828
1829 for (s = RB_MIN(pf_state_tree_id, &tree_id); s;
1830 s = nexts) {
1831 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1832 sk = s->state_key;
1833
1834 if (sk->direction == PF_OUT) {
1835 src = &sk->lan;
1836 dst = &sk->ext;
1837 } else {
1838 src = &sk->ext;
1839 dst = &sk->lan;
1840 }
1841 if ((!psk->psk_af || sk->af == psk->psk_af) &&
1842 (!psk->psk_proto || psk->psk_proto == sk->proto) &&
1843 PF_MATCHA(psk->psk_src.neg,
1844 &psk->psk_src.addr.v.a.addr,
1845 &psk->psk_src.addr.v.a.mask,
1846 &src->addr, sk->af) &&
1847 PF_MATCHA(psk->psk_dst.neg,
1848 &psk->psk_dst.addr.v.a.addr,
1849 &psk->psk_dst.addr.v.a.mask,
1850 &dst->addr, sk->af) &&
1851 #ifndef NO_APPLE_EXTENSIONS
1852 (pf_match_xport(psk->psk_proto,
1853 psk->psk_proto_variant, &psk->psk_src.xport,
1854 &src->xport)) &&
1855 (pf_match_xport(psk->psk_proto,
1856 psk->psk_proto_variant, &psk->psk_dst.xport,
1857 &dst->xport)) &&
1858 #else
1859 (psk->psk_src.port_op == 0 ||
1860 pf_match_port(psk->psk_src.port_op,
1861 psk->psk_src.port[0], psk->psk_src.port[1],
1862 src->port)) &&
1863 (psk->psk_dst.port_op == 0 ||
1864 pf_match_port(psk->psk_dst.port_op,
1865 psk->psk_dst.port[0], psk->psk_dst.port[1],
1866 dst->port)) &&
1867 #endif
1868 (!psk->psk_ifname[0] || strcmp(psk->psk_ifname,
1869 s->kif->pfik_name) == 0)) {
1870 #if NPFSYNC
1871 /* send immediate delete of state */
1872 pfsync_delete_state(s);
1873 s->sync_flags |= PFSTATE_NOSYNC;
1874 #endif
1875 pf_unlink_state(s);
1876 killed++;
1877 }
1878 }
1879 psk->psk_af = killed;
1880 break;
1881 }
1882
1883 case DIOCADDSTATE: {
1884 struct pfioc_state *ps = (struct pfioc_state *)addr;
1885 struct pfsync_state *sp = &ps->state;
1886 struct pf_state *s;
1887 struct pf_state_key *sk;
1888 struct pfi_kif *kif;
1889
1890 if (sp->timeout >= PFTM_MAX &&
1891 sp->timeout != PFTM_UNTIL_PACKET) {
1892 error = EINVAL;
1893 break;
1894 }
1895 s = pool_get(&pf_state_pl, PR_WAITOK);
1896 if (s == NULL) {
1897 error = ENOMEM;
1898 break;
1899 }
1900 bzero(s, sizeof (struct pf_state));
1901 if ((sk = pf_alloc_state_key(s)) == NULL) {
1902 pool_put(&pf_state_pl, s);
1903 error = ENOMEM;
1904 break;
1905 }
1906 pf_state_import(sp, sk, s);
1907 kif = pfi_kif_get(sp->ifname);
1908 if (kif == NULL) {
1909 pool_put(&pf_state_pl, s);
1910 pool_put(&pf_state_key_pl, sk);
1911 error = ENOENT;
1912 break;
1913 }
1914 #ifndef NO_APPLE_EXTENSIONS
1915 TAILQ_INIT(&s->unlink_hooks);
1916 s->state_key->app_state = 0;
1917 #endif
1918 if (pf_insert_state(kif, s)) {
1919 pfi_kif_unref(kif, PFI_KIF_REF_NONE);
1920 pool_put(&pf_state_pl, s);
1921 error = EEXIST;
1922 break;
1923 }
1924 pf_default_rule.states++;
1925 VERIFY(pf_default_rule.states != 0);
1926 break;
1927 }
1928
1929 case DIOCGETSTATE: {
1930 struct pfioc_state *ps = (struct pfioc_state *)addr;
1931 struct pf_state *s;
1932 struct pf_state_cmp id_key;
1933
1934 bcopy(ps->state.id, &id_key.id, sizeof (id_key.id));
1935 id_key.creatorid = ps->state.creatorid;
1936
1937 s = pf_find_state_byid(&id_key);
1938 if (s == NULL) {
1939 error = ENOENT;
1940 break;
1941 }
1942
1943 pf_state_export(&ps->state, s->state_key, s);
1944 break;
1945 }
1946
1947 case DIOCGETSTATES: {
1948 struct pfioc_states *ps = (struct pfioc_states *)addr;
1949 struct pf_state *state;
1950 struct pfsync_state *y, *pstore;
1951 u_int32_t nr = 0;
1952
1953 if (ps->ps_len == 0) {
1954 nr = pf_status.states;
1955 ps->ps_len = sizeof (struct pfsync_state) * nr;
1956 break;
1957 }
1958
1959 pstore = _MALLOC(sizeof (*pstore), M_TEMP, M_WAITOK);
1960
1961 y = ps->ps_states;
1962
1963 state = TAILQ_FIRST(&state_list);
1964 while (state) {
1965 if (state->timeout != PFTM_UNLINKED) {
1966 if ((nr+1) * sizeof (*y) > (unsigned)ps->ps_len)
1967 break;
1968
1969 pf_state_export(pstore,
1970 state->state_key, state);
1971 error = copyout(pstore, CAST_USER_ADDR_T(y),
1972 sizeof (*y));
1973 if (error) {
1974 _FREE(pstore, M_TEMP);
1975 goto fail;
1976 }
1977 y++;
1978 nr++;
1979 }
1980 state = TAILQ_NEXT(state, entry_list);
1981 }
1982
1983 ps->ps_len = sizeof (struct pfsync_state) * nr;
1984
1985 _FREE(pstore, M_TEMP);
1986 break;
1987 }
1988
1989 case DIOCGETSTATUS: {
1990 struct pf_status *s = (struct pf_status *)addr;
1991 bcopy(&pf_status, s, sizeof (struct pf_status));
1992 pfi_update_status(s->ifname, s);
1993 break;
1994 }
1995
1996 case DIOCSETSTATUSIF: {
1997 struct pfioc_if *pi = (struct pfioc_if *)addr;
1998
1999 if (pi->ifname[0] == 0) {
2000 bzero(pf_status.ifname, IFNAMSIZ);
2001 break;
2002 }
2003 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ);
2004 break;
2005 }
2006
2007 case DIOCCLRSTATUS: {
2008 bzero(pf_status.counters, sizeof (pf_status.counters));
2009 bzero(pf_status.fcounters, sizeof (pf_status.fcounters));
2010 bzero(pf_status.scounters, sizeof (pf_status.scounters));
2011 pf_status.since = pf_calendar_time_second();
2012 if (*pf_status.ifname)
2013 pfi_update_status(pf_status.ifname, NULL);
2014 break;
2015 }
2016
2017 case DIOCNATLOOK: {
2018 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr;
2019 struct pf_state_key *sk;
2020 struct pf_state *state;
2021 struct pf_state_key_cmp key;
2022 int m = 0, direction = pnl->direction;
2023
2024 key.af = pnl->af;
2025 key.proto = pnl->proto;
2026
2027 #ifndef NO_APPLE_EXTENSIONS
2028 key.proto_variant = pnl->proto_variant;
2029 #endif
2030
2031 if (!pnl->proto ||
2032 PF_AZERO(&pnl->saddr, pnl->af) ||
2033 PF_AZERO(&pnl->daddr, pnl->af) ||
2034 ((pnl->proto == IPPROTO_TCP ||
2035 pnl->proto == IPPROTO_UDP) &&
2036 #ifndef NO_APPLE_EXTENSIONS
2037 (!pnl->dxport.port || !pnl->sxport.port)))
2038 #else
2039 (!pnl->dport || !pnl->sport)))
2040 #endif
2041 error = EINVAL;
2042 else {
2043 /*
2044 * userland gives us source and dest of connection,
2045 * reverse the lookup so we ask for what happens with
2046 * the return traffic, enabling us to find it in the
2047 * state tree.
2048 */
2049 if (direction == PF_IN) {
2050 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af);
2051 #ifndef NO_APPLE_EXTENSIONS
2052 memcpy(&key.ext.xport, &pnl->dxport,
2053 sizeof (key.ext.xport));
2054 #else
2055 key.ext.port = pnl->dport;
2056 #endif
2057 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af);
2058 #ifndef NO_APPLE_EXTENSIONS
2059 memcpy(&key.gwy.xport, &pnl->sxport,
2060 sizeof (key.gwy.xport));
2061 #else
2062 key.gwy.port = pnl->sport;
2063 #endif
2064 state = pf_find_state_all(&key, PF_IN, &m);
2065 } else {
2066 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af);
2067 #ifndef NO_APPLE_EXTENSIONS
2068 memcpy(&key.lan.xport, &pnl->dxport,
2069 sizeof (key.lan.xport));
2070 #else
2071 key.lan.port = pnl->dport;
2072 #endif
2073 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af);
2074 #ifndef NO_APPLE_EXTENSIONS
2075 memcpy(&key.ext.xport, &pnl->sxport,
2076 sizeof (key.ext.xport));
2077 #else
2078 key.ext.port = pnl->sport;
2079 #endif
2080 state = pf_find_state_all(&key, PF_OUT, &m);
2081 }
2082 if (m > 1)
2083 error = E2BIG; /* more than one state */
2084 else if (state != NULL) {
2085 sk = state->state_key;
2086 if (direction == PF_IN) {
2087 PF_ACPY(&pnl->rsaddr, &sk->lan.addr,
2088 sk->af);
2089 #ifndef NO_APPLE_EXTENSIONS
2090 memcpy(&pnl->rsxport, &sk->lan.xport,
2091 sizeof (pnl->rsxport));
2092 #else
2093 pnl->rsport = sk->lan.port;
2094 #endif
2095 PF_ACPY(&pnl->rdaddr, &pnl->daddr,
2096 pnl->af);
2097 #ifndef NO_APPLE_EXTENSIONS
2098 memcpy(&pnl->rdxport, &pnl->dxport,
2099 sizeof (pnl->rdxport));
2100 #else
2101 pnl->rdport = pnl->dport;
2102 #endif
2103 } else {
2104 PF_ACPY(&pnl->rdaddr, &sk->gwy.addr,
2105 sk->af);
2106 #ifndef NO_APPLE_EXTENSIONS
2107 memcpy(&pnl->rdxport, &sk->gwy.xport,
2108 sizeof (pnl->rdxport));
2109 #else
2110 pnl->rdport = sk->gwy.port;
2111 #endif
2112 PF_ACPY(&pnl->rsaddr, &pnl->saddr,
2113 pnl->af);
2114 #ifndef NO_APPLE_EXTENSIONS
2115 memcpy(&pnl->rsxport, &pnl->sxport,
2116 sizeof (pnl->rsxport));
2117 #else
2118 pnl->rsport = pnl->sport;
2119 #endif
2120 }
2121 } else
2122 error = ENOENT;
2123 }
2124 break;
2125 }
2126
2127 case DIOCSETTIMEOUT: {
2128 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
2129 int old;
2130
2131 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
2132 pt->seconds < 0) {
2133 error = EINVAL;
2134 goto fail;
2135 }
2136 old = pf_default_rule.timeout[pt->timeout];
2137 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
2138 pt->seconds = 1;
2139 pf_default_rule.timeout[pt->timeout] = pt->seconds;
2140 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
2141 wakeup(pf_purge_thread_fn);
2142 pt->seconds = old;
2143 break;
2144 }
2145
2146 case DIOCGETTIMEOUT: {
2147 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
2148
2149 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
2150 error = EINVAL;
2151 goto fail;
2152 }
2153 pt->seconds = pf_default_rule.timeout[pt->timeout];
2154 break;
2155 }
2156
2157 case DIOCGETLIMIT: {
2158 struct pfioc_limit *pl = (struct pfioc_limit *)addr;
2159
2160 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
2161 error = EINVAL;
2162 goto fail;
2163 }
2164 pl->limit = pf_pool_limits[pl->index].limit;
2165 break;
2166 }
2167
2168 case DIOCSETLIMIT: {
2169 struct pfioc_limit *pl = (struct pfioc_limit *)addr;
2170 int old_limit;
2171
2172 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
2173 pf_pool_limits[pl->index].pp == NULL) {
2174 error = EINVAL;
2175 goto fail;
2176 }
2177 pool_sethardlimit(pf_pool_limits[pl->index].pp,
2178 pl->limit, NULL, 0);
2179 old_limit = pf_pool_limits[pl->index].limit;
2180 pf_pool_limits[pl->index].limit = pl->limit;
2181 pl->limit = old_limit;
2182 break;
2183 }
2184
2185 case DIOCSETDEBUG: {
2186 u_int32_t *level = (u_int32_t *)addr;
2187
2188 pf_status.debug = *level;
2189 break;
2190 }
2191
2192 case DIOCCLRRULECTRS: {
2193 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
2194 struct pf_ruleset *ruleset = &pf_main_ruleset;
2195 struct pf_rule *rule;
2196
2197 TAILQ_FOREACH(rule,
2198 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
2199 rule->evaluations = 0;
2200 rule->packets[0] = rule->packets[1] = 0;
2201 rule->bytes[0] = rule->bytes[1] = 0;
2202 }
2203 break;
2204 }
2205
2206 #if ALTQ
2207 case DIOCSTARTALTQ: {
2208 struct pf_altq *altq;
2209
2210 /* enable all altq interfaces on active list */
2211 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
2212 if (altq->qname[0] == 0) {
2213 error = pf_enable_altq(altq);
2214 if (error != 0)
2215 break;
2216 }
2217 }
2218 if (error == 0)
2219 pf_altq_running = 1;
2220 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
2221 break;
2222 }
2223
2224 case DIOCSTOPALTQ: {
2225 struct pf_altq *altq;
2226
2227 /* disable all altq interfaces on active list */
2228 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
2229 if (altq->qname[0] == 0) {
2230 error = pf_disable_altq(altq);
2231 if (error != 0)
2232 break;
2233 }
2234 }
2235 if (error == 0)
2236 pf_altq_running = 0;
2237 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
2238 break;
2239 }
2240
2241 case DIOCADDALTQ: {
2242 struct pfioc_altq *pa = (struct pfioc_altq *)addr;
2243 struct pf_altq *altq, *a;
2244
2245 if (pa->ticket != ticket_altqs_inactive) {
2246 error = EBUSY;
2247 break;
2248 }
2249 altq = pool_get(&pf_altq_pl, PR_WAITOK);
2250 if (altq == NULL) {
2251 error = ENOMEM;
2252 break;
2253 }
2254 bcopy(&pa->altq, altq, sizeof (struct pf_altq));
2255
2256 /*
2257 * if this is for a queue, find the discipline and
2258 * copy the necessary fields
2259 */
2260 if (altq->qname[0] != 0) {
2261 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
2262 error = EBUSY;
2263 pool_put(&pf_altq_pl, altq);
2264 break;
2265 }
2266 altq->altq_disc = NULL;
2267 TAILQ_FOREACH(a, pf_altqs_inactive, entries) {
2268 if (strncmp(a->ifname, altq->ifname,
2269 IFNAMSIZ) == 0 && a->qname[0] == 0) {
2270 altq->altq_disc = a->altq_disc;
2271 break;
2272 }
2273 }
2274 }
2275
2276 error = altq_add(altq);
2277 if (error) {
2278 pool_put(&pf_altq_pl, altq);
2279 break;
2280 }
2281
2282 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries);
2283 bcopy(altq, &pa->altq, sizeof (struct pf_altq));
2284 break;
2285 }
2286
2287 case DIOCGETALTQS: {
2288 struct pfioc_altq *pa = (struct pfioc_altq *)addr;
2289 struct pf_altq *altq;
2290
2291 pa->nr = 0;
2292 TAILQ_FOREACH(altq, pf_altqs_active, entries)
2293 pa->nr++;
2294 pa->ticket = ticket_altqs_active;
2295 break;
2296 }
2297
2298 case DIOCGETALTQ: {
2299 struct pfioc_altq *pa = (struct pfioc_altq *)addr;
2300 struct pf_altq *altq;
2301 u_int32_t nr;
2302
2303 if (pa->ticket != ticket_altqs_active) {
2304 error = EBUSY;
2305 break;
2306 }
2307 nr = 0;
2308 altq = TAILQ_FIRST(pf_altqs_active);
2309 while ((altq != NULL) && (nr < pa->nr)) {
2310 altq = TAILQ_NEXT(altq, entries);
2311 nr++;
2312 }
2313 if (altq == NULL) {
2314 error = EBUSY;
2315 break;
2316 }
2317 bcopy(altq, &pa->altq, sizeof (struct pf_altq));
2318 break;
2319 }
2320
2321 case DIOCCHANGEALTQ:
2322 /* CHANGEALTQ not supported yet! */
2323 error = ENODEV;
2324 break;
2325
2326 case DIOCGETQSTATS: {
2327 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr;
2328 struct pf_altq *altq;
2329 u_int32_t nr;
2330 int nbytes;
2331
2332 if (pq->ticket != ticket_altqs_active) {
2333 error = EBUSY;
2334 break;
2335 }
2336 nbytes = pq->nbytes;
2337 nr = 0;
2338 altq = TAILQ_FIRST(pf_altqs_active);
2339 while ((altq != NULL) && (nr < pq->nr)) {
2340 altq = TAILQ_NEXT(altq, entries);
2341 nr++;
2342 }
2343 if (altq == NULL) {
2344 error = EBUSY;
2345 break;
2346 }
2347 error = altq_getqstats(altq, pq->buf, &nbytes);
2348 if (error == 0) {
2349 pq->scheduler = altq->scheduler;
2350 pq->nbytes = nbytes;
2351 }
2352 break;
2353 }
2354 #endif /* ALTQ */
2355
2356 case DIOCBEGINADDRS: {
2357 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2358
2359 pf_empty_pool(&pf_pabuf);
2360 pp->ticket = ++ticket_pabuf;
2361 break;
2362 }
2363
2364 case DIOCADDADDR: {
2365 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2366
2367 if (pp->ticket != ticket_pabuf) {
2368 error = EBUSY;
2369 break;
2370 }
2371 #if !INET
2372 if (pp->af == AF_INET) {
2373 error = EAFNOSUPPORT;
2374 break;
2375 }
2376 #endif /* INET */
2377 #if !INET6
2378 if (pp->af == AF_INET6) {
2379 error = EAFNOSUPPORT;
2380 break;
2381 }
2382 #endif /* INET6 */
2383 if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
2384 pp->addr.addr.type != PF_ADDR_DYNIFTL &&
2385 pp->addr.addr.type != PF_ADDR_TABLE) {
2386 error = EINVAL;
2387 break;
2388 }
2389 pa = pool_get(&pf_pooladdr_pl, PR_WAITOK);
2390 if (pa == NULL) {
2391 error = ENOMEM;
2392 break;
2393 }
2394 bcopy(&pp->addr, pa, sizeof (struct pf_pooladdr));
2395 if (pa->ifname[0]) {
2396 pa->kif = pfi_kif_get(pa->ifname);
2397 if (pa->kif == NULL) {
2398 pool_put(&pf_pooladdr_pl, pa);
2399 error = EINVAL;
2400 break;
2401 }
2402 pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE);
2403 }
2404 if (pfi_dynaddr_setup(&pa->addr, pp->af)) {
2405 pfi_dynaddr_remove(&pa->addr);
2406 pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE);
2407 pool_put(&pf_pooladdr_pl, pa);
2408 error = EINVAL;
2409 break;
2410 }
2411 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries);
2412 break;
2413 }
2414
2415 case DIOCGETADDRS: {
2416 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2417
2418 pp->nr = 0;
2419 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2420 pp->r_num, 0, 1, 0);
2421 if (pool == NULL) {
2422 error = EBUSY;
2423 break;
2424 }
2425 TAILQ_FOREACH(pa, &pool->list, entries)
2426 pp->nr++;
2427 break;
2428 }
2429
2430 case DIOCGETADDR: {
2431 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2432 u_int32_t nr = 0;
2433
2434 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2435 pp->r_num, 0, 1, 1);
2436 if (pool == NULL) {
2437 error = EBUSY;
2438 break;
2439 }
2440 pa = TAILQ_FIRST(&pool->list);
2441 while ((pa != NULL) && (nr < pp->nr)) {
2442 pa = TAILQ_NEXT(pa, entries);
2443 nr++;
2444 }
2445 if (pa == NULL) {
2446 error = EBUSY;
2447 break;
2448 }
2449 bcopy(pa, &pp->addr, sizeof (struct pf_pooladdr));
2450 pfi_dynaddr_copyout(&pp->addr.addr);
2451 pf_tbladdr_copyout(&pp->addr.addr);
2452 pf_rtlabel_copyout(&pp->addr.addr);
2453 break;
2454 }
2455
2456 case DIOCCHANGEADDR: {
2457 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr;
2458 struct pf_pooladdr *oldpa = NULL, *newpa = NULL;
2459 struct pf_ruleset *ruleset;
2460
2461 if (pca->action < PF_CHANGE_ADD_HEAD ||
2462 pca->action > PF_CHANGE_REMOVE) {
2463 error = EINVAL;
2464 break;
2465 }
2466 if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
2467 pca->addr.addr.type != PF_ADDR_DYNIFTL &&
2468 pca->addr.addr.type != PF_ADDR_TABLE) {
2469 error = EINVAL;
2470 break;
2471 }
2472
2473 ruleset = pf_find_ruleset(pca->anchor);
2474 if (ruleset == NULL) {
2475 error = EBUSY;
2476 break;
2477 }
2478 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action,
2479 pca->r_num, pca->r_last, 1, 1);
2480 if (pool == NULL) {
2481 error = EBUSY;
2482 break;
2483 }
2484 if (pca->action != PF_CHANGE_REMOVE) {
2485 newpa = pool_get(&pf_pooladdr_pl, PR_WAITOK);
2486 if (newpa == NULL) {
2487 error = ENOMEM;
2488 break;
2489 }
2490 bcopy(&pca->addr, newpa, sizeof (struct pf_pooladdr));
2491 #if !INET
2492 if (pca->af == AF_INET) {
2493 pool_put(&pf_pooladdr_pl, newpa);
2494 error = EAFNOSUPPORT;
2495 break;
2496 }
2497 #endif /* INET */
2498 #if !INET6
2499 if (pca->af == AF_INET6) {
2500 pool_put(&pf_pooladdr_pl, newpa);
2501 error = EAFNOSUPPORT;
2502 break;
2503 }
2504 #endif /* INET6 */
2505 if (newpa->ifname[0]) {
2506 newpa->kif = pfi_kif_get(newpa->ifname);
2507 if (newpa->kif == NULL) {
2508 pool_put(&pf_pooladdr_pl, newpa);
2509 error = EINVAL;
2510 break;
2511 }
2512 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE);
2513 } else
2514 newpa->kif = NULL;
2515 if (pfi_dynaddr_setup(&newpa->addr, pca->af) ||
2516 pf_tbladdr_setup(ruleset, &newpa->addr)) {
2517 pfi_dynaddr_remove(&newpa->addr);
2518 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE);
2519 pool_put(&pf_pooladdr_pl, newpa);
2520 error = EINVAL;
2521 break;
2522 }
2523 }
2524
2525 if (pca->action == PF_CHANGE_ADD_HEAD)
2526 oldpa = TAILQ_FIRST(&pool->list);
2527 else if (pca->action == PF_CHANGE_ADD_TAIL)
2528 oldpa = TAILQ_LAST(&pool->list, pf_palist);
2529 else {
2530 int i = 0;
2531
2532 oldpa = TAILQ_FIRST(&pool->list);
2533 while ((oldpa != NULL) && (i < (int)pca->nr)) {
2534 oldpa = TAILQ_NEXT(oldpa, entries);
2535 i++;
2536 }
2537 if (oldpa == NULL) {
2538 error = EINVAL;
2539 break;
2540 }
2541 }
2542
2543 if (pca->action == PF_CHANGE_REMOVE) {
2544 TAILQ_REMOVE(&pool->list, oldpa, entries);
2545 pfi_dynaddr_remove(&oldpa->addr);
2546 pf_tbladdr_remove(&oldpa->addr);
2547 pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE);
2548 pool_put(&pf_pooladdr_pl, oldpa);
2549 } else {
2550 if (oldpa == NULL)
2551 TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
2552 else if (pca->action == PF_CHANGE_ADD_HEAD ||
2553 pca->action == PF_CHANGE_ADD_BEFORE)
2554 TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
2555 else
2556 TAILQ_INSERT_AFTER(&pool->list, oldpa,
2557 newpa, entries);
2558 }
2559
2560 pool->cur = TAILQ_FIRST(&pool->list);
2561 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr,
2562 pca->af);
2563 break;
2564 }
2565
2566 case DIOCGETRULESETS: {
2567 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
2568 struct pf_ruleset *ruleset;
2569 struct pf_anchor *anchor;
2570
2571 pr->path[sizeof (pr->path) - 1] = 0;
2572 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2573 error = EINVAL;
2574 break;
2575 }
2576 pr->nr = 0;
2577 if (ruleset->anchor == NULL) {
2578 /* XXX kludge for pf_main_ruleset */
2579 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2580 if (anchor->parent == NULL)
2581 pr->nr++;
2582 } else {
2583 RB_FOREACH(anchor, pf_anchor_node,
2584 &ruleset->anchor->children)
2585 pr->nr++;
2586 }
2587 break;
2588 }
2589
2590 case DIOCGETRULESET: {
2591 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
2592 struct pf_ruleset *ruleset;
2593 struct pf_anchor *anchor;
2594 u_int32_t nr = 0;
2595
2596 pr->path[sizeof (pr->path) - 1] = 0;
2597 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2598 error = EINVAL;
2599 break;
2600 }
2601 pr->name[0] = 0;
2602 if (ruleset->anchor == NULL) {
2603 /* XXX kludge for pf_main_ruleset */
2604 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2605 if (anchor->parent == NULL && nr++ == pr->nr) {
2606 strlcpy(pr->name, anchor->name,
2607 sizeof (pr->name));
2608 break;
2609 }
2610 } else {
2611 RB_FOREACH(anchor, pf_anchor_node,
2612 &ruleset->anchor->children)
2613 if (nr++ == pr->nr) {
2614 strlcpy(pr->name, anchor->name,
2615 sizeof (pr->name));
2616 break;
2617 }
2618 }
2619 if (!pr->name[0])
2620 error = EBUSY;
2621 break;
2622 }
2623
2624 case DIOCRCLRTABLES: {
2625 struct pfioc_table *io = (struct pfioc_table *)addr;
2626
2627 if (io->pfrio_esize != 0) {
2628 error = ENODEV;
2629 break;
2630 }
2631 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
2632 io->pfrio_flags | PFR_FLAG_USERIOCTL);
2633 break;
2634 }
2635
2636 case DIOCRADDTABLES: {
2637 struct pfioc_table *io = (struct pfioc_table *)addr;
2638
2639 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2640 error = ENODEV;
2641 break;
2642 }
2643 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size,
2644 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2645 break;
2646 }
2647
2648 case DIOCRDELTABLES: {
2649 struct pfioc_table *io = (struct pfioc_table *)addr;
2650
2651 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2652 error = ENODEV;
2653 break;
2654 }
2655 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size,
2656 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2657 break;
2658 }
2659
2660 case DIOCRGETTABLES: {
2661 struct pfioc_table *io = (struct pfioc_table *)addr;
2662
2663 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2664 error = ENODEV;
2665 break;
2666 }
2667 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer,
2668 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2669 break;
2670 }
2671
2672 case DIOCRGETTSTATS: {
2673 struct pfioc_table *io = (struct pfioc_table *)addr;
2674
2675 if (io->pfrio_esize != sizeof (struct pfr_tstats)) {
2676 error = ENODEV;
2677 break;
2678 }
2679 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer,
2680 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2681 break;
2682 }
2683
2684 case DIOCRCLRTSTATS: {
2685 struct pfioc_table *io = (struct pfioc_table *)addr;
2686
2687 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2688 error = ENODEV;
2689 break;
2690 }
2691 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size,
2692 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2693 break;
2694 }
2695
2696 case DIOCRSETTFLAGS: {
2697 struct pfioc_table *io = (struct pfioc_table *)addr;
2698
2699 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2700 error = ENODEV;
2701 break;
2702 }
2703 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size,
2704 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
2705 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2706 break;
2707 }
2708
2709 case DIOCRCLRADDRS: {
2710 struct pfioc_table *io = (struct pfioc_table *)addr;
2711
2712 if (io->pfrio_esize != 0) {
2713 error = ENODEV;
2714 break;
2715 }
2716 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
2717 io->pfrio_flags | PFR_FLAG_USERIOCTL);
2718 break;
2719 }
2720
2721 case DIOCRADDADDRS: {
2722 struct pfioc_table *io = (struct pfioc_table *)addr;
2723
2724 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2725 error = ENODEV;
2726 break;
2727 }
2728 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer,
2729 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
2730 PFR_FLAG_USERIOCTL);
2731 break;
2732 }
2733
2734 case DIOCRDELADDRS: {
2735 struct pfioc_table *io = (struct pfioc_table *)addr;
2736
2737 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2738 error = ENODEV;
2739 break;
2740 }
2741 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer,
2742 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
2743 PFR_FLAG_USERIOCTL);
2744 break;
2745 }
2746
2747 case DIOCRSETADDRS: {
2748 struct pfioc_table *io = (struct pfioc_table *)addr;
2749
2750 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2751 error = ENODEV;
2752 break;
2753 }
2754 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer,
2755 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
2756 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
2757 PFR_FLAG_USERIOCTL, 0);
2758 break;
2759 }
2760
2761 case DIOCRGETADDRS: {
2762 struct pfioc_table *io = (struct pfioc_table *)addr;
2763
2764 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2765 error = ENODEV;
2766 break;
2767 }
2768 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer,
2769 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2770 break;
2771 }
2772
2773 case DIOCRGETASTATS: {
2774 struct pfioc_table *io = (struct pfioc_table *)addr;
2775
2776 if (io->pfrio_esize != sizeof (struct pfr_astats)) {
2777 error = ENODEV;
2778 break;
2779 }
2780 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer,
2781 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2782 break;
2783 }
2784
2785 case DIOCRCLRASTATS: {
2786 struct pfioc_table *io = (struct pfioc_table *)addr;
2787
2788 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2789 error = ENODEV;
2790 break;
2791 }
2792 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer,
2793 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
2794 PFR_FLAG_USERIOCTL);
2795 break;
2796 }
2797
2798 case DIOCRTSTADDRS: {
2799 struct pfioc_table *io = (struct pfioc_table *)addr;
2800
2801 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2802 error = ENODEV;
2803 break;
2804 }
2805 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer,
2806 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
2807 PFR_FLAG_USERIOCTL);
2808 break;
2809 }
2810
2811 case DIOCRINADEFINE: {
2812 struct pfioc_table *io = (struct pfioc_table *)addr;
2813
2814 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2815 error = ENODEV;
2816 break;
2817 }
2818 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer,
2819 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
2820 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2821 break;
2822 }
2823
2824 case DIOCOSFPADD: {
2825 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2826 error = pf_osfp_add(io);
2827 break;
2828 }
2829
2830 case DIOCOSFPGET: {
2831 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2832 error = pf_osfp_get(io);
2833 break;
2834 }
2835
2836 case DIOCXBEGIN: {
2837 struct pfioc_trans *io = (struct pfioc_trans *)addr;
2838 struct pfioc_trans_e *ioe;
2839 struct pfr_table *table;
2840 int i;
2841
2842 if (io->esize != sizeof (*ioe)) {
2843 error = ENODEV;
2844 goto fail;
2845 }
2846 ioe = _MALLOC(sizeof (*ioe), M_TEMP, M_WAITOK);
2847 table = _MALLOC(sizeof (*table), M_TEMP, M_WAITOK);
2848 for (i = 0; i < io->size; i++) {
2849 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
2850 sizeof (*ioe))) {
2851 _FREE(table, M_TEMP);
2852 _FREE(ioe, M_TEMP);
2853 error = EFAULT;
2854 goto fail;
2855 }
2856 switch (ioe->rs_num) {
2857 case PF_RULESET_ALTQ:
2858 #if ALTQ
2859 if (ioe->anchor[0]) {
2860 _FREE(table, M_TEMP);
2861 _FREE(ioe, M_TEMP);
2862 error = EINVAL;
2863 goto fail;
2864 }
2865 if ((error = pf_begin_altq(&ioe->ticket))) {
2866 _FREE(table, M_TEMP);
2867 _FREE(ioe, M_TEMP);
2868 goto fail;
2869 }
2870 #endif /* ALTQ */
2871 break;
2872 case PF_RULESET_TABLE:
2873 bzero(table, sizeof (*table));
2874 strlcpy(table->pfrt_anchor, ioe->anchor,
2875 sizeof (table->pfrt_anchor));
2876 if ((error = pfr_ina_begin(table,
2877 &ioe->ticket, NULL, 0))) {
2878 _FREE(table, M_TEMP);
2879 _FREE(ioe, M_TEMP);
2880 goto fail;
2881 }
2882 break;
2883 default:
2884 if ((error = pf_begin_rules(&ioe->ticket,
2885 ioe->rs_num, ioe->anchor))) {
2886 _FREE(table, M_TEMP);
2887 _FREE(ioe, M_TEMP);
2888 goto fail;
2889 }
2890 break;
2891 }
2892 if (copyout(ioe, CAST_USER_ADDR_T(io->array+i),
2893 sizeof (io->array[i]))) {
2894 _FREE(table, M_TEMP);
2895 _FREE(ioe, M_TEMP);
2896 error = EFAULT;
2897 goto fail;
2898 }
2899 }
2900 _FREE(table, M_TEMP);
2901 _FREE(ioe, M_TEMP);
2902 break;
2903 }
2904
2905 case DIOCXROLLBACK: {
2906 struct pfioc_trans *io = (struct pfioc_trans *)addr;
2907 struct pfioc_trans_e *ioe;
2908 struct pfr_table *table;
2909 int i;
2910
2911 if (io->esize != sizeof (*ioe)) {
2912 error = ENODEV;
2913 goto fail;
2914 }
2915 ioe = _MALLOC(sizeof (*ioe), M_TEMP, M_WAITOK);
2916 table = _MALLOC(sizeof (*table), M_TEMP, M_WAITOK);
2917 for (i = 0; i < io->size; i++) {
2918 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
2919 sizeof (*ioe))) {
2920 _FREE(table, M_TEMP);
2921 _FREE(ioe, M_TEMP);
2922 error = EFAULT;
2923 goto fail;
2924 }
2925 switch (ioe->rs_num) {
2926 case PF_RULESET_ALTQ:
2927 #if ALTQ
2928 if (ioe->anchor[0]) {
2929 _FREE(table, M_TEMP);
2930 _FREE(ioe, M_TEMP);
2931 error = EINVAL;
2932 goto fail;
2933 }
2934 if ((error = pf_rollback_altq(ioe->ticket))) {
2935 _FREE(table, M_TEMP);
2936 _FREE(ioe, M_TEMP);
2937 goto fail; /* really bad */
2938 }
2939 #endif /* ALTQ */
2940 break;
2941 case PF_RULESET_TABLE:
2942 bzero(table, sizeof (*table));
2943 strlcpy(table->pfrt_anchor, ioe->anchor,
2944 sizeof (table->pfrt_anchor));
2945 if ((error = pfr_ina_rollback(table,
2946 ioe->ticket, NULL, 0))) {
2947 _FREE(table, M_TEMP);
2948 _FREE(ioe, M_TEMP);
2949 goto fail; /* really bad */
2950 }
2951 break;
2952 default:
2953 if ((error = pf_rollback_rules(ioe->ticket,
2954 ioe->rs_num, ioe->anchor))) {
2955 _FREE(table, M_TEMP);
2956 _FREE(ioe, M_TEMP);
2957 goto fail; /* really bad */
2958 }
2959 break;
2960 }
2961 }
2962 _FREE(table, M_TEMP);
2963 _FREE(ioe, M_TEMP);
2964 break;
2965 }
2966
2967 case DIOCXCOMMIT: {
2968 struct pfioc_trans *io = (struct pfioc_trans *)addr;
2969 struct pfioc_trans_e *ioe;
2970 struct pfr_table *table;
2971 struct pf_ruleset *rs;
2972 int i;
2973
2974 if (io->esize != sizeof (*ioe)) {
2975 error = ENODEV;
2976 goto fail;
2977 }
2978 ioe = _MALLOC(sizeof (*ioe), M_TEMP, M_WAITOK);
2979 table = _MALLOC(sizeof (*table), M_TEMP, M_WAITOK);
2980 /* first makes sure everything will succeed */
2981 for (i = 0; i < io->size; i++) {
2982 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
2983 sizeof (*ioe))) {
2984 _FREE(table, M_TEMP);
2985 _FREE(ioe, M_TEMP);
2986 error = EFAULT;
2987 goto fail;
2988 }
2989 switch (ioe->rs_num) {
2990 case PF_RULESET_ALTQ:
2991 #if ALTQ
2992 if (ioe->anchor[0]) {
2993 _FREE(table, M_TEMP);
2994 _FREE(ioe, M_TEMP);
2995 error = EINVAL;
2996 goto fail;
2997 }
2998 if (!altqs_inactive_open || ioe->ticket !=
2999 ticket_altqs_inactive) {
3000 _FREE(table, M_TEMP);
3001 _FREE(ioe, M_TEMP);
3002 error = EBUSY;
3003 goto fail;
3004 }
3005 #endif /* ALTQ */
3006 break;
3007 case PF_RULESET_TABLE:
3008 rs = pf_find_ruleset(ioe->anchor);
3009 if (rs == NULL || !rs->topen || ioe->ticket !=
3010 rs->tticket) {
3011 _FREE(table, M_TEMP);
3012 _FREE(ioe, M_TEMP);
3013 error = EBUSY;
3014 goto fail;
3015 }
3016 break;
3017 default:
3018 if (ioe->rs_num < 0 || ioe->rs_num >=
3019 PF_RULESET_MAX) {
3020 _FREE(table, M_TEMP);
3021 _FREE(ioe, M_TEMP);
3022 error = EINVAL;
3023 goto fail;
3024 }
3025 rs = pf_find_ruleset(ioe->anchor);
3026 if (rs == NULL ||
3027 !rs->rules[ioe->rs_num].inactive.open ||
3028 rs->rules[ioe->rs_num].inactive.ticket !=
3029 ioe->ticket) {
3030 _FREE(table, M_TEMP);
3031 _FREE(ioe, M_TEMP);
3032 error = EBUSY;
3033 goto fail;
3034 }
3035 break;
3036 }
3037 }
3038 /* now do the commit - no errors should happen here */
3039 for (i = 0; i < io->size; i++) {
3040 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
3041 sizeof (*ioe))) {
3042 _FREE(table, M_TEMP);
3043 _FREE(ioe, M_TEMP);
3044 error = EFAULT;
3045 goto fail;
3046 }
3047 switch (ioe->rs_num) {
3048 case PF_RULESET_ALTQ:
3049 #if ALTQ
3050 if ((error = pf_commit_altq(ioe->ticket))) {
3051 _FREE(table, M_TEMP);
3052 _FREE(ioe, M_TEMP);
3053 goto fail; /* really bad */
3054 }
3055 #endif /* ALTQ */
3056 break;
3057 case PF_RULESET_TABLE:
3058 bzero(table, sizeof (*table));
3059 strlcpy(table->pfrt_anchor, ioe->anchor,
3060 sizeof (table->pfrt_anchor));
3061 if ((error = pfr_ina_commit(table, ioe->ticket,
3062 NULL, NULL, 0))) {
3063 _FREE(table, M_TEMP);
3064 _FREE(ioe, M_TEMP);
3065 goto fail; /* really bad */
3066 }
3067 break;
3068 default:
3069 if ((error = pf_commit_rules(ioe->ticket,
3070 ioe->rs_num, ioe->anchor))) {
3071 _FREE(table, M_TEMP);
3072 _FREE(ioe, M_TEMP);
3073 goto fail; /* really bad */
3074 }
3075 break;
3076 }
3077 }
3078 _FREE(table, M_TEMP);
3079 _FREE(ioe, M_TEMP);
3080 break;
3081 }
3082
3083 case DIOCGETSRCNODES: {
3084 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr;
3085 struct pf_src_node *n, *sn, *pstore;
3086 u_int32_t nr = 0;
3087 int space = psn->psn_len;
3088
3089 if (space == 0) {
3090 RB_FOREACH(n, pf_src_tree, &tree_src_tracking)
3091 nr++;
3092 psn->psn_len = sizeof (struct pf_src_node) * nr;
3093 break;
3094 }
3095
3096 pstore = _MALLOC(sizeof (*pstore), M_TEMP, M_WAITOK);
3097
3098 sn = psn->psn_src_nodes;
3099 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
3100 uint64_t secs = pf_time_second(), diff;
3101
3102 if ((nr + 1) * sizeof (*sn) > (unsigned)psn->psn_len)
3103 break;
3104
3105 bcopy(n, pstore, sizeof (*pstore));
3106 if (n->rule.ptr != NULL)
3107 pstore->rule.nr = n->rule.ptr->nr;
3108 pstore->creation = secs - pstore->creation;
3109 if (pstore->expire > secs)
3110 pstore->expire -= secs;
3111 else
3112 pstore->expire = 0;
3113
3114 /* adjust the connection rate estimate */
3115 diff = secs - n->conn_rate.last;
3116 if (diff >= n->conn_rate.seconds)
3117 pstore->conn_rate.count = 0;
3118 else
3119 pstore->conn_rate.count -=
3120 n->conn_rate.count * diff /
3121 n->conn_rate.seconds;
3122
3123 error = copyout(pstore, CAST_USER_ADDR_T(sn),
3124 sizeof (*sn));
3125 if (error) {
3126 _FREE(pstore, M_TEMP);
3127 goto fail;
3128 }
3129 sn++;
3130 nr++;
3131 }
3132 psn->psn_len = sizeof (struct pf_src_node) * nr;
3133
3134 _FREE(pstore, M_TEMP);
3135 break;
3136 }
3137
3138 case DIOCCLRSRCNODES: {
3139 struct pf_src_node *n;
3140 struct pf_state *state;
3141
3142 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
3143 state->src_node = NULL;
3144 state->nat_src_node = NULL;
3145 }
3146 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
3147 n->expire = 1;
3148 n->states = 0;
3149 }
3150 pf_purge_expired_src_nodes();
3151 pf_status.src_nodes = 0;
3152 break;
3153 }
3154
3155 case DIOCKILLSRCNODES: {
3156 struct pf_src_node *sn;
3157 struct pf_state *s;
3158 struct pfioc_src_node_kill *psnk =
3159 (struct pfioc_src_node_kill *)addr;
3160 int killed = 0;
3161
3162 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) {
3163 if (PF_MATCHA(psnk->psnk_src.neg,
3164 &psnk->psnk_src.addr.v.a.addr,
3165 &psnk->psnk_src.addr.v.a.mask,
3166 &sn->addr, sn->af) &&
3167 PF_MATCHA(psnk->psnk_dst.neg,
3168 &psnk->psnk_dst.addr.v.a.addr,
3169 &psnk->psnk_dst.addr.v.a.mask,
3170 &sn->raddr, sn->af)) {
3171 /* Handle state to src_node linkage */
3172 if (sn->states != 0) {
3173 RB_FOREACH(s, pf_state_tree_id,
3174 &tree_id) {
3175 if (s->src_node == sn)
3176 s->src_node = NULL;
3177 if (s->nat_src_node == sn)
3178 s->nat_src_node = NULL;
3179 }
3180 sn->states = 0;
3181 }
3182 sn->expire = 1;
3183 killed++;
3184 }
3185 }
3186
3187 if (killed > 0)
3188 pf_purge_expired_src_nodes();
3189
3190 psnk->psnk_af = killed;
3191 break;
3192 }
3193
3194 case DIOCSETHOSTID: {
3195 u_int32_t *hid = (u_int32_t *)addr;
3196
3197 if (*hid == 0)
3198 pf_status.hostid = random();
3199 else
3200 pf_status.hostid = *hid;
3201 break;
3202 }
3203
3204 case DIOCOSFPFLUSH:
3205 pf_osfp_flush();
3206 break;
3207
3208 case DIOCIGETIFACES: {
3209 struct pfioc_iface *io = (struct pfioc_iface *)addr;
3210
3211 if (io->pfiio_esize != sizeof (struct pfi_kif)) {
3212 error = ENODEV;
3213 break;
3214 }
3215 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer,
3216 &io->pfiio_size);
3217 break;
3218 }
3219
3220 case DIOCSETIFFLAG: {
3221 struct pfioc_iface *io = (struct pfioc_iface *)addr;
3222
3223 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
3224 break;
3225 }
3226
3227 case DIOCCLRIFFLAG: {
3228 struct pfioc_iface *io = (struct pfioc_iface *)addr;
3229
3230 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
3231 break;
3232 }
3233
3234 default:
3235 error = ENODEV;
3236 break;
3237 }
3238 fail:
3239 lck_mtx_unlock(pf_lock);
3240 lck_rw_done(pf_perim_lock);
3241
3242 return (error);
3243 }
3244
3245 int
3246 pf_af_hook(struct ifnet *ifp, struct mbuf **mppn, struct mbuf **mp,
3247 unsigned int af, int input)
3248 {
3249 int error = 0, reentry;
3250 struct thread *curthread = current_thread();
3251 struct mbuf *nextpkt;
3252
3253 reentry = (ifp->if_pf_curthread == curthread);
3254 if (!reentry) {
3255 lck_rw_lock_shared(pf_perim_lock);
3256 if (!pf_hooks_attached)
3257 goto done;
3258
3259 lck_mtx_lock(pf_lock);
3260 ifp->if_pf_curthread = curthread;
3261 }
3262
3263 if (mppn != NULL && *mppn != NULL)
3264 VERIFY(*mppn == *mp);
3265 if ((nextpkt = (*mp)->m_nextpkt) != NULL)
3266 (*mp)->m_nextpkt = NULL;
3267
3268 switch (af) {
3269 #if INET
3270 case AF_INET: {
3271 error = pf_inet_hook(ifp, mp, input);
3272 break;
3273 }
3274 #endif /* INET */
3275 #if INET6
3276 case AF_INET6:
3277 error = pf_inet6_hook(ifp, mp, input);
3278 break;
3279 #endif /* INET6 */
3280 default:
3281 break;
3282 }
3283
3284 if (nextpkt != NULL) {
3285 if (*mp != NULL) {
3286 struct mbuf *m = *mp;
3287 while (m->m_nextpkt != NULL)
3288 m = m->m_nextpkt;
3289 m->m_nextpkt = nextpkt;
3290 } else {
3291 *mp = nextpkt;
3292 }
3293 }
3294 if (mppn != NULL && *mppn != NULL)
3295 *mppn = *mp;
3296
3297 if (!reentry) {
3298 ifp->if_pf_curthread = NULL;
3299 lck_mtx_unlock(pf_lock);
3300 }
3301 done:
3302 if (!reentry)
3303 lck_rw_done(pf_perim_lock);
3304
3305 return (error);
3306 }
3307
3308
3309 #if INET
3310 static int
3311 pf_inet_hook(struct ifnet *ifp, struct mbuf **mp, int input)
3312 {
3313 struct mbuf *m = *mp;
3314 #if BYTE_ORDER != BIG_ENDIAN
3315 struct ip *ip = mtod(m, struct ip *);
3316 #endif
3317 int error = 0;
3318
3319 /*
3320 * If the packet is outbound, is originated locally, is flagged for
3321 * delayed UDP/TCP checksum calculation, and is about to be processed
3322 * for an interface that doesn't support the appropriate checksum
3323 * offloading, then calculated the checksum here so that PF can adjust
3324 * it properly.
3325 */
3326 if (!input && m->m_pkthdr.rcvif == NULL) {
3327 static const int mask = CSUM_DELAY_DATA;
3328 const int flags = m->m_pkthdr.csum_flags &
3329 ~IF_HWASSIST_CSUM_FLAGS(ifp->if_hwassist);
3330
3331 if (flags & mask) {
3332 in_delayed_cksum(m);
3333 m->m_pkthdr.csum_flags &= ~mask;
3334 }
3335 }
3336
3337 #if BYTE_ORDER != BIG_ENDIAN
3338 HTONS(ip->ip_len);
3339 HTONS(ip->ip_off);
3340 #endif
3341 if (pf_test(input ? PF_IN : PF_OUT, ifp, mp, NULL) != PF_PASS) {
3342 if (*mp != NULL) {
3343 m_freem(*mp);
3344 *mp = NULL;
3345 error = EHOSTUNREACH;
3346 } else {
3347 error = ENOBUFS;
3348 }
3349 }
3350 #if BYTE_ORDER != BIG_ENDIAN
3351 else {
3352 ip = mtod(*mp, struct ip *);
3353 NTOHS(ip->ip_len);
3354 NTOHS(ip->ip_off);
3355 }
3356 #endif
3357 return (error);
3358 }
3359 #endif /* INET */
3360
3361 #if INET6
3362 int
3363 pf_inet6_hook(struct ifnet *ifp, struct mbuf **mp, int input)
3364 {
3365 int error = 0;
3366
3367 #if 0
3368 /*
3369 * TODO: once we support IPv6 hardware checksum offload
3370 */
3371 /*
3372 * If the packet is outbound, is originated locally, is flagged for
3373 * delayed UDP/TCP checksum calculation, and is about to be processed
3374 * for an interface that doesn't support the appropriate checksum
3375 * offloading, then calculated the checksum here so that PF can adjust
3376 * it properly.
3377 */
3378 if (!input && (*mp)->m_pkthdr.rcvif == NULL) {
3379 static const int mask = CSUM_DELAY_DATA;
3380 const int flags = (*mp)->m_pkthdr.csum_flags &
3381 ~IF_HWASSIST_CSUM_FLAGS(ifp->if_hwassist);
3382
3383 if (flags & mask) {
3384 in6_delayed_cksum(*mp);
3385 (*mp)->m_pkthdr.csum_flags &= ~mask;
3386 }
3387 }
3388 #endif
3389
3390 if (pf_test6(input ? PF_IN : PF_OUT, ifp, mp, NULL) != PF_PASS) {
3391 if (*mp != NULL) {
3392 m_freem(*mp);
3393 *mp = NULL;
3394 error = EHOSTUNREACH;
3395 } else {
3396 error = ENOBUFS;
3397 }
3398 }
3399 return (error);
3400 }
3401 #endif /* INET6 */
3402
3403 int
3404 pf_ifaddr_hook(struct ifnet *ifp, unsigned long cmd)
3405 {
3406 lck_rw_lock_shared(pf_perim_lock);
3407 if (!pf_hooks_attached)
3408 goto done;
3409
3410 lck_mtx_lock(pf_lock);
3411
3412 switch (cmd) {
3413 case SIOCSIFADDR:
3414 case SIOCAIFADDR:
3415 case SIOCDIFADDR:
3416 #if INET6
3417 case SIOCAIFADDR_IN6:
3418 case SIOCDIFADDR_IN6:
3419 #endif /* INET6 */
3420 if (ifp->if_pf_kif != NULL)
3421 pfi_kifaddr_update(ifp->if_pf_kif);
3422 break;
3423 default:
3424 panic("%s: unexpected ioctl %lu", __func__, cmd);
3425 /* NOTREACHED */
3426 }
3427
3428 lck_mtx_unlock(pf_lock);
3429 done:
3430 lck_rw_done(pf_perim_lock);
3431 return (0);
3432 }
3433
3434 /*
3435 * Caller acquires dlil lock as writer (exclusive)
3436 */
3437 void
3438 pf_ifnet_hook(struct ifnet *ifp, int attach)
3439 {
3440 lck_rw_lock_shared(pf_perim_lock);
3441 if (!pf_hooks_attached)
3442 goto done;
3443
3444 lck_mtx_lock(pf_lock);
3445 if (attach)
3446 pfi_attach_ifnet(ifp);
3447 else
3448 pfi_detach_ifnet(ifp);
3449 lck_mtx_unlock(pf_lock);
3450 done:
3451 lck_rw_done(pf_perim_lock);
3452 }
3453
3454 static void
3455 pf_attach_hooks(void)
3456 {
3457 int i;
3458
3459 if (pf_hooks_attached)
3460 return;
3461
3462 ifnet_head_lock_shared();
3463 for (i = 0; i <= if_index; i++) {
3464 struct ifnet *ifp = ifindex2ifnet[i];
3465 if (ifp != NULL) {
3466 pfi_attach_ifnet(ifp);
3467 }
3468 }
3469 ifnet_head_done();
3470 pf_hooks_attached = 1;
3471 }
3472
3473 static void
3474 pf_detach_hooks(void)
3475 {
3476 int i;
3477
3478 if (!pf_hooks_attached)
3479 return;
3480
3481 ifnet_head_lock_shared();
3482 for (i = 0; i <= if_index; i++) {
3483 struct ifnet *ifp = ifindex2ifnet[i];
3484 if (ifp != NULL && ifp->if_pf_kif != NULL) {
3485 pfi_detach_ifnet(ifp);
3486 }
3487 }
3488 ifnet_head_done();
3489 pf_hooks_attached = 0;
3490 }
mirror of XNU