]> git.saurik.com Git - apple/xnu.git/blob - bsd/net/pf_ioctl.c
projects / apple / xnu.git / blob
? search:


8145fed94130e505e5ea0da31077824c506e1005
[apple/xnu.git] / bsd / net / pf_ioctl.c
1 /*
2 * Copyright (c) 2008 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /* $apfw: pf_ioctl.c,v 1.16 2008/08/27 00:01:32 jhw Exp $ */
30 /* $OpenBSD: pf_ioctl.c,v 1.175 2007/02/26 22:47:43 deraadt Exp $ */
31
32 /*
33 * Copyright (c) 2001 Daniel Hartmeier
34 * Copyright (c) 2002,2003 Henning Brauer
35 * All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 *
41 * - Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * - Redistributions in binary form must reproduce the above
44 * copyright notice, this list of conditions and the following
45 * disclaimer in the documentation and/or other materials provided
46 * with the distribution.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
49 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
50 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
51 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
52 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
53 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
54 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
55 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
56 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
58 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
59 * POSSIBILITY OF SUCH DAMAGE.
60 *
61 * Effort sponsored in part by the Defense Advanced Research Projects
62 * Agency (DARPA) and Air Force Research Laboratory, Air Force
63 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
64 *
65 */
66
67 #include <machine/endian.h>
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/mbuf.h>
71 #include <sys/filio.h>
72 #include <sys/fcntl.h>
73 #include <sys/socket.h>
74 #include <sys/socketvar.h>
75 #include <sys/kernel.h>
76 #include <sys/time.h>
77 #include <sys/proc_internal.h>
78 #include <sys/malloc.h>
79 #include <sys/kauth.h>
80 #include <sys/conf.h>
81 #include <sys/mcache.h>
82
83 #include <mach/vm_param.h>
84
85 #include <net/if.h>
86 #include <net/if_types.h>
87 #include <net/route.h>
88
89 #include <netinet/in.h>
90 #include <netinet/in_var.h>
91 #include <netinet/in_systm.h>
92 #include <netinet/ip.h>
93 #include <netinet/ip_var.h>
94 #include <netinet/ip_icmp.h>
95 #include <netinet/if_ether.h>
96
97 #include <libkern/crypto/md5.h>
98
99 #include <miscfs/devfs/devfs.h>
100
101 #include <net/pfvar.h>
102
103 #if NPFSYNC
104 #include <net/if_pfsync.h>
105 #endif /* NPFSYNC */
106
107 #if PFLOG
108 #include <net/if_pflog.h>
109 #endif /* PFLOG */
110
111 #if INET6
112 #include <netinet/ip6.h>
113 #include <netinet/in_pcb.h>
114 #endif /* INET6 */
115
116 #if ALTQ
117 #include <altq/altq.h>
118 #endif /* ALTQ */
119
120 #if 0
121 static void pfdetach(void);
122 #endif
123 static int pfopen(dev_t, int, int, struct proc *);
124 static int pfclose(dev_t, int, int, struct proc *);
125 static int pfioctl(dev_t, u_long, caddr_t, int, struct proc *);
126 static struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
127 u_int8_t, u_int8_t, u_int8_t);
128
129 static void pf_mv_pool(struct pf_palist *, struct pf_palist *);
130 static void pf_empty_pool(struct pf_palist *);
131 #if ALTQ
132 static int pf_begin_altq(u_int32_t *);
133 static int pf_rollback_altq(u_int32_t);
134 static int pf_commit_altq(u_int32_t);
135 static int pf_enable_altq(struct pf_altq *);
136 static int pf_disable_altq(struct pf_altq *);
137 #endif /* ALTQ */
138 static int pf_begin_rules(u_int32_t *, int, const char *);
139 static int pf_rollback_rules(u_int32_t, int, char *);
140 static int pf_setup_pfsync_matching(struct pf_ruleset *);
141 static void pf_hash_rule(MD5_CTX *, struct pf_rule *);
142 #ifndef NO_APPLE_EXTENSIONS
143 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *, u_int8_t);
144 #else
145 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
146 #endif
147 static int pf_commit_rules(u_int32_t, int, char *);
148 static void pf_state_export(struct pfsync_state *, struct pf_state_key *,
149 struct pf_state *);
150 static void pf_state_import(struct pfsync_state *, struct pf_state_key *,
151 struct pf_state *);
152
153 #define PF_CDEV_MAJOR (-1)
154
155 static struct cdevsw pf_cdevsw = {
156 /* open */ pfopen,
157 /* close */ pfclose,
158 /* read */ eno_rdwrt,
159 /* write */ eno_rdwrt,
160 /* ioctl */ pfioctl,
161 /* stop */ eno_stop,
162 /* reset */ eno_reset,
163 /* tty */ NULL,
164 /* select */ eno_select,
165 /* mmap */ eno_mmap,
166 /* strategy */ eno_strat,
167 /* getc */ eno_getc,
168 /* putc */ eno_putc,
169 /* type */ 0
170 };
171
172 static void pf_attach_hooks(void);
173 static void pf_detach_hooks(void);
174 static int pf_hooks_attached = 0;
175
176 struct pf_rule pf_default_rule;
177 #if ALTQ
178 static int pf_altq_running;
179 #endif /* ALTQ */
180
181 #define TAGID_MAX 50000
182 static TAILQ_HEAD(pf_tags, pf_tagname) pf_tags =
183 TAILQ_HEAD_INITIALIZER(pf_tags);
184 #if ALTQ
185 static TAILQ_HEAD(pf_tags, pf_tagname) pf_qids =
186 TAILQ_HEAD_INITIALIZER(pf_qids);
187 #endif /* ALTQ */
188
189 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
190 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
191 #endif
192 static u_int16_t tagname2tag(struct pf_tags *, char *);
193 static void tag2tagname(struct pf_tags *, u_int16_t, char *);
194 static void tag_unref(struct pf_tags *, u_int16_t);
195 static int pf_rtlabel_add(struct pf_addr_wrap *);
196 static void pf_rtlabel_remove(struct pf_addr_wrap *);
197 static void pf_rtlabel_copyout(struct pf_addr_wrap *);
198
199 #if INET
200 static int pf_inet_hook(struct ifnet *, struct mbuf **, int);
201 #endif /* INET */
202 #if INET6
203 static int pf_inet6_hook(struct ifnet *, struct mbuf **, int);
204 #endif /* INET6 */
205
206 #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x
207
208 static lck_attr_t *pf_perim_lock_attr;
209 static lck_grp_t *pf_perim_lock_grp;
210 static lck_grp_attr_t *pf_perim_lock_grp_attr;
211
212 static lck_attr_t *pf_lock_attr;
213 static lck_grp_t *pf_lock_grp;
214 static lck_grp_attr_t *pf_lock_grp_attr;
215
216 struct thread *pf_purge_thread;
217
218 extern void pfi_kifaddr_update(void *);
219
220 void
221 pfinit(void)
222 {
223 u_int32_t *t = pf_default_rule.timeout;
224 int maj;
225
226 pf_perim_lock_grp_attr = lck_grp_attr_alloc_init();
227 pf_perim_lock_grp = lck_grp_alloc_init("pf_perim",
228 pf_perim_lock_grp_attr);
229 pf_perim_lock_attr = lck_attr_alloc_init();
230 pf_perim_lock = lck_rw_alloc_init(pf_perim_lock_grp,
231 pf_perim_lock_attr);
232
233 pf_lock_grp_attr = lck_grp_attr_alloc_init();
234 pf_lock_grp = lck_grp_alloc_init("pf", pf_lock_grp_attr);
235 pf_lock_attr = lck_attr_alloc_init();
236 pf_lock = lck_mtx_alloc_init(pf_lock_grp, pf_lock_attr);
237
238 pool_init(&pf_rule_pl, sizeof (struct pf_rule), 0, 0, 0, "pfrulepl",
239 NULL);
240 pool_init(&pf_src_tree_pl, sizeof (struct pf_src_node), 0, 0, 0,
241 "pfsrctrpl", NULL);
242 pool_init(&pf_state_pl, sizeof (struct pf_state), 0, 0, 0, "pfstatepl",
243 NULL);
244 pool_init(&pf_state_key_pl, sizeof (struct pf_state_key), 0, 0, 0,
245 "pfstatekeypl", NULL);
246 #ifndef NO_APPLE_EXTENSIONS
247 pool_init(&pf_app_state_pl, sizeof (struct pf_app_state), 0, 0, 0,
248 "pfappstatepl", NULL);
249 #endif
250 #if ALTQ
251 pool_init(&pf_altq_pl, sizeof (struct pf_altq), 0, 0, 0, "pfaltqpl",
252 NULL);
253 #endif /* ALTQ */
254 pool_init(&pf_pooladdr_pl, sizeof (struct pf_pooladdr), 0, 0, 0,
255 "pfpooladdrpl", NULL);
256 pfr_initialize();
257 pfi_initialize();
258 pf_osfp_initialize();
259
260 pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp,
261 pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0);
262
263 if (max_mem <= 256*1024*1024)
264 pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit =
265 PFR_KENTRY_HIWAT_SMALL;
266
267 RB_INIT(&tree_src_tracking);
268 RB_INIT(&pf_anchors);
269 pf_init_ruleset(&pf_main_ruleset);
270 TAILQ_INIT(&pf_pabuf);
271 TAILQ_INIT(&state_list);
272 #if ALTQ
273 TAILQ_INIT(&pf_altqs[0]);
274 TAILQ_INIT(&pf_altqs[1]);
275 pf_altqs_active = &pf_altqs[0];
276 pf_altqs_inactive = &pf_altqs[1];
277 #endif /* ALTQ */
278
279 /* default rule should never be garbage collected */
280 pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next;
281 pf_default_rule.action = PF_PASS;
282 pf_default_rule.nr = -1;
283 pf_default_rule.rtableid = IFSCOPE_NONE;
284
285 /* initialize default timeouts */
286 t[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
287 t[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
288 t[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
289 t[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
290 t[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
291 t[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
292 t[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
293 t[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
294 t[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
295 t[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
296 t[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
297 #ifndef NO_APPLE_EXTENSIONS
298 t[PFTM_GREv1_FIRST_PACKET] = PFTM_GREv1_FIRST_PACKET_VAL;
299 t[PFTM_GREv1_INITIATING] = PFTM_GREv1_INITIATING_VAL;
300 t[PFTM_GREv1_ESTABLISHED] = PFTM_GREv1_ESTABLISHED_VAL;
301 t[PFTM_ESP_FIRST_PACKET] = PFTM_ESP_FIRST_PACKET_VAL;
302 t[PFTM_ESP_INITIATING] = PFTM_ESP_INITIATING_VAL;
303 t[PFTM_ESP_ESTABLISHED] = PFTM_ESP_ESTABLISHED_VAL;
304 #endif
305 t[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
306 t[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
307 t[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
308 t[PFTM_FRAG] = PFTM_FRAG_VAL;
309 t[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
310 t[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
311 t[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
312 t[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
313 t[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
314
315 pf_normalize_init();
316 bzero(&pf_status, sizeof (pf_status));
317 pf_status.debug = PF_DEBUG_URGENT;
318
319 /* XXX do our best to avoid a conflict */
320 pf_status.hostid = random();
321
322 if (kernel_thread_start(pf_purge_thread_fn, NULL,
323 &pf_purge_thread) != 0) {
324 printf("%s: unable to start purge thread!", __func__);
325 return;
326 }
327
328 maj = cdevsw_add(PF_CDEV_MAJOR, &pf_cdevsw);
329 if (maj == -1) {
330 printf("%s: failed to allocate major number!\n", __func__);
331 return;
332 }
333 (void) devfs_make_node(makedev(maj, 0), DEVFS_CHAR,
334 UID_ROOT, GID_WHEEL, 0600, "pf", 0);
335 }
336
337 #if 0
338 static void
339 pfdetach(void)
340 {
341 struct pf_anchor *anchor;
342 struct pf_state *state;
343 struct pf_src_node *node;
344 struct pfioc_table pt;
345 u_int32_t ticket;
346 int i;
347 char r = '\0';
348
349 pf_status.running = 0;
350 wakeup(pf_purge_thread_fn);
351
352 /* clear the rulesets */
353 for (i = 0; i < PF_RULESET_MAX; i++)
354 if (pf_begin_rules(&ticket, i, &r) == 0)
355 pf_commit_rules(ticket, i, &r);
356 #if ALTQ
357 if (pf_begin_altq(&ticket) == 0)
358 pf_commit_altq(ticket);
359 #endif /* ALTQ */
360
361 /* clear states */
362 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
363 state->timeout = PFTM_PURGE;
364 #if NPFSYNC
365 state->sync_flags = PFSTATE_NOSYNC;
366 #endif
367 }
368 pf_purge_expired_states(pf_status.states);
369
370 #if NPFSYNC
371 pfsync_clear_states(pf_status.hostid, NULL);
372 #endif
373
374 /* clear source nodes */
375 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
376 state->src_node = NULL;
377 state->nat_src_node = NULL;
378 }
379 RB_FOREACH(node, pf_src_tree, &tree_src_tracking) {
380 node->expire = 1;
381 node->states = 0;
382 }
383 pf_purge_expired_src_nodes();
384
385 /* clear tables */
386 memset(&pt, '\0', sizeof (pt));
387 pfr_clr_tables(&pt.pfrio_table, &pt.pfrio_ndel, pt.pfrio_flags);
388
389 /* destroy anchors */
390 while ((anchor = RB_MIN(pf_anchor_global, &pf_anchors)) != NULL) {
391 for (i = 0; i < PF_RULESET_MAX; i++)
392 if (pf_begin_rules(&ticket, i, anchor->name) == 0)
393 pf_commit_rules(ticket, i, anchor->name);
394 }
395
396 /* destroy main ruleset */
397 pf_remove_if_empty_ruleset(&pf_main_ruleset);
398
399 /* destroy the pools */
400 pool_destroy(&pf_pooladdr_pl);
401 #if ALTQ
402 pool_destroy(&pf_altq_pl);
403 #endif /* ALTQ */
404 pool_destroy(&pf_state_pl);
405 pool_destroy(&pf_rule_pl);
406 pool_destroy(&pf_src_tree_pl);
407
408 /* destroy subsystems */
409 pf_normalize_destroy();
410 pf_osfp_destroy();
411 pfr_destroy();
412 pfi_destroy();
413 }
414 #endif
415
416 static int
417 pfopen(dev_t dev, int flags, int fmt, struct proc *p)
418 {
419 #pragma unused(flags, fmt, p)
420 if (minor(dev) >= 1)
421 return (ENXIO);
422 return (0);
423 }
424
425 static int
426 pfclose(dev_t dev, int flags, int fmt, struct proc *p)
427 {
428 #pragma unused(flags, fmt, p)
429 if (minor(dev) >= 1)
430 return (ENXIO);
431 return (0);
432 }
433
434 static struct pf_pool *
435 pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
436 u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
437 u_int8_t check_ticket)
438 {
439 struct pf_ruleset *ruleset;
440 struct pf_rule *rule;
441 int rs_num;
442
443 ruleset = pf_find_ruleset(anchor);
444 if (ruleset == NULL)
445 return (NULL);
446 rs_num = pf_get_ruleset_number(rule_action);
447 if (rs_num >= PF_RULESET_MAX)
448 return (NULL);
449 if (active) {
450 if (check_ticket && ticket !=
451 ruleset->rules[rs_num].active.ticket)
452 return (NULL);
453 if (r_last)
454 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
455 pf_rulequeue);
456 else
457 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
458 } else {
459 if (check_ticket && ticket !=
460 ruleset->rules[rs_num].inactive.ticket)
461 return (NULL);
462 if (r_last)
463 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
464 pf_rulequeue);
465 else
466 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
467 }
468 if (!r_last) {
469 while ((rule != NULL) && (rule->nr != rule_number))
470 rule = TAILQ_NEXT(rule, entries);
471 }
472 if (rule == NULL)
473 return (NULL);
474
475 return (&rule->rpool);
476 }
477
478 static void
479 pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb)
480 {
481 struct pf_pooladdr *mv_pool_pa;
482
483 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
484 TAILQ_REMOVE(poola, mv_pool_pa, entries);
485 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
486 }
487 }
488
489 static void
490 pf_empty_pool(struct pf_palist *poola)
491 {
492 struct pf_pooladdr *empty_pool_pa;
493
494 while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) {
495 pfi_dynaddr_remove(&empty_pool_pa->addr);
496 pf_tbladdr_remove(&empty_pool_pa->addr);
497 pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE);
498 TAILQ_REMOVE(poola, empty_pool_pa, entries);
499 pool_put(&pf_pooladdr_pl, empty_pool_pa);
500 }
501 }
502
503 void
504 pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
505 {
506 if (rulequeue != NULL) {
507 if (rule->states <= 0) {
508 /*
509 * XXX - we need to remove the table *before* detaching
510 * the rule to make sure the table code does not delete
511 * the anchor under our feet.
512 */
513 pf_tbladdr_remove(&rule->src.addr);
514 pf_tbladdr_remove(&rule->dst.addr);
515 if (rule->overload_tbl)
516 pfr_detach_table(rule->overload_tbl);
517 }
518 TAILQ_REMOVE(rulequeue, rule, entries);
519 rule->entries.tqe_prev = NULL;
520 rule->nr = -1;
521 }
522
523 if (rule->states > 0 || rule->src_nodes > 0 ||
524 rule->entries.tqe_prev != NULL)
525 return;
526 pf_tag_unref(rule->tag);
527 pf_tag_unref(rule->match_tag);
528 #if ALTQ
529 if (rule->pqid != rule->qid)
530 pf_qid_unref(rule->pqid);
531 pf_qid_unref(rule->qid);
532 #endif /* ALTQ */
533 pf_rtlabel_remove(&rule->src.addr);
534 pf_rtlabel_remove(&rule->dst.addr);
535 pfi_dynaddr_remove(&rule->src.addr);
536 pfi_dynaddr_remove(&rule->dst.addr);
537 if (rulequeue == NULL) {
538 pf_tbladdr_remove(&rule->src.addr);
539 pf_tbladdr_remove(&rule->dst.addr);
540 if (rule->overload_tbl)
541 pfr_detach_table(rule->overload_tbl);
542 }
543 pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE);
544 pf_anchor_remove(rule);
545 pf_empty_pool(&rule->rpool.list);
546 pool_put(&pf_rule_pl, rule);
547 }
548
549 static u_int16_t
550 tagname2tag(struct pf_tags *head, char *tagname)
551 {
552 struct pf_tagname *tag, *p = NULL;
553 u_int16_t new_tagid = 1;
554
555 TAILQ_FOREACH(tag, head, entries)
556 if (strcmp(tagname, tag->name) == 0) {
557 tag->ref++;
558 return (tag->tag);
559 }
560
561 /*
562 * to avoid fragmentation, we do a linear search from the beginning
563 * and take the first free slot we find. if there is none or the list
564 * is empty, append a new entry at the end.
565 */
566
567 /* new entry */
568 if (!TAILQ_EMPTY(head))
569 for (p = TAILQ_FIRST(head); p != NULL &&
570 p->tag == new_tagid; p = TAILQ_NEXT(p, entries))
571 new_tagid = p->tag + 1;
572
573 if (new_tagid > TAGID_MAX)
574 return (0);
575
576 /* allocate and fill new struct pf_tagname */
577 tag = _MALLOC(sizeof (*tag), M_TEMP, M_WAITOK|M_ZERO);
578 if (tag == NULL)
579 return (0);
580 strlcpy(tag->name, tagname, sizeof (tag->name));
581 tag->tag = new_tagid;
582 tag->ref++;
583
584 if (p != NULL) /* insert new entry before p */
585 TAILQ_INSERT_BEFORE(p, tag, entries);
586 else /* either list empty or no free slot in between */
587 TAILQ_INSERT_TAIL(head, tag, entries);
588
589 return (tag->tag);
590 }
591
592 static void
593 tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p)
594 {
595 struct pf_tagname *tag;
596
597 TAILQ_FOREACH(tag, head, entries)
598 if (tag->tag == tagid) {
599 strlcpy(p, tag->name, PF_TAG_NAME_SIZE);
600 return;
601 }
602 }
603
604 static void
605 tag_unref(struct pf_tags *head, u_int16_t tag)
606 {
607 struct pf_tagname *p, *next;
608
609 if (tag == 0)
610 return;
611
612 for (p = TAILQ_FIRST(head); p != NULL; p = next) {
613 next = TAILQ_NEXT(p, entries);
614 if (tag == p->tag) {
615 if (--p->ref == 0) {
616 TAILQ_REMOVE(head, p, entries);
617 _FREE(p, M_TEMP);
618 }
619 break;
620 }
621 }
622 }
623
624 u_int16_t
625 pf_tagname2tag(char *tagname)
626 {
627 return (tagname2tag(&pf_tags, tagname));
628 }
629
630 void
631 pf_tag2tagname(u_int16_t tagid, char *p)
632 {
633 tag2tagname(&pf_tags, tagid, p);
634 }
635
636 void
637 pf_tag_ref(u_int16_t tag)
638 {
639 struct pf_tagname *t;
640
641 TAILQ_FOREACH(t, &pf_tags, entries)
642 if (t->tag == tag)
643 break;
644 if (t != NULL)
645 t->ref++;
646 }
647
648 void
649 pf_tag_unref(u_int16_t tag)
650 {
651 tag_unref(&pf_tags, tag);
652 }
653
654 static int
655 pf_rtlabel_add(struct pf_addr_wrap *a)
656 {
657 #pragma unused(a)
658 return (0);
659 }
660
661 static void
662 pf_rtlabel_remove(struct pf_addr_wrap *a)
663 {
664 #pragma unused(a)
665 }
666
667 static void
668 pf_rtlabel_copyout(struct pf_addr_wrap *a)
669 {
670 #pragma unused(a)
671 }
672
673 #if ALTQ
674 u_int32_t
675 pf_qname2qid(char *qname)
676 {
677 return ((u_int32_t)tagname2tag(&pf_qids, qname));
678 }
679
680 void
681 pf_qid2qname(u_int32_t qid, char *p)
682 {
683 tag2tagname(&pf_qids, (u_int16_t)qid, p);
684 }
685
686 void
687 pf_qid_unref(u_int32_t qid)
688 {
689 tag_unref(&pf_qids, (u_int16_t)qid);
690 }
691
692 static int
693 pf_begin_altq(u_int32_t *ticket)
694 {
695 struct pf_altq *altq;
696 int error = 0;
697
698 /* Purge the old altq list */
699 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
700 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
701 if (altq->qname[0] == 0) {
702 /* detach and destroy the discipline */
703 error = altq_remove(altq);
704 } else
705 pf_qid_unref(altq->qid);
706 pool_put(&pf_altq_pl, altq);
707 }
708 if (error)
709 return (error);
710 *ticket = ++ticket_altqs_inactive;
711 altqs_inactive_open = 1;
712 return (0);
713 }
714
715 static int
716 pf_rollback_altq(u_int32_t ticket)
717 {
718 struct pf_altq *altq;
719 int error = 0;
720
721 if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
722 return (0);
723 /* Purge the old altq list */
724 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
725 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
726 if (altq->qname[0] == 0) {
727 /* detach and destroy the discipline */
728 error = altq_remove(altq);
729 } else
730 pf_qid_unref(altq->qid);
731 pool_put(&pf_altq_pl, altq);
732 }
733 altqs_inactive_open = 0;
734 return (error);
735 }
736
737 static int
738 pf_commit_altq(u_int32_t ticket)
739 {
740 struct pf_altqqueue *old_altqs;
741 struct pf_altq *altq;
742 int s, err, error = 0;
743
744 if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
745 return (EBUSY);
746
747 /* swap altqs, keep the old. */
748 s = splnet();
749 old_altqs = pf_altqs_active;
750 pf_altqs_active = pf_altqs_inactive;
751 pf_altqs_inactive = old_altqs;
752 ticket_altqs_active = ticket_altqs_inactive;
753
754 /* Attach new disciplines */
755 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
756 if (altq->qname[0] == 0) {
757 /* attach the discipline */
758 error = altq_pfattach(altq);
759 if (error == 0 && pf_altq_running)
760 error = pf_enable_altq(altq);
761 if (error != 0) {
762 splx(s);
763 return (error);
764 }
765 }
766 }
767
768 /* Purge the old altq list */
769 while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
770 TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
771 if (altq->qname[0] == 0) {
772 /* detach and destroy the discipline */
773 if (pf_altq_running)
774 error = pf_disable_altq(altq);
775 err = altq_pfdetach(altq);
776 if (err != 0 && error == 0)
777 error = err;
778 err = altq_remove(altq);
779 if (err != 0 && error == 0)
780 error = err;
781 } else
782 pf_qid_unref(altq->qid);
783 pool_put(&pf_altq_pl, altq);
784 }
785 splx(s);
786
787 altqs_inactive_open = 0;
788 return (error);
789 }
790
791 static int
792 pf_enable_altq(struct pf_altq *altq)
793 {
794 struct ifnet *ifp;
795 struct tb_profile tb;
796 int s, error = 0;
797
798 if ((ifp = ifunit(altq->ifname)) == NULL)
799 return (EINVAL);
800
801 if (ifp->if_snd.altq_type != ALTQT_NONE)
802 error = altq_enable(&ifp->if_snd);
803
804 /* set tokenbucket regulator */
805 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
806 tb.rate = altq->ifbandwidth;
807 tb.depth = altq->tbrsize;
808 s = splnet();
809 error = tbr_set(&ifp->if_snd, &tb);
810 splx(s);
811 }
812
813 return (error);
814 }
815
816 static int
817 pf_disable_altq(struct pf_altq *altq)
818 {
819 struct ifnet *ifp;
820 struct tb_profile tb;
821 int s, error;
822
823 if ((ifp = ifunit(altq->ifname)) == NULL)
824 return (EINVAL);
825
826 /*
827 * when the discipline is no longer referenced, it was overridden
828 * by a new one. if so, just return.
829 */
830 if (altq->altq_disc != ifp->if_snd.altq_disc)
831 return (0);
832
833 error = altq_disable(&ifp->if_snd);
834
835 if (error == 0) {
836 /* clear tokenbucket regulator */
837 tb.rate = 0;
838 s = splnet();
839 error = tbr_set(&ifp->if_snd, &tb);
840 splx(s);
841 }
842
843 return (error);
844 }
845 #endif /* ALTQ */
846
847 static int
848 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
849 {
850 struct pf_ruleset *rs;
851 struct pf_rule *rule;
852
853 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
854 return (EINVAL);
855 rs = pf_find_or_create_ruleset(anchor);
856 if (rs == NULL)
857 return (EINVAL);
858 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
859 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
860 rs->rules[rs_num].inactive.rcount--;
861 }
862 *ticket = ++rs->rules[rs_num].inactive.ticket;
863 rs->rules[rs_num].inactive.open = 1;
864 return (0);
865 }
866
867 static int
868 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
869 {
870 struct pf_ruleset *rs;
871 struct pf_rule *rule;
872
873 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
874 return (EINVAL);
875 rs = pf_find_ruleset(anchor);
876 if (rs == NULL || !rs->rules[rs_num].inactive.open ||
877 rs->rules[rs_num].inactive.ticket != ticket)
878 return (0);
879 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
880 pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
881 rs->rules[rs_num].inactive.rcount--;
882 }
883 rs->rules[rs_num].inactive.open = 0;
884 return (0);
885 }
886
887 #define PF_MD5_UPD(st, elm) \
888 MD5Update(ctx, (u_int8_t *)&(st)->elm, sizeof ((st)->elm))
889
890 #define PF_MD5_UPD_STR(st, elm) \
891 MD5Update(ctx, (u_int8_t *)(st)->elm, strlen((st)->elm))
892
893 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \
894 (stor) = htonl((st)->elm); \
895 MD5Update(ctx, (u_int8_t *)&(stor), sizeof (u_int32_t)); \
896 } while (0)
897
898 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \
899 (stor) = htons((st)->elm); \
900 MD5Update(ctx, (u_int8_t *)&(stor), sizeof (u_int16_t)); \
901 } while (0)
902
903 #ifndef NO_APPLE_EXTENSIONS
904 static void
905 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr, u_int8_t proto)
906 #else
907 static void
908 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
909 #endif
910 {
911 PF_MD5_UPD(pfr, addr.type);
912 switch (pfr->addr.type) {
913 case PF_ADDR_DYNIFTL:
914 PF_MD5_UPD(pfr, addr.v.ifname);
915 PF_MD5_UPD(pfr, addr.iflags);
916 break;
917 case PF_ADDR_TABLE:
918 PF_MD5_UPD(pfr, addr.v.tblname);
919 break;
920 case PF_ADDR_ADDRMASK:
921 /* XXX ignore af? */
922 PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
923 PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
924 break;
925 case PF_ADDR_RTLABEL:
926 PF_MD5_UPD(pfr, addr.v.rtlabelname);
927 break;
928 }
929
930 #ifndef NO_APPLE_EXTENSIONS
931 switch (proto) {
932 case IPPROTO_TCP:
933 case IPPROTO_UDP:
934 PF_MD5_UPD(pfr, xport.range.port[0]);
935 PF_MD5_UPD(pfr, xport.range.port[1]);
936 PF_MD5_UPD(pfr, xport.range.op);
937 break;
938
939 default:
940 break;
941 }
942
943 PF_MD5_UPD(pfr, neg);
944 #else
945 PF_MD5_UPD(pfr, port[0]);
946 PF_MD5_UPD(pfr, port[1]);
947 PF_MD5_UPD(pfr, neg);
948 PF_MD5_UPD(pfr, port_op);
949 #endif
950 }
951
952 static void
953 pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule)
954 {
955 u_int16_t x;
956 u_int32_t y;
957
958 #ifndef NO_APPLE_EXTENSIONS
959 pf_hash_rule_addr(ctx, &rule->src, rule->proto);
960 pf_hash_rule_addr(ctx, &rule->dst, rule->proto);
961 #else
962 pf_hash_rule_addr(ctx, &rule->src);
963 pf_hash_rule_addr(ctx, &rule->dst);
964 #endif
965 PF_MD5_UPD_STR(rule, label);
966 PF_MD5_UPD_STR(rule, ifname);
967 PF_MD5_UPD_STR(rule, match_tagname);
968 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
969 PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
970 PF_MD5_UPD_HTONL(rule, prob, y);
971 PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
972 PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
973 PF_MD5_UPD(rule, uid.op);
974 PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
975 PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
976 PF_MD5_UPD(rule, gid.op);
977 PF_MD5_UPD_HTONL(rule, rule_flag, y);
978 PF_MD5_UPD(rule, action);
979 PF_MD5_UPD(rule, direction);
980 PF_MD5_UPD(rule, af);
981 PF_MD5_UPD(rule, quick);
982 PF_MD5_UPD(rule, ifnot);
983 PF_MD5_UPD(rule, match_tag_not);
984 PF_MD5_UPD(rule, natpass);
985 PF_MD5_UPD(rule, keep_state);
986 PF_MD5_UPD(rule, proto);
987 PF_MD5_UPD(rule, type);
988 PF_MD5_UPD(rule, code);
989 PF_MD5_UPD(rule, flags);
990 PF_MD5_UPD(rule, flagset);
991 PF_MD5_UPD(rule, allow_opts);
992 PF_MD5_UPD(rule, rt);
993 PF_MD5_UPD(rule, tos);
994 }
995
996 static int
997 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
998 {
999 struct pf_ruleset *rs;
1000 struct pf_rule *rule, **old_array;
1001 struct pf_rulequeue *old_rules;
1002 int error;
1003 u_int32_t old_rcount;
1004
1005 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED);
1006
1007 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
1008 return (EINVAL);
1009 rs = pf_find_ruleset(anchor);
1010 if (rs == NULL || !rs->rules[rs_num].inactive.open ||
1011 ticket != rs->rules[rs_num].inactive.ticket)
1012 return (EBUSY);
1013
1014 /* Calculate checksum for the main ruleset */
1015 if (rs == &pf_main_ruleset) {
1016 error = pf_setup_pfsync_matching(rs);
1017 if (error != 0)
1018 return (error);
1019 }
1020
1021 /* Swap rules, keep the old. */
1022 old_rules = rs->rules[rs_num].active.ptr;
1023 old_rcount = rs->rules[rs_num].active.rcount;
1024 old_array = rs->rules[rs_num].active.ptr_array;
1025
1026 rs->rules[rs_num].active.ptr =
1027 rs->rules[rs_num].inactive.ptr;
1028 rs->rules[rs_num].active.ptr_array =
1029 rs->rules[rs_num].inactive.ptr_array;
1030 rs->rules[rs_num].active.rcount =
1031 rs->rules[rs_num].inactive.rcount;
1032 rs->rules[rs_num].inactive.ptr = old_rules;
1033 rs->rules[rs_num].inactive.ptr_array = old_array;
1034 rs->rules[rs_num].inactive.rcount = old_rcount;
1035
1036 rs->rules[rs_num].active.ticket =
1037 rs->rules[rs_num].inactive.ticket;
1038 pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
1039
1040
1041 /* Purge the old rule list. */
1042 while ((rule = TAILQ_FIRST(old_rules)) != NULL)
1043 pf_rm_rule(old_rules, rule);
1044 if (rs->rules[rs_num].inactive.ptr_array)
1045 _FREE(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
1046 rs->rules[rs_num].inactive.ptr_array = NULL;
1047 rs->rules[rs_num].inactive.rcount = 0;
1048 rs->rules[rs_num].inactive.open = 0;
1049 pf_remove_if_empty_ruleset(rs);
1050 return (0);
1051 }
1052
1053 static void
1054 pf_state_export(struct pfsync_state *sp, struct pf_state_key *sk,
1055 struct pf_state *s)
1056 {
1057 uint64_t secs = pf_time_second();
1058 bzero(sp, sizeof (struct pfsync_state));
1059
1060 /* copy from state key */
1061 #ifndef NO_APPLE_EXTENSIONS
1062 sp->lan.addr = sk->lan.addr;
1063 sp->lan.xport = sk->lan.xport;
1064 sp->gwy.addr = sk->gwy.addr;
1065 sp->gwy.xport = sk->gwy.xport;
1066 sp->ext.addr = sk->ext.addr;
1067 sp->ext.xport = sk->ext.xport;
1068 sp->proto_variant = sk->proto_variant;
1069 sp->tag = s->tag;
1070 #else
1071 sp->lan.addr = sk->lan.addr;
1072 sp->lan.port = sk->lan.port;
1073 sp->gwy.addr = sk->gwy.addr;
1074 sp->gwy.port = sk->gwy.port;
1075 sp->ext.addr = sk->ext.addr;
1076 sp->ext.port = sk->ext.port;
1077 #endif
1078 sp->proto = sk->proto;
1079 sp->af = sk->af;
1080 sp->direction = sk->direction;
1081
1082 /* copy from state */
1083 memcpy(&sp->id, &s->id, sizeof (sp->id));
1084 sp->creatorid = s->creatorid;
1085 strlcpy(sp->ifname, s->kif->pfik_name, sizeof (sp->ifname));
1086 pf_state_peer_to_pfsync(&s->src, &sp->src);
1087 pf_state_peer_to_pfsync(&s->dst, &sp->dst);
1088
1089 sp->rule = s->rule.ptr->nr;
1090 sp->nat_rule = (s->nat_rule.ptr == NULL) ?
1091 (unsigned)-1 : s->nat_rule.ptr->nr;
1092 sp->anchor = (s->anchor.ptr == NULL) ?
1093 (unsigned)-1 : s->anchor.ptr->nr;
1094
1095 pf_state_counter_to_pfsync(s->bytes[0], sp->bytes[0]);
1096 pf_state_counter_to_pfsync(s->bytes[1], sp->bytes[1]);
1097 pf_state_counter_to_pfsync(s->packets[0], sp->packets[0]);
1098 pf_state_counter_to_pfsync(s->packets[1], sp->packets[1]);
1099 sp->creation = secs - s->creation;
1100 sp->expire = pf_state_expires(s);
1101 sp->log = s->log;
1102 sp->allow_opts = s->allow_opts;
1103 sp->timeout = s->timeout;
1104
1105 if (s->src_node)
1106 sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
1107 if (s->nat_src_node)
1108 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
1109
1110 if (sp->expire > secs)
1111 sp->expire -= secs;
1112 else
1113 sp->expire = 0;
1114
1115 }
1116
1117 static void
1118 pf_state_import(struct pfsync_state *sp, struct pf_state_key *sk,
1119 struct pf_state *s)
1120 {
1121 /* copy to state key */
1122 #ifndef NO_APPLE_EXTENSIONS
1123 sk->lan.addr = sp->lan.addr;
1124 sk->lan.xport = sp->lan.xport;
1125 sk->gwy.addr = sp->gwy.addr;
1126 sk->gwy.xport = sp->gwy.xport;
1127 sk->ext.addr = sp->ext.addr;
1128 sk->ext.xport = sp->ext.xport;
1129 sk->proto_variant = sp->proto_variant;
1130 s->tag = sp->tag;
1131 #else
1132 sk->lan.addr = sp->lan.addr;
1133 sk->lan.port = sp->lan.port;
1134 sk->gwy.addr = sp->gwy.addr;
1135 sk->gwy.port = sp->gwy.port;
1136 sk->ext.addr = sp->ext.addr;
1137 sk->ext.port = sp->ext.port;
1138 #endif
1139 sk->proto = sp->proto;
1140 sk->af = sp->af;
1141 sk->direction = sp->direction;
1142
1143 /* copy to state */
1144 memcpy(&s->id, &sp->id, sizeof (sp->id));
1145 s->creatorid = sp->creatorid;
1146 pf_state_peer_from_pfsync(&sp->src, &s->src);
1147 pf_state_peer_from_pfsync(&sp->dst, &s->dst);
1148
1149 s->rule.ptr = &pf_default_rule;
1150 s->nat_rule.ptr = NULL;
1151 s->anchor.ptr = NULL;
1152 s->rt_kif = NULL;
1153 s->creation = pf_time_second();
1154 s->expire = pf_time_second();
1155 if (sp->expire > 0)
1156 s->expire -= pf_default_rule.timeout[sp->timeout] - sp->expire;
1157 s->pfsync_time = 0;
1158 s->packets[0] = s->packets[1] = 0;
1159 s->bytes[0] = s->bytes[1] = 0;
1160 }
1161
1162 static int
1163 pf_setup_pfsync_matching(struct pf_ruleset *rs)
1164 {
1165 MD5_CTX ctx;
1166 struct pf_rule *rule;
1167 int rs_cnt;
1168 u_int8_t digest[PF_MD5_DIGEST_LENGTH];
1169
1170 MD5Init(&ctx);
1171 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
1172 /* XXX PF_RULESET_SCRUB as well? */
1173 if (rs_cnt == PF_RULESET_SCRUB)
1174 continue;
1175
1176 if (rs->rules[rs_cnt].inactive.ptr_array)
1177 _FREE(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
1178 rs->rules[rs_cnt].inactive.ptr_array = NULL;
1179
1180 if (rs->rules[rs_cnt].inactive.rcount) {
1181 rs->rules[rs_cnt].inactive.ptr_array =
1182 _MALLOC(sizeof (caddr_t) *
1183 rs->rules[rs_cnt].inactive.rcount,
1184 M_TEMP, M_WAITOK);
1185
1186 if (!rs->rules[rs_cnt].inactive.ptr_array)
1187 return (ENOMEM);
1188 }
1189
1190 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
1191 entries) {
1192 pf_hash_rule(&ctx, rule);
1193 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
1194 }
1195 }
1196
1197 MD5Final(digest, &ctx);
1198 memcpy(pf_status.pf_chksum, digest, sizeof (pf_status.pf_chksum));
1199 return (0);
1200 }
1201
1202 static int
1203 pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
1204 {
1205 #pragma unused(dev)
1206 struct pf_pooladdr *pa = NULL;
1207 struct pf_pool *pool = NULL;
1208 int error = 0;
1209
1210 if (kauth_cred_issuser(kauth_cred_get()) == 0)
1211 return (EPERM);
1212
1213 /* XXX keep in sync with switch() below */
1214 if (securelevel > 1)
1215 switch (cmd) {
1216 case DIOCGETRULES:
1217 case DIOCGETRULE:
1218 case DIOCGETADDRS:
1219 case DIOCGETADDR:
1220 case DIOCGETSTATE:
1221 case DIOCSETSTATUSIF:
1222 case DIOCGETSTATUS:
1223 case DIOCCLRSTATUS:
1224 case DIOCNATLOOK:
1225 case DIOCSETDEBUG:
1226 case DIOCGETSTATES:
1227 case DIOCGETTIMEOUT:
1228 case DIOCCLRRULECTRS:
1229 case DIOCGETLIMIT:
1230 case DIOCGETALTQS:
1231 case DIOCGETALTQ:
1232 case DIOCGETQSTATS:
1233 case DIOCGETRULESETS:
1234 case DIOCGETRULESET:
1235 case DIOCRGETTABLES:
1236 case DIOCRGETTSTATS:
1237 case DIOCRCLRTSTATS:
1238 case DIOCRCLRADDRS:
1239 case DIOCRADDADDRS:
1240 case DIOCRDELADDRS:
1241 case DIOCRSETADDRS:
1242 case DIOCRGETADDRS:
1243 case DIOCRGETASTATS:
1244 case DIOCRCLRASTATS:
1245 case DIOCRTSTADDRS:
1246 case DIOCOSFPGET:
1247 case DIOCGETSRCNODES:
1248 case DIOCCLRSRCNODES:
1249 case DIOCIGETIFACES:
1250 case DIOCSETIFFLAG:
1251 case DIOCCLRIFFLAG:
1252 break;
1253 case DIOCRCLRTABLES:
1254 case DIOCRADDTABLES:
1255 case DIOCRDELTABLES:
1256 case DIOCRSETTFLAGS:
1257 if (((struct pfioc_table *)addr)->pfrio_flags &
1258 PFR_FLAG_DUMMY)
1259 break; /* dummy operation ok */
1260 return (EPERM);
1261 default:
1262 return (EPERM);
1263 }
1264
1265 if (!(flags & FWRITE))
1266 switch (cmd) {
1267 case DIOCSTART:
1268 case DIOCSTOP:
1269 case DIOCGETRULES:
1270 case DIOCGETADDRS:
1271 case DIOCGETADDR:
1272 case DIOCGETSTATE:
1273 case DIOCGETSTATUS:
1274 case DIOCGETSTATES:
1275 case DIOCGETTIMEOUT:
1276 case DIOCGETLIMIT:
1277 case DIOCGETALTQS:
1278 case DIOCGETALTQ:
1279 case DIOCGETQSTATS:
1280 case DIOCGETRULESETS:
1281 case DIOCGETRULESET:
1282 case DIOCNATLOOK:
1283 case DIOCRGETTABLES:
1284 case DIOCRGETTSTATS:
1285 case DIOCRGETADDRS:
1286 case DIOCRGETASTATS:
1287 case DIOCRTSTADDRS:
1288 case DIOCOSFPGET:
1289 case DIOCGETSRCNODES:
1290 case DIOCIGETIFACES:
1291 break;
1292 case DIOCRCLRTABLES:
1293 case DIOCRADDTABLES:
1294 case DIOCRDELTABLES:
1295 case DIOCRCLRTSTATS:
1296 case DIOCRCLRADDRS:
1297 case DIOCRADDADDRS:
1298 case DIOCRDELADDRS:
1299 case DIOCRSETADDRS:
1300 case DIOCRSETTFLAGS:
1301 if (((struct pfioc_table *)addr)->pfrio_flags &
1302 PFR_FLAG_DUMMY) {
1303 flags |= FWRITE; /* need write lock for dummy */
1304 break; /* dummy operation ok */
1305 }
1306 return (EACCES);
1307 case DIOCGETRULE:
1308 if (((struct pfioc_rule *)addr)->action ==
1309 PF_GET_CLR_CNTR)
1310 return (EACCES);
1311 break;
1312 default:
1313 return (EACCES);
1314 }
1315
1316 if (flags & FWRITE)
1317 lck_rw_lock_exclusive(pf_perim_lock);
1318 else
1319 lck_rw_lock_shared(pf_perim_lock);
1320
1321 lck_mtx_lock(pf_lock);
1322
1323 switch (cmd) {
1324
1325 case DIOCSTART:
1326 if (pf_status.running) {
1327 error = EEXIST;
1328 } else if (pf_purge_thread == NULL) {
1329 error = ENOMEM;
1330 } else {
1331 pf_status.running = 1;
1332 pf_status.since = pf_time_second();
1333 if (pf_status.stateid == 0) {
1334 pf_status.stateid = pf_time_second();
1335 pf_status.stateid = pf_status.stateid << 32;
1336 }
1337 mbuf_growth_aggressive();
1338 pf_attach_hooks();
1339 wakeup(pf_purge_thread_fn);
1340 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
1341 }
1342 break;
1343
1344 case DIOCSTOP:
1345 if (!pf_status.running) {
1346 error = ENOENT;
1347 } else {
1348 mbuf_growth_normal();
1349 pf_detach_hooks();
1350 pf_status.running = 0;
1351 pf_status.since = pf_time_second();
1352 wakeup(pf_purge_thread_fn);
1353 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
1354 }
1355 break;
1356
1357 case DIOCADDRULE: {
1358 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
1359 struct pf_ruleset *ruleset;
1360 struct pf_rule *rule, *tail;
1361 struct pf_pooladdr *apa;
1362 int rs_num;
1363
1364 pr->anchor[sizeof (pr->anchor) - 1] = 0;
1365 ruleset = pf_find_ruleset(pr->anchor);
1366 if (ruleset == NULL) {
1367 error = EINVAL;
1368 break;
1369 }
1370 rs_num = pf_get_ruleset_number(pr->rule.action);
1371 if (rs_num >= PF_RULESET_MAX) {
1372 error = EINVAL;
1373 break;
1374 }
1375 if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1376 error = EINVAL;
1377 break;
1378 }
1379 if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) {
1380 error = EBUSY;
1381 break;
1382 }
1383 if (pr->pool_ticket != ticket_pabuf) {
1384 error = EBUSY;
1385 break;
1386 }
1387 rule = pool_get(&pf_rule_pl, PR_WAITOK);
1388 if (rule == NULL) {
1389 error = ENOMEM;
1390 break;
1391 }
1392 bcopy(&pr->rule, rule, sizeof (struct pf_rule));
1393 rule->cuid = kauth_cred_getuid(p->p_ucred);
1394 rule->cpid = p->p_pid;
1395 rule->anchor = NULL;
1396 rule->kif = NULL;
1397 TAILQ_INIT(&rule->rpool.list);
1398 /* initialize refcounting */
1399 rule->states = 0;
1400 rule->src_nodes = 0;
1401 rule->entries.tqe_prev = NULL;
1402 #if !INET
1403 if (rule->af == AF_INET) {
1404 pool_put(&pf_rule_pl, rule);
1405 error = EAFNOSUPPORT;
1406 break;
1407 }
1408 #endif /* INET */
1409 #if !INET6
1410 if (rule->af == AF_INET6) {
1411 pool_put(&pf_rule_pl, rule);
1412 error = EAFNOSUPPORT;
1413 break;
1414 }
1415 #endif /* INET6 */
1416 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
1417 pf_rulequeue);
1418 if (tail)
1419 rule->nr = tail->nr + 1;
1420 else
1421 rule->nr = 0;
1422 if (rule->ifname[0]) {
1423 rule->kif = pfi_kif_get(rule->ifname);
1424 if (rule->kif == NULL) {
1425 pool_put(&pf_rule_pl, rule);
1426 error = EINVAL;
1427 break;
1428 }
1429 pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE);
1430 }
1431
1432 #if ALTQ
1433 /* set queue IDs */
1434 if (rule->qname[0] != 0) {
1435 if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
1436 error = EBUSY;
1437 else if (rule->pqname[0] != 0) {
1438 if ((rule->pqid =
1439 pf_qname2qid(rule->pqname)) == 0)
1440 error = EBUSY;
1441 } else
1442 rule->pqid = rule->qid;
1443 }
1444 #endif /* ALTQ */
1445 if (rule->tagname[0])
1446 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
1447 error = EBUSY;
1448 if (rule->match_tagname[0])
1449 if ((rule->match_tag =
1450 pf_tagname2tag(rule->match_tagname)) == 0)
1451 error = EBUSY;
1452 if (rule->rt && !rule->direction)
1453 error = EINVAL;
1454 #if PFLOG
1455 if (!rule->log)
1456 rule->logif = 0;
1457 if (rule->logif >= PFLOGIFS_MAX)
1458 error = EINVAL;
1459 #endif /* PFLOG */
1460 if (pf_rtlabel_add(&rule->src.addr) ||
1461 pf_rtlabel_add(&rule->dst.addr))
1462 error = EBUSY;
1463 if (pfi_dynaddr_setup(&rule->src.addr, rule->af))
1464 error = EINVAL;
1465 if (pfi_dynaddr_setup(&rule->dst.addr, rule->af))
1466 error = EINVAL;
1467 if (pf_tbladdr_setup(ruleset, &rule->src.addr))
1468 error = EINVAL;
1469 if (pf_tbladdr_setup(ruleset, &rule->dst.addr))
1470 error = EINVAL;
1471 if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
1472 error = EINVAL;
1473 TAILQ_FOREACH(apa, &pf_pabuf, entries)
1474 if (pf_tbladdr_setup(ruleset, &apa->addr))
1475 error = EINVAL;
1476
1477 if (rule->overload_tblname[0]) {
1478 if ((rule->overload_tbl = pfr_attach_table(ruleset,
1479 rule->overload_tblname)) == NULL)
1480 error = EINVAL;
1481 else
1482 rule->overload_tbl->pfrkt_flags |=
1483 PFR_TFLAG_ACTIVE;
1484 }
1485
1486 pf_mv_pool(&pf_pabuf, &rule->rpool.list);
1487 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
1488 (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
1489 (rule->rt > PF_FASTROUTE)) &&
1490 (TAILQ_FIRST(&rule->rpool.list) == NULL))
1491 error = EINVAL;
1492
1493 if (error) {
1494 pf_rm_rule(NULL, rule);
1495 break;
1496 }
1497 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
1498 rule->evaluations = rule->packets[0] = rule->packets[1] =
1499 rule->bytes[0] = rule->bytes[1] = 0;
1500 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
1501 rule, entries);
1502 ruleset->rules[rs_num].inactive.rcount++;
1503 break;
1504 }
1505
1506 case DIOCGETRULES: {
1507 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
1508 struct pf_ruleset *ruleset;
1509 struct pf_rule *tail;
1510 int rs_num;
1511
1512 pr->anchor[sizeof (pr->anchor) - 1] = 0;
1513 ruleset = pf_find_ruleset(pr->anchor);
1514 if (ruleset == NULL) {
1515 error = EINVAL;
1516 break;
1517 }
1518 rs_num = pf_get_ruleset_number(pr->rule.action);
1519 if (rs_num >= PF_RULESET_MAX) {
1520 error = EINVAL;
1521 break;
1522 }
1523 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
1524 pf_rulequeue);
1525 if (tail)
1526 pr->nr = tail->nr + 1;
1527 else
1528 pr->nr = 0;
1529 pr->ticket = ruleset->rules[rs_num].active.ticket;
1530 break;
1531 }
1532
1533 case DIOCGETRULE: {
1534 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
1535 struct pf_ruleset *ruleset;
1536 struct pf_rule *rule;
1537 int rs_num, i;
1538
1539 pr->anchor[sizeof (pr->anchor) - 1] = 0;
1540 ruleset = pf_find_ruleset(pr->anchor);
1541 if (ruleset == NULL) {
1542 error = EINVAL;
1543 break;
1544 }
1545 rs_num = pf_get_ruleset_number(pr->rule.action);
1546 if (rs_num >= PF_RULESET_MAX) {
1547 error = EINVAL;
1548 break;
1549 }
1550 if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
1551 error = EBUSY;
1552 break;
1553 }
1554 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
1555 while ((rule != NULL) && (rule->nr != pr->nr))
1556 rule = TAILQ_NEXT(rule, entries);
1557 if (rule == NULL) {
1558 error = EBUSY;
1559 break;
1560 }
1561 bcopy(rule, &pr->rule, sizeof (struct pf_rule));
1562 if (pf_anchor_copyout(ruleset, rule, pr)) {
1563 error = EBUSY;
1564 break;
1565 }
1566 pfi_dynaddr_copyout(&pr->rule.src.addr);
1567 pfi_dynaddr_copyout(&pr->rule.dst.addr);
1568 pf_tbladdr_copyout(&pr->rule.src.addr);
1569 pf_tbladdr_copyout(&pr->rule.dst.addr);
1570 pf_rtlabel_copyout(&pr->rule.src.addr);
1571 pf_rtlabel_copyout(&pr->rule.dst.addr);
1572 for (i = 0; i < PF_SKIP_COUNT; ++i)
1573 if (rule->skip[i].ptr == NULL)
1574 pr->rule.skip[i].nr = -1;
1575 else
1576 pr->rule.skip[i].nr =
1577 rule->skip[i].ptr->nr;
1578
1579 if (pr->action == PF_GET_CLR_CNTR) {
1580 rule->evaluations = 0;
1581 rule->packets[0] = rule->packets[1] = 0;
1582 rule->bytes[0] = rule->bytes[1] = 0;
1583 }
1584 break;
1585 }
1586
1587 case DIOCCHANGERULE: {
1588 struct pfioc_rule *pcr = (struct pfioc_rule *)addr;
1589 struct pf_ruleset *ruleset;
1590 struct pf_rule *oldrule = NULL, *newrule = NULL;
1591 u_int32_t nr = 0;
1592 int rs_num;
1593
1594 if (!(pcr->action == PF_CHANGE_REMOVE ||
1595 pcr->action == PF_CHANGE_GET_TICKET) &&
1596 pcr->pool_ticket != ticket_pabuf) {
1597 error = EBUSY;
1598 break;
1599 }
1600
1601 if (pcr->action < PF_CHANGE_ADD_HEAD ||
1602 pcr->action > PF_CHANGE_GET_TICKET) {
1603 error = EINVAL;
1604 break;
1605 }
1606 ruleset = pf_find_ruleset(pcr->anchor);
1607 if (ruleset == NULL) {
1608 error = EINVAL;
1609 break;
1610 }
1611 rs_num = pf_get_ruleset_number(pcr->rule.action);
1612 if (rs_num >= PF_RULESET_MAX) {
1613 error = EINVAL;
1614 break;
1615 }
1616
1617 if (pcr->action == PF_CHANGE_GET_TICKET) {
1618 pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
1619 break;
1620 } else {
1621 if (pcr->ticket !=
1622 ruleset->rules[rs_num].active.ticket) {
1623 error = EINVAL;
1624 break;
1625 }
1626 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
1627 error = EINVAL;
1628 break;
1629 }
1630 }
1631
1632 if (pcr->action != PF_CHANGE_REMOVE) {
1633 newrule = pool_get(&pf_rule_pl, PR_WAITOK);
1634 if (newrule == NULL) {
1635 error = ENOMEM;
1636 break;
1637 }
1638 bcopy(&pcr->rule, newrule, sizeof (struct pf_rule));
1639 newrule->cuid = kauth_cred_getuid(p->p_ucred);
1640 newrule->cpid = p->p_pid;
1641 TAILQ_INIT(&newrule->rpool.list);
1642 /* initialize refcounting */
1643 newrule->states = 0;
1644 newrule->entries.tqe_prev = NULL;
1645 #if !INET
1646 if (newrule->af == AF_INET) {
1647 pool_put(&pf_rule_pl, newrule);
1648 error = EAFNOSUPPORT;
1649 break;
1650 }
1651 #endif /* INET */
1652 #if !INET6
1653 if (newrule->af == AF_INET6) {
1654 pool_put(&pf_rule_pl, newrule);
1655 error = EAFNOSUPPORT;
1656 break;
1657 }
1658 #endif /* INET6 */
1659 if (newrule->ifname[0]) {
1660 newrule->kif = pfi_kif_get(newrule->ifname);
1661 if (newrule->kif == NULL) {
1662 pool_put(&pf_rule_pl, newrule);
1663 error = EINVAL;
1664 break;
1665 }
1666 pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE);
1667 } else
1668 newrule->kif = NULL;
1669
1670 #if ALTQ
1671 /* set queue IDs */
1672 if (newrule->qname[0] != 0) {
1673 if ((newrule->qid =
1674 pf_qname2qid(newrule->qname)) == 0)
1675 error = EBUSY;
1676 else if (newrule->pqname[0] != 0) {
1677 if ((newrule->pqid =
1678 pf_qname2qid(newrule->pqname)) == 0)
1679 error = EBUSY;
1680 } else
1681 newrule->pqid = newrule->qid;
1682 }
1683 #endif /* ALTQ */
1684 if (newrule->tagname[0])
1685 if ((newrule->tag =
1686 pf_tagname2tag(newrule->tagname)) == 0)
1687 error = EBUSY;
1688 if (newrule->match_tagname[0])
1689 if ((newrule->match_tag = pf_tagname2tag(
1690 newrule->match_tagname)) == 0)
1691 error = EBUSY;
1692 if (newrule->rt && !newrule->direction)
1693 error = EINVAL;
1694 #if PFLOG
1695 if (!newrule->log)
1696 newrule->logif = 0;
1697 if (newrule->logif >= PFLOGIFS_MAX)
1698 error = EINVAL;
1699 #endif /* PFLOG */
1700 if (pf_rtlabel_add(&newrule->src.addr) ||
1701 pf_rtlabel_add(&newrule->dst.addr))
1702 error = EBUSY;
1703 if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af))
1704 error = EINVAL;
1705 if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af))
1706 error = EINVAL;
1707 if (pf_tbladdr_setup(ruleset, &newrule->src.addr))
1708 error = EINVAL;
1709 if (pf_tbladdr_setup(ruleset, &newrule->dst.addr))
1710 error = EINVAL;
1711 if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
1712 error = EINVAL;
1713 TAILQ_FOREACH(pa, &pf_pabuf, entries)
1714 if (pf_tbladdr_setup(ruleset, &pa->addr))
1715 error = EINVAL;
1716
1717 if (newrule->overload_tblname[0]) {
1718 if ((newrule->overload_tbl = pfr_attach_table(
1719 ruleset, newrule->overload_tblname)) ==
1720 NULL)
1721 error = EINVAL;
1722 else
1723 newrule->overload_tbl->pfrkt_flags |=
1724 PFR_TFLAG_ACTIVE;
1725 }
1726
1727 pf_mv_pool(&pf_pabuf, &newrule->rpool.list);
1728 if (((((newrule->action == PF_NAT) ||
1729 (newrule->action == PF_RDR) ||
1730 (newrule->action == PF_BINAT) ||
1731 (newrule->rt > PF_FASTROUTE)) &&
1732 !newrule->anchor)) &&
1733 (TAILQ_FIRST(&newrule->rpool.list) == NULL))
1734 error = EINVAL;
1735
1736 if (error) {
1737 pf_rm_rule(NULL, newrule);
1738 break;
1739 }
1740 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
1741 newrule->evaluations = 0;
1742 newrule->packets[0] = newrule->packets[1] = 0;
1743 newrule->bytes[0] = newrule->bytes[1] = 0;
1744 }
1745 pf_empty_pool(&pf_pabuf);
1746
1747 if (pcr->action == PF_CHANGE_ADD_HEAD)
1748 oldrule = TAILQ_FIRST(
1749 ruleset->rules[rs_num].active.ptr);
1750 else if (pcr->action == PF_CHANGE_ADD_TAIL)
1751 oldrule = TAILQ_LAST(
1752 ruleset->rules[rs_num].active.ptr, pf_rulequeue);
1753 else {
1754 oldrule = TAILQ_FIRST(
1755 ruleset->rules[rs_num].active.ptr);
1756 while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
1757 oldrule = TAILQ_NEXT(oldrule, entries);
1758 if (oldrule == NULL) {
1759 if (newrule != NULL)
1760 pf_rm_rule(NULL, newrule);
1761 error = EINVAL;
1762 break;
1763 }
1764 }
1765
1766 if (pcr->action == PF_CHANGE_REMOVE) {
1767 pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule);
1768 ruleset->rules[rs_num].active.rcount--;
1769 } else {
1770 if (oldrule == NULL)
1771 TAILQ_INSERT_TAIL(
1772 ruleset->rules[rs_num].active.ptr,
1773 newrule, entries);
1774 else if (pcr->action == PF_CHANGE_ADD_HEAD ||
1775 pcr->action == PF_CHANGE_ADD_BEFORE)
1776 TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
1777 else
1778 TAILQ_INSERT_AFTER(
1779 ruleset->rules[rs_num].active.ptr,
1780 oldrule, newrule, entries);
1781 ruleset->rules[rs_num].active.rcount++;
1782 }
1783
1784 nr = 0;
1785 TAILQ_FOREACH(oldrule,
1786 ruleset->rules[rs_num].active.ptr, entries)
1787 oldrule->nr = nr++;
1788
1789 ruleset->rules[rs_num].active.ticket++;
1790
1791 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
1792 pf_remove_if_empty_ruleset(ruleset);
1793
1794 break;
1795 }
1796
1797 case DIOCCLRSTATES: {
1798 struct pf_state *s, *nexts;
1799 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1800 int killed = 0;
1801
1802 for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) {
1803 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1804
1805 if (!psk->psk_ifname[0] || strcmp(psk->psk_ifname,
1806 s->kif->pfik_name) == 0) {
1807 #if NPFSYNC
1808 /* don't send out individual delete messages */
1809 s->sync_flags = PFSTATE_NOSYNC;
1810 #endif
1811 pf_unlink_state(s);
1812 killed++;
1813 }
1814 }
1815 psk->psk_af = killed;
1816 #if NPFSYNC
1817 pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
1818 #endif
1819 break;
1820 }
1821
1822 case DIOCKILLSTATES: {
1823 struct pf_state *s, *nexts;
1824 struct pf_state_key *sk;
1825 struct pf_state_host *src, *dst;
1826 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
1827 int killed = 0;
1828
1829 for (s = RB_MIN(pf_state_tree_id, &tree_id); s;
1830 s = nexts) {
1831 nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
1832 sk = s->state_key;
1833
1834 if (sk->direction == PF_OUT) {
1835 src = &sk->lan;
1836 dst = &sk->ext;
1837 } else {
1838 src = &sk->ext;
1839 dst = &sk->lan;
1840 }
1841 if ((!psk->psk_af || sk->af == psk->psk_af) &&
1842 (!psk->psk_proto || psk->psk_proto == sk->proto) &&
1843 PF_MATCHA(psk->psk_src.neg,
1844 &psk->psk_src.addr.v.a.addr,
1845 &psk->psk_src.addr.v.a.mask,
1846 &src->addr, sk->af) &&
1847 PF_MATCHA(psk->psk_dst.neg,
1848 &psk->psk_dst.addr.v.a.addr,
1849 &psk->psk_dst.addr.v.a.mask,
1850 &dst->addr, sk->af) &&
1851 #ifndef NO_APPLE_EXTENSIONS
1852 (pf_match_xport(psk->psk_proto,
1853 psk->psk_proto_variant, &psk->psk_src.xport,
1854 &src->xport)) &&
1855 (pf_match_xport(psk->psk_proto,
1856 psk->psk_proto_variant, &psk->psk_dst.xport,
1857 &dst->xport)) &&
1858 #else
1859 (psk->psk_src.port_op == 0 ||
1860 pf_match_port(psk->psk_src.port_op,
1861 psk->psk_src.port[0], psk->psk_src.port[1],
1862 src->port)) &&
1863 (psk->psk_dst.port_op == 0 ||
1864 pf_match_port(psk->psk_dst.port_op,
1865 psk->psk_dst.port[0], psk->psk_dst.port[1],
1866 dst->port)) &&
1867 #endif
1868 (!psk->psk_ifname[0] || strcmp(psk->psk_ifname,
1869 s->kif->pfik_name) == 0)) {
1870 #if NPFSYNC
1871 /* send immediate delete of state */
1872 pfsync_delete_state(s);
1873 s->sync_flags |= PFSTATE_NOSYNC;
1874 #endif
1875 pf_unlink_state(s);
1876 killed++;
1877 }
1878 }
1879 psk->psk_af = killed;
1880 break;
1881 }
1882
1883 case DIOCADDSTATE: {
1884 struct pfioc_state *ps = (struct pfioc_state *)addr;
1885 struct pfsync_state *sp = &ps->state;
1886 struct pf_state *s;
1887 struct pf_state_key *sk;
1888 struct pfi_kif *kif;
1889
1890 if (sp->timeout >= PFTM_MAX &&
1891 sp->timeout != PFTM_UNTIL_PACKET) {
1892 error = EINVAL;
1893 break;
1894 }
1895 s = pool_get(&pf_state_pl, PR_WAITOK);
1896 if (s == NULL) {
1897 error = ENOMEM;
1898 break;
1899 }
1900 bzero(s, sizeof (struct pf_state));
1901 if ((sk = pf_alloc_state_key(s)) == NULL) {
1902 pool_put(&pf_state_pl, s);
1903 error = ENOMEM;
1904 break;
1905 }
1906 pf_state_import(sp, sk, s);
1907 kif = pfi_kif_get(sp->ifname);
1908 if (kif == NULL) {
1909 pool_put(&pf_state_pl, s);
1910 pool_put(&pf_state_key_pl, sk);
1911 error = ENOENT;
1912 break;
1913 }
1914 #ifndef NO_APPLE_EXTENSIONS
1915 TAILQ_INIT(&s->unlink_hooks);
1916 s->state_key->app_state = 0;
1917 #endif
1918 if (pf_insert_state(kif, s)) {
1919 pfi_kif_unref(kif, PFI_KIF_REF_NONE);
1920 pool_put(&pf_state_pl, s);
1921 error = EEXIST;
1922 break;
1923 }
1924 pf_default_rule.states++;
1925 break;
1926 }
1927
1928 case DIOCGETSTATE: {
1929 struct pfioc_state *ps = (struct pfioc_state *)addr;
1930 struct pf_state *s;
1931 struct pf_state_cmp id_key;
1932
1933 bcopy(ps->state.id, &id_key.id, sizeof (id_key.id));
1934 id_key.creatorid = ps->state.creatorid;
1935
1936 s = pf_find_state_byid(&id_key);
1937 if (s == NULL) {
1938 error = ENOENT;
1939 break;
1940 }
1941
1942 pf_state_export(&ps->state, s->state_key, s);
1943 break;
1944 }
1945
1946 case DIOCGETSTATES: {
1947 struct pfioc_states *ps = (struct pfioc_states *)addr;
1948 struct pf_state *state;
1949 struct pfsync_state *y, *pstore;
1950 u_int32_t nr = 0;
1951
1952 if (ps->ps_len == 0) {
1953 nr = pf_status.states;
1954 ps->ps_len = sizeof (struct pfsync_state) * nr;
1955 break;
1956 }
1957
1958 pstore = _MALLOC(sizeof (*pstore), M_TEMP, M_WAITOK);
1959
1960 y = ps->ps_states;
1961
1962 state = TAILQ_FIRST(&state_list);
1963 while (state) {
1964 if (state->timeout != PFTM_UNLINKED) {
1965 if ((nr+1) * sizeof (*y) > (unsigned)ps->ps_len)
1966 break;
1967
1968 pf_state_export(pstore,
1969 state->state_key, state);
1970 error = copyout(pstore, CAST_USER_ADDR_T(y),
1971 sizeof (*y));
1972 if (error) {
1973 _FREE(pstore, M_TEMP);
1974 goto fail;
1975 }
1976 y++;
1977 nr++;
1978 }
1979 state = TAILQ_NEXT(state, entry_list);
1980 }
1981
1982 ps->ps_len = sizeof (struct pfsync_state) * nr;
1983
1984 _FREE(pstore, M_TEMP);
1985 break;
1986 }
1987
1988 case DIOCGETSTATUS: {
1989 struct pf_status *s = (struct pf_status *)addr;
1990 bcopy(&pf_status, s, sizeof (struct pf_status));
1991 pfi_update_status(s->ifname, s);
1992 break;
1993 }
1994
1995 case DIOCSETSTATUSIF: {
1996 struct pfioc_if *pi = (struct pfioc_if *)addr;
1997
1998 if (pi->ifname[0] == 0) {
1999 bzero(pf_status.ifname, IFNAMSIZ);
2000 break;
2001 }
2002 strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ);
2003 break;
2004 }
2005
2006 case DIOCCLRSTATUS: {
2007 bzero(pf_status.counters, sizeof (pf_status.counters));
2008 bzero(pf_status.fcounters, sizeof (pf_status.fcounters));
2009 bzero(pf_status.scounters, sizeof (pf_status.scounters));
2010 pf_status.since = pf_time_second();
2011 if (*pf_status.ifname)
2012 pfi_update_status(pf_status.ifname, NULL);
2013 break;
2014 }
2015
2016 case DIOCNATLOOK: {
2017 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr;
2018 struct pf_state_key *sk;
2019 struct pf_state *state;
2020 struct pf_state_key_cmp key;
2021 int m = 0, direction = pnl->direction;
2022
2023 key.af = pnl->af;
2024 key.proto = pnl->proto;
2025
2026 #ifndef NO_APPLE_EXTENSIONS
2027 key.proto_variant = pnl->proto_variant;
2028 #endif
2029
2030 if (!pnl->proto ||
2031 PF_AZERO(&pnl->saddr, pnl->af) ||
2032 PF_AZERO(&pnl->daddr, pnl->af) ||
2033 ((pnl->proto == IPPROTO_TCP ||
2034 pnl->proto == IPPROTO_UDP) &&
2035 #ifndef NO_APPLE_EXTENSIONS
2036 (!pnl->dxport.port || !pnl->sxport.port)))
2037 #else
2038 (!pnl->dport || !pnl->sport)))
2039 #endif
2040 error = EINVAL;
2041 else {
2042 /*
2043 * userland gives us source and dest of connection,
2044 * reverse the lookup so we ask for what happens with
2045 * the return traffic, enabling us to find it in the
2046 * state tree.
2047 */
2048 if (direction == PF_IN) {
2049 PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af);
2050 #ifndef NO_APPLE_EXTENSIONS
2051 memcpy(&key.ext.xport, &pnl->dxport,
2052 sizeof (key.ext.xport));
2053 #else
2054 key.ext.port = pnl->dport;
2055 #endif
2056 PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af);
2057 #ifndef NO_APPLE_EXTENSIONS
2058 memcpy(&key.gwy.xport, &pnl->sxport,
2059 sizeof (key.gwy.xport));
2060 #else
2061 key.gwy.port = pnl->sport;
2062 #endif
2063 state = pf_find_state_all(&key, PF_IN, &m);
2064 } else {
2065 PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af);
2066 #ifndef NO_APPLE_EXTENSIONS
2067 memcpy(&key.lan.xport, &pnl->dxport,
2068 sizeof (key.lan.xport));
2069 #else
2070 key.lan.port = pnl->dport;
2071 #endif
2072 PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af);
2073 #ifndef NO_APPLE_EXTENSIONS
2074 memcpy(&key.ext.xport, &pnl->sxport,
2075 sizeof (key.ext.xport));
2076 #else
2077 key.ext.port = pnl->sport;
2078 #endif
2079 state = pf_find_state_all(&key, PF_OUT, &m);
2080 }
2081 if (m > 1)
2082 error = E2BIG; /* more than one state */
2083 else if (state != NULL) {
2084 sk = state->state_key;
2085 if (direction == PF_IN) {
2086 PF_ACPY(&pnl->rsaddr, &sk->lan.addr,
2087 sk->af);
2088 #ifndef NO_APPLE_EXTENSIONS
2089 memcpy(&pnl->rsxport, &sk->lan.xport,
2090 sizeof (pnl->rsxport));
2091 #else
2092 pnl->rsport = sk->lan.port;
2093 #endif
2094 PF_ACPY(&pnl->rdaddr, &pnl->daddr,
2095 pnl->af);
2096 #ifndef NO_APPLE_EXTENSIONS
2097 memcpy(&pnl->rdxport, &pnl->dxport,
2098 sizeof (pnl->rdxport));
2099 #else
2100 pnl->rdport = pnl->dport;
2101 #endif
2102 } else {
2103 PF_ACPY(&pnl->rdaddr, &sk->gwy.addr,
2104 sk->af);
2105 #ifndef NO_APPLE_EXTENSIONS
2106 memcpy(&pnl->rdxport, &sk->gwy.xport,
2107 sizeof (pnl->rdxport));
2108 #else
2109 pnl->rdport = sk->gwy.port;
2110 #endif
2111 PF_ACPY(&pnl->rsaddr, &pnl->saddr,
2112 pnl->af);
2113 #ifndef NO_APPLE_EXTENSIONS
2114 memcpy(&pnl->rsxport, &pnl->sxport,
2115 sizeof (pnl->rsxport));
2116 #else
2117 pnl->rsport = pnl->sport;
2118 #endif
2119 }
2120 } else
2121 error = ENOENT;
2122 }
2123 break;
2124 }
2125
2126 case DIOCSETTIMEOUT: {
2127 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
2128 int old;
2129
2130 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
2131 pt->seconds < 0) {
2132 error = EINVAL;
2133 goto fail;
2134 }
2135 old = pf_default_rule.timeout[pt->timeout];
2136 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
2137 pt->seconds = 1;
2138 pf_default_rule.timeout[pt->timeout] = pt->seconds;
2139 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
2140 wakeup(pf_purge_thread_fn);
2141 pt->seconds = old;
2142 break;
2143 }
2144
2145 case DIOCGETTIMEOUT: {
2146 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
2147
2148 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
2149 error = EINVAL;
2150 goto fail;
2151 }
2152 pt->seconds = pf_default_rule.timeout[pt->timeout];
2153 break;
2154 }
2155
2156 case DIOCGETLIMIT: {
2157 struct pfioc_limit *pl = (struct pfioc_limit *)addr;
2158
2159 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
2160 error = EINVAL;
2161 goto fail;
2162 }
2163 pl->limit = pf_pool_limits[pl->index].limit;
2164 break;
2165 }
2166
2167 case DIOCSETLIMIT: {
2168 struct pfioc_limit *pl = (struct pfioc_limit *)addr;
2169 int old_limit;
2170
2171 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
2172 pf_pool_limits[pl->index].pp == NULL) {
2173 error = EINVAL;
2174 goto fail;
2175 }
2176 pool_sethardlimit(pf_pool_limits[pl->index].pp,
2177 pl->limit, NULL, 0);
2178 old_limit = pf_pool_limits[pl->index].limit;
2179 pf_pool_limits[pl->index].limit = pl->limit;
2180 pl->limit = old_limit;
2181 break;
2182 }
2183
2184 case DIOCSETDEBUG: {
2185 u_int32_t *level = (u_int32_t *)addr;
2186
2187 pf_status.debug = *level;
2188 break;
2189 }
2190
2191 case DIOCCLRRULECTRS: {
2192 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
2193 struct pf_ruleset *ruleset = &pf_main_ruleset;
2194 struct pf_rule *rule;
2195
2196 TAILQ_FOREACH(rule,
2197 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
2198 rule->evaluations = 0;
2199 rule->packets[0] = rule->packets[1] = 0;
2200 rule->bytes[0] = rule->bytes[1] = 0;
2201 }
2202 break;
2203 }
2204
2205 #if ALTQ
2206 case DIOCSTARTALTQ: {
2207 struct pf_altq *altq;
2208
2209 /* enable all altq interfaces on active list */
2210 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
2211 if (altq->qname[0] == 0) {
2212 error = pf_enable_altq(altq);
2213 if (error != 0)
2214 break;
2215 }
2216 }
2217 if (error == 0)
2218 pf_altq_running = 1;
2219 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
2220 break;
2221 }
2222
2223 case DIOCSTOPALTQ: {
2224 struct pf_altq *altq;
2225
2226 /* disable all altq interfaces on active list */
2227 TAILQ_FOREACH(altq, pf_altqs_active, entries) {
2228 if (altq->qname[0] == 0) {
2229 error = pf_disable_altq(altq);
2230 if (error != 0)
2231 break;
2232 }
2233 }
2234 if (error == 0)
2235 pf_altq_running = 0;
2236 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
2237 break;
2238 }
2239
2240 case DIOCADDALTQ: {
2241 struct pfioc_altq *pa = (struct pfioc_altq *)addr;
2242 struct pf_altq *altq, *a;
2243
2244 if (pa->ticket != ticket_altqs_inactive) {
2245 error = EBUSY;
2246 break;
2247 }
2248 altq = pool_get(&pf_altq_pl, PR_WAITOK);
2249 if (altq == NULL) {
2250 error = ENOMEM;
2251 break;
2252 }
2253 bcopy(&pa->altq, altq, sizeof (struct pf_altq));
2254
2255 /*
2256 * if this is for a queue, find the discipline and
2257 * copy the necessary fields
2258 */
2259 if (altq->qname[0] != 0) {
2260 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
2261 error = EBUSY;
2262 pool_put(&pf_altq_pl, altq);
2263 break;
2264 }
2265 altq->altq_disc = NULL;
2266 TAILQ_FOREACH(a, pf_altqs_inactive, entries) {
2267 if (strncmp(a->ifname, altq->ifname,
2268 IFNAMSIZ) == 0 && a->qname[0] == 0) {
2269 altq->altq_disc = a->altq_disc;
2270 break;
2271 }
2272 }
2273 }
2274
2275 error = altq_add(altq);
2276 if (error) {
2277 pool_put(&pf_altq_pl, altq);
2278 break;
2279 }
2280
2281 TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries);
2282 bcopy(altq, &pa->altq, sizeof (struct pf_altq));
2283 break;
2284 }
2285
2286 case DIOCGETALTQS: {
2287 struct pfioc_altq *pa = (struct pfioc_altq *)addr;
2288 struct pf_altq *altq;
2289
2290 pa->nr = 0;
2291 TAILQ_FOREACH(altq, pf_altqs_active, entries)
2292 pa->nr++;
2293 pa->ticket = ticket_altqs_active;
2294 break;
2295 }
2296
2297 case DIOCGETALTQ: {
2298 struct pfioc_altq *pa = (struct pfioc_altq *)addr;
2299 struct pf_altq *altq;
2300 u_int32_t nr;
2301
2302 if (pa->ticket != ticket_altqs_active) {
2303 error = EBUSY;
2304 break;
2305 }
2306 nr = 0;
2307 altq = TAILQ_FIRST(pf_altqs_active);
2308 while ((altq != NULL) && (nr < pa->nr)) {
2309 altq = TAILQ_NEXT(altq, entries);
2310 nr++;
2311 }
2312 if (altq == NULL) {
2313 error = EBUSY;
2314 break;
2315 }
2316 bcopy(altq, &pa->altq, sizeof (struct pf_altq));
2317 break;
2318 }
2319
2320 case DIOCCHANGEALTQ:
2321 /* CHANGEALTQ not supported yet! */
2322 error = ENODEV;
2323 break;
2324
2325 case DIOCGETQSTATS: {
2326 struct pfioc_qstats *pq = (struct pfioc_qstats *)addr;
2327 struct pf_altq *altq;
2328 u_int32_t nr;
2329 int nbytes;
2330
2331 if (pq->ticket != ticket_altqs_active) {
2332 error = EBUSY;
2333 break;
2334 }
2335 nbytes = pq->nbytes;
2336 nr = 0;
2337 altq = TAILQ_FIRST(pf_altqs_active);
2338 while ((altq != NULL) && (nr < pq->nr)) {
2339 altq = TAILQ_NEXT(altq, entries);
2340 nr++;
2341 }
2342 if (altq == NULL) {
2343 error = EBUSY;
2344 break;
2345 }
2346 error = altq_getqstats(altq, pq->buf, &nbytes);
2347 if (error == 0) {
2348 pq->scheduler = altq->scheduler;
2349 pq->nbytes = nbytes;
2350 }
2351 break;
2352 }
2353 #endif /* ALTQ */
2354
2355 case DIOCBEGINADDRS: {
2356 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2357
2358 pf_empty_pool(&pf_pabuf);
2359 pp->ticket = ++ticket_pabuf;
2360 break;
2361 }
2362
2363 case DIOCADDADDR: {
2364 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2365
2366 if (pp->ticket != ticket_pabuf) {
2367 error = EBUSY;
2368 break;
2369 }
2370 #if !INET
2371 if (pp->af == AF_INET) {
2372 error = EAFNOSUPPORT;
2373 break;
2374 }
2375 #endif /* INET */
2376 #if !INET6
2377 if (pp->af == AF_INET6) {
2378 error = EAFNOSUPPORT;
2379 break;
2380 }
2381 #endif /* INET6 */
2382 if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
2383 pp->addr.addr.type != PF_ADDR_DYNIFTL &&
2384 pp->addr.addr.type != PF_ADDR_TABLE) {
2385 error = EINVAL;
2386 break;
2387 }
2388 pa = pool_get(&pf_pooladdr_pl, PR_WAITOK);
2389 if (pa == NULL) {
2390 error = ENOMEM;
2391 break;
2392 }
2393 bcopy(&pp->addr, pa, sizeof (struct pf_pooladdr));
2394 if (pa->ifname[0]) {
2395 pa->kif = pfi_kif_get(pa->ifname);
2396 if (pa->kif == NULL) {
2397 pool_put(&pf_pooladdr_pl, pa);
2398 error = EINVAL;
2399 break;
2400 }
2401 pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE);
2402 }
2403 if (pfi_dynaddr_setup(&pa->addr, pp->af)) {
2404 pfi_dynaddr_remove(&pa->addr);
2405 pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE);
2406 pool_put(&pf_pooladdr_pl, pa);
2407 error = EINVAL;
2408 break;
2409 }
2410 TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries);
2411 break;
2412 }
2413
2414 case DIOCGETADDRS: {
2415 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2416
2417 pp->nr = 0;
2418 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2419 pp->r_num, 0, 1, 0);
2420 if (pool == NULL) {
2421 error = EBUSY;
2422 break;
2423 }
2424 TAILQ_FOREACH(pa, &pool->list, entries)
2425 pp->nr++;
2426 break;
2427 }
2428
2429 case DIOCGETADDR: {
2430 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
2431 u_int32_t nr = 0;
2432
2433 pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
2434 pp->r_num, 0, 1, 1);
2435 if (pool == NULL) {
2436 error = EBUSY;
2437 break;
2438 }
2439 pa = TAILQ_FIRST(&pool->list);
2440 while ((pa != NULL) && (nr < pp->nr)) {
2441 pa = TAILQ_NEXT(pa, entries);
2442 nr++;
2443 }
2444 if (pa == NULL) {
2445 error = EBUSY;
2446 break;
2447 }
2448 bcopy(pa, &pp->addr, sizeof (struct pf_pooladdr));
2449 pfi_dynaddr_copyout(&pp->addr.addr);
2450 pf_tbladdr_copyout(&pp->addr.addr);
2451 pf_rtlabel_copyout(&pp->addr.addr);
2452 break;
2453 }
2454
2455 case DIOCCHANGEADDR: {
2456 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr;
2457 struct pf_pooladdr *oldpa = NULL, *newpa = NULL;
2458 struct pf_ruleset *ruleset;
2459
2460 if (pca->action < PF_CHANGE_ADD_HEAD ||
2461 pca->action > PF_CHANGE_REMOVE) {
2462 error = EINVAL;
2463 break;
2464 }
2465 if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
2466 pca->addr.addr.type != PF_ADDR_DYNIFTL &&
2467 pca->addr.addr.type != PF_ADDR_TABLE) {
2468 error = EINVAL;
2469 break;
2470 }
2471
2472 ruleset = pf_find_ruleset(pca->anchor);
2473 if (ruleset == NULL) {
2474 error = EBUSY;
2475 break;
2476 }
2477 pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action,
2478 pca->r_num, pca->r_last, 1, 1);
2479 if (pool == NULL) {
2480 error = EBUSY;
2481 break;
2482 }
2483 if (pca->action != PF_CHANGE_REMOVE) {
2484 newpa = pool_get(&pf_pooladdr_pl, PR_WAITOK);
2485 if (newpa == NULL) {
2486 error = ENOMEM;
2487 break;
2488 }
2489 bcopy(&pca->addr, newpa, sizeof (struct pf_pooladdr));
2490 #if !INET
2491 if (pca->af == AF_INET) {
2492 pool_put(&pf_pooladdr_pl, newpa);
2493 error = EAFNOSUPPORT;
2494 break;
2495 }
2496 #endif /* INET */
2497 #if !INET6
2498 if (pca->af == AF_INET6) {
2499 pool_put(&pf_pooladdr_pl, newpa);
2500 error = EAFNOSUPPORT;
2501 break;
2502 }
2503 #endif /* INET6 */
2504 if (newpa->ifname[0]) {
2505 newpa->kif = pfi_kif_get(newpa->ifname);
2506 if (newpa->kif == NULL) {
2507 pool_put(&pf_pooladdr_pl, newpa);
2508 error = EINVAL;
2509 break;
2510 }
2511 pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE);
2512 } else
2513 newpa->kif = NULL;
2514 if (pfi_dynaddr_setup(&newpa->addr, pca->af) ||
2515 pf_tbladdr_setup(ruleset, &newpa->addr)) {
2516 pfi_dynaddr_remove(&newpa->addr);
2517 pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE);
2518 pool_put(&pf_pooladdr_pl, newpa);
2519 error = EINVAL;
2520 break;
2521 }
2522 }
2523
2524 if (pca->action == PF_CHANGE_ADD_HEAD)
2525 oldpa = TAILQ_FIRST(&pool->list);
2526 else if (pca->action == PF_CHANGE_ADD_TAIL)
2527 oldpa = TAILQ_LAST(&pool->list, pf_palist);
2528 else {
2529 int i = 0;
2530
2531 oldpa = TAILQ_FIRST(&pool->list);
2532 while ((oldpa != NULL) && (i < (int)pca->nr)) {
2533 oldpa = TAILQ_NEXT(oldpa, entries);
2534 i++;
2535 }
2536 if (oldpa == NULL) {
2537 error = EINVAL;
2538 break;
2539 }
2540 }
2541
2542 if (pca->action == PF_CHANGE_REMOVE) {
2543 TAILQ_REMOVE(&pool->list, oldpa, entries);
2544 pfi_dynaddr_remove(&oldpa->addr);
2545 pf_tbladdr_remove(&oldpa->addr);
2546 pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE);
2547 pool_put(&pf_pooladdr_pl, oldpa);
2548 } else {
2549 if (oldpa == NULL)
2550 TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
2551 else if (pca->action == PF_CHANGE_ADD_HEAD ||
2552 pca->action == PF_CHANGE_ADD_BEFORE)
2553 TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
2554 else
2555 TAILQ_INSERT_AFTER(&pool->list, oldpa,
2556 newpa, entries);
2557 }
2558
2559 pool->cur = TAILQ_FIRST(&pool->list);
2560 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr,
2561 pca->af);
2562 break;
2563 }
2564
2565 case DIOCGETRULESETS: {
2566 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
2567 struct pf_ruleset *ruleset;
2568 struct pf_anchor *anchor;
2569
2570 pr->path[sizeof (pr->path) - 1] = 0;
2571 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2572 error = EINVAL;
2573 break;
2574 }
2575 pr->nr = 0;
2576 if (ruleset->anchor == NULL) {
2577 /* XXX kludge for pf_main_ruleset */
2578 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2579 if (anchor->parent == NULL)
2580 pr->nr++;
2581 } else {
2582 RB_FOREACH(anchor, pf_anchor_node,
2583 &ruleset->anchor->children)
2584 pr->nr++;
2585 }
2586 break;
2587 }
2588
2589 case DIOCGETRULESET: {
2590 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
2591 struct pf_ruleset *ruleset;
2592 struct pf_anchor *anchor;
2593 u_int32_t nr = 0;
2594
2595 pr->path[sizeof (pr->path) - 1] = 0;
2596 if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
2597 error = EINVAL;
2598 break;
2599 }
2600 pr->name[0] = 0;
2601 if (ruleset->anchor == NULL) {
2602 /* XXX kludge for pf_main_ruleset */
2603 RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
2604 if (anchor->parent == NULL && nr++ == pr->nr) {
2605 strlcpy(pr->name, anchor->name,
2606 sizeof (pr->name));
2607 break;
2608 }
2609 } else {
2610 RB_FOREACH(anchor, pf_anchor_node,
2611 &ruleset->anchor->children)
2612 if (nr++ == pr->nr) {
2613 strlcpy(pr->name, anchor->name,
2614 sizeof (pr->name));
2615 break;
2616 }
2617 }
2618 if (!pr->name[0])
2619 error = EBUSY;
2620 break;
2621 }
2622
2623 case DIOCRCLRTABLES: {
2624 struct pfioc_table *io = (struct pfioc_table *)addr;
2625
2626 if (io->pfrio_esize != 0) {
2627 error = ENODEV;
2628 break;
2629 }
2630 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
2631 io->pfrio_flags | PFR_FLAG_USERIOCTL);
2632 break;
2633 }
2634
2635 case DIOCRADDTABLES: {
2636 struct pfioc_table *io = (struct pfioc_table *)addr;
2637
2638 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2639 error = ENODEV;
2640 break;
2641 }
2642 error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size,
2643 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2644 break;
2645 }
2646
2647 case DIOCRDELTABLES: {
2648 struct pfioc_table *io = (struct pfioc_table *)addr;
2649
2650 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2651 error = ENODEV;
2652 break;
2653 }
2654 error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size,
2655 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2656 break;
2657 }
2658
2659 case DIOCRGETTABLES: {
2660 struct pfioc_table *io = (struct pfioc_table *)addr;
2661
2662 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2663 error = ENODEV;
2664 break;
2665 }
2666 error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer,
2667 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2668 break;
2669 }
2670
2671 case DIOCRGETTSTATS: {
2672 struct pfioc_table *io = (struct pfioc_table *)addr;
2673
2674 if (io->pfrio_esize != sizeof (struct pfr_tstats)) {
2675 error = ENODEV;
2676 break;
2677 }
2678 error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer,
2679 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2680 break;
2681 }
2682
2683 case DIOCRCLRTSTATS: {
2684 struct pfioc_table *io = (struct pfioc_table *)addr;
2685
2686 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2687 error = ENODEV;
2688 break;
2689 }
2690 error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size,
2691 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2692 break;
2693 }
2694
2695 case DIOCRSETTFLAGS: {
2696 struct pfioc_table *io = (struct pfioc_table *)addr;
2697
2698 if (io->pfrio_esize != sizeof (struct pfr_table)) {
2699 error = ENODEV;
2700 break;
2701 }
2702 error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size,
2703 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
2704 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2705 break;
2706 }
2707
2708 case DIOCRCLRADDRS: {
2709 struct pfioc_table *io = (struct pfioc_table *)addr;
2710
2711 if (io->pfrio_esize != 0) {
2712 error = ENODEV;
2713 break;
2714 }
2715 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
2716 io->pfrio_flags | PFR_FLAG_USERIOCTL);
2717 break;
2718 }
2719
2720 case DIOCRADDADDRS: {
2721 struct pfioc_table *io = (struct pfioc_table *)addr;
2722
2723 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2724 error = ENODEV;
2725 break;
2726 }
2727 error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer,
2728 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
2729 PFR_FLAG_USERIOCTL);
2730 break;
2731 }
2732
2733 case DIOCRDELADDRS: {
2734 struct pfioc_table *io = (struct pfioc_table *)addr;
2735
2736 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2737 error = ENODEV;
2738 break;
2739 }
2740 error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer,
2741 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
2742 PFR_FLAG_USERIOCTL);
2743 break;
2744 }
2745
2746 case DIOCRSETADDRS: {
2747 struct pfioc_table *io = (struct pfioc_table *)addr;
2748
2749 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2750 error = ENODEV;
2751 break;
2752 }
2753 error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer,
2754 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
2755 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
2756 PFR_FLAG_USERIOCTL, 0);
2757 break;
2758 }
2759
2760 case DIOCRGETADDRS: {
2761 struct pfioc_table *io = (struct pfioc_table *)addr;
2762
2763 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2764 error = ENODEV;
2765 break;
2766 }
2767 error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer,
2768 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2769 break;
2770 }
2771
2772 case DIOCRGETASTATS: {
2773 struct pfioc_table *io = (struct pfioc_table *)addr;
2774
2775 if (io->pfrio_esize != sizeof (struct pfr_astats)) {
2776 error = ENODEV;
2777 break;
2778 }
2779 error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer,
2780 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2781 break;
2782 }
2783
2784 case DIOCRCLRASTATS: {
2785 struct pfioc_table *io = (struct pfioc_table *)addr;
2786
2787 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2788 error = ENODEV;
2789 break;
2790 }
2791 error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer,
2792 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
2793 PFR_FLAG_USERIOCTL);
2794 break;
2795 }
2796
2797 case DIOCRTSTADDRS: {
2798 struct pfioc_table *io = (struct pfioc_table *)addr;
2799
2800 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2801 error = ENODEV;
2802 break;
2803 }
2804 error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer,
2805 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
2806 PFR_FLAG_USERIOCTL);
2807 break;
2808 }
2809
2810 case DIOCRINADEFINE: {
2811 struct pfioc_table *io = (struct pfioc_table *)addr;
2812
2813 if (io->pfrio_esize != sizeof (struct pfr_addr)) {
2814 error = ENODEV;
2815 break;
2816 }
2817 error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer,
2818 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
2819 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
2820 break;
2821 }
2822
2823 case DIOCOSFPADD: {
2824 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2825 error = pf_osfp_add(io);
2826 break;
2827 }
2828
2829 case DIOCOSFPGET: {
2830 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
2831 error = pf_osfp_get(io);
2832 break;
2833 }
2834
2835 case DIOCXBEGIN: {
2836 struct pfioc_trans *io = (struct pfioc_trans *)addr;
2837 struct pfioc_trans_e *ioe;
2838 struct pfr_table *table;
2839 int i;
2840
2841 if (io->esize != sizeof (*ioe)) {
2842 error = ENODEV;
2843 goto fail;
2844 }
2845 ioe = _MALLOC(sizeof (*ioe), M_TEMP, M_WAITOK);
2846 table = _MALLOC(sizeof (*table), M_TEMP, M_WAITOK);
2847 for (i = 0; i < io->size; i++) {
2848 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
2849 sizeof (*ioe))) {
2850 _FREE(table, M_TEMP);
2851 _FREE(ioe, M_TEMP);
2852 error = EFAULT;
2853 goto fail;
2854 }
2855 switch (ioe->rs_num) {
2856 case PF_RULESET_ALTQ:
2857 #if ALTQ
2858 if (ioe->anchor[0]) {
2859 _FREE(table, M_TEMP);
2860 _FREE(ioe, M_TEMP);
2861 error = EINVAL;
2862 goto fail;
2863 }
2864 if ((error = pf_begin_altq(&ioe->ticket))) {
2865 _FREE(table, M_TEMP);
2866 _FREE(ioe, M_TEMP);
2867 goto fail;
2868 }
2869 #endif /* ALTQ */
2870 break;
2871 case PF_RULESET_TABLE:
2872 bzero(table, sizeof (*table));
2873 strlcpy(table->pfrt_anchor, ioe->anchor,
2874 sizeof (table->pfrt_anchor));
2875 if ((error = pfr_ina_begin(table,
2876 &ioe->ticket, NULL, 0))) {
2877 _FREE(table, M_TEMP);
2878 _FREE(ioe, M_TEMP);
2879 goto fail;
2880 }
2881 break;
2882 default:
2883 if ((error = pf_begin_rules(&ioe->ticket,
2884 ioe->rs_num, ioe->anchor))) {
2885 _FREE(table, M_TEMP);
2886 _FREE(ioe, M_TEMP);
2887 goto fail;
2888 }
2889 break;
2890 }
2891 if (copyout(ioe, CAST_USER_ADDR_T(io->array+i),
2892 sizeof (io->array[i]))) {
2893 _FREE(table, M_TEMP);
2894 _FREE(ioe, M_TEMP);
2895 error = EFAULT;
2896 goto fail;
2897 }
2898 }
2899 _FREE(table, M_TEMP);
2900 _FREE(ioe, M_TEMP);
2901 break;
2902 }
2903
2904 case DIOCXROLLBACK: {
2905 struct pfioc_trans *io = (struct pfioc_trans *)addr;
2906 struct pfioc_trans_e *ioe;
2907 struct pfr_table *table;
2908 int i;
2909
2910 if (io->esize != sizeof (*ioe)) {
2911 error = ENODEV;
2912 goto fail;
2913 }
2914 ioe = _MALLOC(sizeof (*ioe), M_TEMP, M_WAITOK);
2915 table = _MALLOC(sizeof (*table), M_TEMP, M_WAITOK);
2916 for (i = 0; i < io->size; i++) {
2917 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
2918 sizeof (*ioe))) {
2919 _FREE(table, M_TEMP);
2920 _FREE(ioe, M_TEMP);
2921 error = EFAULT;
2922 goto fail;
2923 }
2924 switch (ioe->rs_num) {
2925 case PF_RULESET_ALTQ:
2926 #if ALTQ
2927 if (ioe->anchor[0]) {
2928 _FREE(table, M_TEMP);
2929 _FREE(ioe, M_TEMP);
2930 error = EINVAL;
2931 goto fail;
2932 }
2933 if ((error = pf_rollback_altq(ioe->ticket))) {
2934 _FREE(table, M_TEMP);
2935 _FREE(ioe, M_TEMP);
2936 goto fail; /* really bad */
2937 }
2938 #endif /* ALTQ */
2939 break;
2940 case PF_RULESET_TABLE:
2941 bzero(table, sizeof (*table));
2942 strlcpy(table->pfrt_anchor, ioe->anchor,
2943 sizeof (table->pfrt_anchor));
2944 if ((error = pfr_ina_rollback(table,
2945 ioe->ticket, NULL, 0))) {
2946 _FREE(table, M_TEMP);
2947 _FREE(ioe, M_TEMP);
2948 goto fail; /* really bad */
2949 }
2950 break;
2951 default:
2952 if ((error = pf_rollback_rules(ioe->ticket,
2953 ioe->rs_num, ioe->anchor))) {
2954 _FREE(table, M_TEMP);
2955 _FREE(ioe, M_TEMP);
2956 goto fail; /* really bad */
2957 }
2958 break;
2959 }
2960 }
2961 _FREE(table, M_TEMP);
2962 _FREE(ioe, M_TEMP);
2963 break;
2964 }
2965
2966 case DIOCXCOMMIT: {
2967 struct pfioc_trans *io = (struct pfioc_trans *)addr;
2968 struct pfioc_trans_e *ioe;
2969 struct pfr_table *table;
2970 struct pf_ruleset *rs;
2971 int i;
2972
2973 if (io->esize != sizeof (*ioe)) {
2974 error = ENODEV;
2975 goto fail;
2976 }
2977 ioe = _MALLOC(sizeof (*ioe), M_TEMP, M_WAITOK);
2978 table = _MALLOC(sizeof (*table), M_TEMP, M_WAITOK);
2979 /* first makes sure everything will succeed */
2980 for (i = 0; i < io->size; i++) {
2981 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
2982 sizeof (*ioe))) {
2983 _FREE(table, M_TEMP);
2984 _FREE(ioe, M_TEMP);
2985 error = EFAULT;
2986 goto fail;
2987 }
2988 switch (ioe->rs_num) {
2989 case PF_RULESET_ALTQ:
2990 #if ALTQ
2991 if (ioe->anchor[0]) {
2992 _FREE(table, M_TEMP);
2993 _FREE(ioe, M_TEMP);
2994 error = EINVAL;
2995 goto fail;
2996 }
2997 if (!altqs_inactive_open || ioe->ticket !=
2998 ticket_altqs_inactive) {
2999 _FREE(table, M_TEMP);
3000 _FREE(ioe, M_TEMP);
3001 error = EBUSY;
3002 goto fail;
3003 }
3004 #endif /* ALTQ */
3005 break;
3006 case PF_RULESET_TABLE:
3007 rs = pf_find_ruleset(ioe->anchor);
3008 if (rs == NULL || !rs->topen || ioe->ticket !=
3009 rs->tticket) {
3010 _FREE(table, M_TEMP);
3011 _FREE(ioe, M_TEMP);
3012 error = EBUSY;
3013 goto fail;
3014 }
3015 break;
3016 default:
3017 if (ioe->rs_num < 0 || ioe->rs_num >=
3018 PF_RULESET_MAX) {
3019 _FREE(table, M_TEMP);
3020 _FREE(ioe, M_TEMP);
3021 error = EINVAL;
3022 goto fail;
3023 }
3024 rs = pf_find_ruleset(ioe->anchor);
3025 if (rs == NULL ||
3026 !rs->rules[ioe->rs_num].inactive.open ||
3027 rs->rules[ioe->rs_num].inactive.ticket !=
3028 ioe->ticket) {
3029 _FREE(table, M_TEMP);
3030 _FREE(ioe, M_TEMP);
3031 error = EBUSY;
3032 goto fail;
3033 }
3034 break;
3035 }
3036 }
3037 /* now do the commit - no errors should happen here */
3038 for (i = 0; i < io->size; i++) {
3039 if (copyin(CAST_USER_ADDR_T(io->array+i), ioe,
3040 sizeof (*ioe))) {
3041 _FREE(table, M_TEMP);
3042 _FREE(ioe, M_TEMP);
3043 error = EFAULT;
3044 goto fail;
3045 }
3046 switch (ioe->rs_num) {
3047 case PF_RULESET_ALTQ:
3048 #if ALTQ
3049 if ((error = pf_commit_altq(ioe->ticket))) {
3050 _FREE(table, M_TEMP);
3051 _FREE(ioe, M_TEMP);
3052 goto fail; /* really bad */
3053 }
3054 #endif /* ALTQ */
3055 break;
3056 case PF_RULESET_TABLE:
3057 bzero(table, sizeof (*table));
3058 strlcpy(table->pfrt_anchor, ioe->anchor,
3059 sizeof (table->pfrt_anchor));
3060 if ((error = pfr_ina_commit(table, ioe->ticket,
3061 NULL, NULL, 0))) {
3062 _FREE(table, M_TEMP);
3063 _FREE(ioe, M_TEMP);
3064 goto fail; /* really bad */
3065 }
3066 break;
3067 default:
3068 if ((error = pf_commit_rules(ioe->ticket,
3069 ioe->rs_num, ioe->anchor))) {
3070 _FREE(table, M_TEMP);
3071 _FREE(ioe, M_TEMP);
3072 goto fail; /* really bad */
3073 }
3074 break;
3075 }
3076 }
3077 _FREE(table, M_TEMP);
3078 _FREE(ioe, M_TEMP);
3079 break;
3080 }
3081
3082 case DIOCGETSRCNODES: {
3083 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr;
3084 struct pf_src_node *n, *sn, *pstore;
3085 u_int32_t nr = 0;
3086 int space = psn->psn_len;
3087
3088 if (space == 0) {
3089 RB_FOREACH(n, pf_src_tree, &tree_src_tracking)
3090 nr++;
3091 psn->psn_len = sizeof (struct pf_src_node) * nr;
3092 break;
3093 }
3094
3095 pstore = _MALLOC(sizeof (*pstore), M_TEMP, M_WAITOK);
3096
3097 sn = psn->psn_src_nodes;
3098 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
3099 uint64_t secs = pf_time_second(), diff;
3100
3101 if ((nr + 1) * sizeof (*sn) > (unsigned)psn->psn_len)
3102 break;
3103
3104 bcopy(n, pstore, sizeof (*pstore));
3105 if (n->rule.ptr != NULL)
3106 pstore->rule.nr = n->rule.ptr->nr;
3107 pstore->creation = secs - pstore->creation;
3108 if (pstore->expire > secs)
3109 pstore->expire -= secs;
3110 else
3111 pstore->expire = 0;
3112
3113 /* adjust the connection rate estimate */
3114 diff = secs - n->conn_rate.last;
3115 if (diff >= n->conn_rate.seconds)
3116 pstore->conn_rate.count = 0;
3117 else
3118 pstore->conn_rate.count -=
3119 n->conn_rate.count * diff /
3120 n->conn_rate.seconds;
3121
3122 error = copyout(pstore, CAST_USER_ADDR_T(sn),
3123 sizeof (*sn));
3124 if (error) {
3125 _FREE(pstore, M_TEMP);
3126 goto fail;
3127 }
3128 sn++;
3129 nr++;
3130 }
3131 psn->psn_len = sizeof (struct pf_src_node) * nr;
3132
3133 _FREE(pstore, M_TEMP);
3134 break;
3135 }
3136
3137 case DIOCCLRSRCNODES: {
3138 struct pf_src_node *n;
3139 struct pf_state *state;
3140
3141 RB_FOREACH(state, pf_state_tree_id, &tree_id) {
3142 state->src_node = NULL;
3143 state->nat_src_node = NULL;
3144 }
3145 RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
3146 n->expire = 1;
3147 n->states = 0;
3148 }
3149 pf_purge_expired_src_nodes();
3150 pf_status.src_nodes = 0;
3151 break;
3152 }
3153
3154 case DIOCKILLSRCNODES: {
3155 struct pf_src_node *sn;
3156 struct pf_state *s;
3157 struct pfioc_src_node_kill *psnk =
3158 (struct pfioc_src_node_kill *)addr;
3159 int killed = 0;
3160
3161 RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) {
3162 if (PF_MATCHA(psnk->psnk_src.neg,
3163 &psnk->psnk_src.addr.v.a.addr,
3164 &psnk->psnk_src.addr.v.a.mask,
3165 &sn->addr, sn->af) &&
3166 PF_MATCHA(psnk->psnk_dst.neg,
3167 &psnk->psnk_dst.addr.v.a.addr,
3168 &psnk->psnk_dst.addr.v.a.mask,
3169 &sn->raddr, sn->af)) {
3170 /* Handle state to src_node linkage */
3171 if (sn->states != 0) {
3172 RB_FOREACH(s, pf_state_tree_id,
3173 &tree_id) {
3174 if (s->src_node == sn)
3175 s->src_node = NULL;
3176 if (s->nat_src_node == sn)
3177 s->nat_src_node = NULL;
3178 }
3179 sn->states = 0;
3180 }
3181 sn->expire = 1;
3182 killed++;
3183 }
3184 }
3185
3186 if (killed > 0)
3187 pf_purge_expired_src_nodes();
3188
3189 psnk->psnk_af = killed;
3190 break;
3191 }
3192
3193 case DIOCSETHOSTID: {
3194 u_int32_t *hid = (u_int32_t *)addr;
3195
3196 if (*hid == 0)
3197 pf_status.hostid = random();
3198 else
3199 pf_status.hostid = *hid;
3200 break;
3201 }
3202
3203 case DIOCOSFPFLUSH:
3204 pf_osfp_flush();
3205 break;
3206
3207 case DIOCIGETIFACES: {
3208 struct pfioc_iface *io = (struct pfioc_iface *)addr;
3209
3210 if (io->pfiio_esize != sizeof (struct pfi_kif)) {
3211 error = ENODEV;
3212 break;
3213 }
3214 error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer,
3215 &io->pfiio_size);
3216 break;
3217 }
3218
3219 case DIOCSETIFFLAG: {
3220 struct pfioc_iface *io = (struct pfioc_iface *)addr;
3221
3222 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
3223 break;
3224 }
3225
3226 case DIOCCLRIFFLAG: {
3227 struct pfioc_iface *io = (struct pfioc_iface *)addr;
3228
3229 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
3230 break;
3231 }
3232
3233 default:
3234 error = ENODEV;
3235 break;
3236 }
3237 fail:
3238 lck_mtx_unlock(pf_lock);
3239 lck_rw_done(pf_perim_lock);
3240
3241 return (error);
3242 }
3243
3244 int
3245 pf_af_hook(struct ifnet *ifp, struct mbuf **mppn, struct mbuf **mp,
3246 unsigned int af, int input)
3247 {
3248 int error = 0, reentry;
3249 struct thread *curthread = current_thread();
3250 struct mbuf *nextpkt;
3251
3252 reentry = (ifp->if_pf_curthread == curthread);
3253 if (!reentry) {
3254 lck_rw_lock_shared(pf_perim_lock);
3255 if (!pf_hooks_attached)
3256 goto done;
3257
3258 lck_mtx_lock(pf_lock);
3259 ifp->if_pf_curthread = curthread;
3260 }
3261
3262 if (mppn != NULL && *mppn != NULL)
3263 VERIFY(*mppn == *mp);
3264 if ((nextpkt = (*mp)->m_nextpkt) != NULL)
3265 (*mp)->m_nextpkt = NULL;
3266
3267 switch (af) {
3268 #if INET
3269 case AF_INET: {
3270 error = pf_inet_hook(ifp, mp, input);
3271 break;
3272 }
3273 #endif /* INET */
3274 #if INET6
3275 case AF_INET6:
3276 error = pf_inet6_hook(ifp, mp, input);
3277 break;
3278 #endif /* INET6 */
3279 default:
3280 break;
3281 }
3282
3283 if (nextpkt != NULL) {
3284 if (*mp != NULL) {
3285 struct mbuf *m = *mp;
3286 while (m->m_nextpkt != NULL)
3287 m = m->m_nextpkt;
3288 m->m_nextpkt = nextpkt;
3289 } else {
3290 *mp = nextpkt;
3291 }
3292 }
3293 if (mppn != NULL && *mppn != NULL)
3294 *mppn = *mp;
3295
3296 if (!reentry) {
3297 ifp->if_pf_curthread = NULL;
3298 lck_mtx_unlock(pf_lock);
3299 }
3300 done:
3301 if (!reentry)
3302 lck_rw_done(pf_perim_lock);
3303
3304 return (error);
3305 }
3306
3307
3308 #if INET
3309 static int
3310 pf_inet_hook(struct ifnet *ifp, struct mbuf **mp, int input)
3311 {
3312 struct mbuf *m = *mp;
3313 #if BYTE_ORDER != BIG_ENDIAN
3314 struct ip *ip = mtod(m, struct ip *);
3315 #endif
3316 int error = 0;
3317
3318 /*
3319 * If the packet is outbound, is originated locally, is flagged for
3320 * delayed UDP/TCP checksum calculation, and is about to be processed
3321 * for an interface that doesn't support the appropriate checksum
3322 * offloading, then calculated the checksum here so that PF can adjust
3323 * it properly.
3324 */
3325 if (!input && m->m_pkthdr.rcvif == NULL) {
3326 static const int mask = CSUM_DELAY_DATA;
3327 const int flags = m->m_pkthdr.csum_flags &
3328 ~IF_HWASSIST_CSUM_FLAGS(ifp->if_hwassist);
3329
3330 if (flags & mask) {
3331 in_delayed_cksum(m);
3332 m->m_pkthdr.csum_flags &= ~mask;
3333 }
3334 }
3335
3336 #if BYTE_ORDER != BIG_ENDIAN
3337 HTONS(ip->ip_len);
3338 HTONS(ip->ip_off);
3339 #endif
3340 if (pf_test(input ? PF_IN : PF_OUT, ifp, mp, NULL) != PF_PASS) {
3341 if (*mp != NULL) {
3342 m_freem(*mp);
3343 *mp = NULL;
3344 error = EHOSTUNREACH;
3345 } else {
3346 error = ENOBUFS;
3347 }
3348 }
3349 #if BYTE_ORDER != BIG_ENDIAN
3350 else {
3351 ip = mtod(*mp, struct ip *);
3352 NTOHS(ip->ip_len);
3353 NTOHS(ip->ip_off);
3354 }
3355 #endif
3356 return (error);
3357 }
3358 #endif /* INET */
3359
3360 #if INET6
3361 int
3362 pf_inet6_hook(struct ifnet *ifp, struct mbuf **mp, int input)
3363 {
3364 int error = 0;
3365
3366 #if 0
3367 /*
3368 * TODO: once we support IPv6 hardware checksum offload
3369 */
3370 /*
3371 * If the packet is outbound, is originated locally, is flagged for
3372 * delayed UDP/TCP checksum calculation, and is about to be processed
3373 * for an interface that doesn't support the appropriate checksum
3374 * offloading, then calculated the checksum here so that PF can adjust
3375 * it properly.
3376 */
3377 if (!input && (*mp)->m_pkthdr.rcvif == NULL) {
3378 static const int mask = CSUM_DELAY_DATA;
3379 const int flags = (*mp)->m_pkthdr.csum_flags &
3380 ~IF_HWASSIST_CSUM_FLAGS(ifp->if_hwassist);
3381
3382 if (flags & mask) {
3383 in6_delayed_cksum(*mp);
3384 (*mp)->m_pkthdr.csum_flags &= ~mask;
3385 }
3386 }
3387 #endif
3388
3389 if (pf_test6(input ? PF_IN : PF_OUT, ifp, mp, NULL) != PF_PASS) {
3390 if (*mp != NULL) {
3391 m_freem(*mp);
3392 *mp = NULL;
3393 error = EHOSTUNREACH;
3394 } else {
3395 error = ENOBUFS;
3396 }
3397 }
3398 return (error);
3399 }
3400 #endif /* INET6 */
3401
3402 int
3403 pf_ifaddr_hook(struct ifnet *ifp, unsigned long cmd)
3404 {
3405 lck_rw_lock_shared(pf_perim_lock);
3406 if (!pf_hooks_attached)
3407 goto done;
3408
3409 lck_mtx_lock(pf_lock);
3410
3411 switch (cmd) {
3412 case SIOCSIFADDR:
3413 case SIOCAIFADDR:
3414 case SIOCDIFADDR:
3415 #if INET6
3416 case SIOCAIFADDR_IN6:
3417 case SIOCDIFADDR_IN6:
3418 #endif /* INET6 */
3419 if (ifp->if_pf_kif != NULL)
3420 pfi_kifaddr_update(ifp->if_pf_kif);
3421 break;
3422 default:
3423 panic("%s: unexpected ioctl %lu", __func__, cmd);
3424 /* NOTREACHED */
3425 }
3426
3427 lck_mtx_unlock(pf_lock);
3428 done:
3429 lck_rw_done(pf_perim_lock);
3430 return (0);
3431 }
3432
3433 /*
3434 * Caller acquires dlil lock as writer (exclusive)
3435 */
3436 void
3437 pf_ifnet_hook(struct ifnet *ifp, int attach)
3438 {
3439 lck_rw_lock_shared(pf_perim_lock);
3440 if (!pf_hooks_attached)
3441 goto done;
3442
3443 lck_mtx_lock(pf_lock);
3444 if (attach)
3445 pfi_attach_ifnet(ifp);
3446 else
3447 pfi_detach_ifnet(ifp);
3448 lck_mtx_unlock(pf_lock);
3449 done:
3450 lck_rw_done(pf_perim_lock);
3451 }
3452
3453 static void
3454 pf_attach_hooks(void)
3455 {
3456 int i;
3457
3458 if (pf_hooks_attached)
3459 return;
3460
3461 ifnet_head_lock_shared();
3462 for (i = 0; i <= if_index; i++) {
3463 struct ifnet *ifp = ifindex2ifnet[i];
3464 if (ifp != NULL) {
3465 pfi_attach_ifnet(ifp);
3466 }
3467 }
3468 ifnet_head_done();
3469 pf_hooks_attached = 1;
3470 }
3471
3472 static void
3473 pf_detach_hooks(void)
3474 {
3475 int i;
3476
3477 if (!pf_hooks_attached)
3478 return;
3479
3480 ifnet_head_lock_shared();
3481 for (i = 0; i <= if_index; i++) {
3482 struct ifnet *ifp = ifindex2ifnet[i];
3483 if (ifp != NULL && ifp->if_pf_kif != NULL) {
3484 pfi_detach_ifnet(ifp);
3485 }
3486 }
3487 ifnet_head_done();
3488 pf_hooks_attached = 0;
3489 }
mirror of XNU