1 /* $OpenBSD: pf_ruleset.c,v 1.6 2010/01/18 23:52:46 mcbride Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include <sys/param.h> 39 #include <sys/socket.h> 40 #ifdef _KERNEL 41 # include <sys/systm.h> 42 #endif /* _KERNEL */ 43 #include <sys/mbuf.h> 44 #include <sys/syslog.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_systm.h> 48 #include <netinet/ip.h> 49 #include <netinet/tcp.h> 50 51 #include <net/if.h> 52 #include <net/pfvar.h> 53 54 #ifdef INET6 55 #include <netinet/ip6.h> 56 #endif /* INET6 */ 57 58 59 #ifdef _KERNEL 60 #define rs_malloc(x) malloc(x, M_TEMP, M_WAITOK|M_CANFAIL|M_ZERO) 61 #define rs_free(x) free(x, M_TEMP) 62 63 #else 64 /* Userland equivalents so we can lend code to pfctl et al. */ 65 66 # include <arpa/inet.h> 67 # include <errno.h> 68 # include <stdio.h> 69 # include <stdlib.h> 70 # include <string.h> 71 # define rs_malloc(x) calloc(1, x) 72 # define rs_free(x) free(x) 73 74 # ifdef PFDEBUG 75 # include <sys/stdarg.h> /* for DPFPRINTF() */ 76 # endif 77 #endif /* _KERNEL */ 78 79 80 struct pf_anchor_global pf_anchors; 81 struct pf_anchor pf_main_anchor; 82 83 static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *); 84 85 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 86 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 87 88 static __inline int 89 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) 90 { 91 int c = strcmp(a->path, b->path); 92 93 return (c ? (c < 0 ? -1 : 1) : 0); 94 } 95 96 void 97 pf_init_ruleset(struct pf_ruleset *ruleset) 98 { 99 memset(ruleset, 0, sizeof(struct pf_ruleset)); 100 TAILQ_INIT(&ruleset->rules.queues[0]); 101 TAILQ_INIT(&ruleset->rules.queues[1]); 102 ruleset->rules.active.ptr = &ruleset->rules.queues[0]; 103 ruleset->rules.inactive.ptr = &ruleset->rules.queues[1]; 104 } 105 106 struct pf_anchor * 107 pf_find_anchor(const char *path) 108 { 109 struct pf_anchor *key, *found; 110 111 key = (struct pf_anchor *)rs_malloc(sizeof(*key)); 112 if (key == NULL) 113 return (NULL); 114 strlcpy(key->path, path, sizeof(key->path)); 115 found = RB_FIND(pf_anchor_global, &pf_anchors, key); 116 rs_free(key); 117 return (found); 118 } 119 120 struct pf_ruleset * 121 pf_find_ruleset(const char *path) 122 { 123 struct pf_anchor *anchor; 124 125 while (*path == '/') 126 path++; 127 if (!*path) 128 return (&pf_main_ruleset); 129 anchor = pf_find_anchor(path); 130 if (anchor == NULL) 131 return (NULL); 132 else 133 return (&anchor->ruleset); 134 } 135 136 struct pf_ruleset * 137 pf_find_or_create_ruleset(const char *path) 138 { 139 char *p, *q, *r; 140 struct pf_ruleset *ruleset; 141 struct pf_anchor *anchor, *dup, *parent = NULL; 142 143 if (path[0] == 0) 144 return (&pf_main_ruleset); 145 while (*path == '/') 146 path++; 147 ruleset = pf_find_ruleset(path); 148 if (ruleset != NULL) 149 return (ruleset); 150 p = (char *)rs_malloc(MAXPATHLEN); 151 if (p == NULL) 152 return (NULL); 153 strlcpy(p, path, MAXPATHLEN); 154 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 155 *q = 0; 156 if ((ruleset = pf_find_ruleset(p)) != NULL) { 157 parent = ruleset->anchor; 158 break; 159 } 160 } 161 if (q == NULL) 162 q = p; 163 else 164 q++; 165 strlcpy(p, path, MAXPATHLEN); 166 if (!*q) { 167 rs_free(p); 168 return (NULL); 169 } 170 while ((r = strchr(q, '/')) != NULL || *q) { 171 if (r != NULL) 172 *r = 0; 173 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 174 (parent != NULL && strlen(parent->path) >= 175 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 176 rs_free(p); 177 return (NULL); 178 } 179 anchor = (struct pf_anchor *)rs_malloc(sizeof(*anchor)); 180 if (anchor == NULL) { 181 rs_free(p); 182 return (NULL); 183 } 184 RB_INIT(&anchor->children); 185 strlcpy(anchor->name, q, sizeof(anchor->name)); 186 if (parent != NULL) { 187 strlcpy(anchor->path, parent->path, 188 sizeof(anchor->path)); 189 strlcat(anchor->path, "/", sizeof(anchor->path)); 190 } 191 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 192 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != 193 NULL) { 194 DPFPRINTF(LOG_NOTICE, 195 "pf_find_or_create_ruleset: RB_INSERT1 " 196 "'%s' '%s' collides with '%s' '%s'", 197 anchor->path, anchor->name, dup->path, dup->name); 198 rs_free(anchor); 199 rs_free(p); 200 return (NULL); 201 } 202 if (parent != NULL) { 203 anchor->parent = parent; 204 if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 205 anchor)) != NULL) { 206 DPFPRINTF(LOG_NOTICE, 207 "pf_find_or_create_ruleset: " 208 "RB_INSERT2 '%s' '%s' collides with " 209 "'%s' '%s'", anchor->path, anchor->name, 210 dup->path, dup->name); 211 RB_REMOVE(pf_anchor_global, &pf_anchors, 212 anchor); 213 rs_free(anchor); 214 rs_free(p); 215 return (NULL); 216 } 217 } 218 pf_init_ruleset(&anchor->ruleset); 219 anchor->ruleset.anchor = anchor; 220 parent = anchor; 221 if (r != NULL) 222 q = r + 1; 223 else 224 *q = 0; 225 } 226 rs_free(p); 227 return (&anchor->ruleset); 228 } 229 230 void 231 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 232 { 233 struct pf_anchor *parent; 234 235 while (ruleset != NULL) { 236 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 237 !RB_EMPTY(&ruleset->anchor->children) || 238 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 239 ruleset->topen) 240 return; 241 if (!TAILQ_EMPTY(ruleset->rules.active.ptr) || 242 !TAILQ_EMPTY(ruleset->rules.inactive.ptr) || 243 ruleset->rules.inactive.open) 244 return; 245 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); 246 if ((parent = ruleset->anchor->parent) != NULL) 247 RB_REMOVE(pf_anchor_node, &parent->children, 248 ruleset->anchor); 249 rs_free(ruleset->anchor); 250 if (parent == NULL) 251 return; 252 ruleset = &parent->ruleset; 253 } 254 } 255 256 int 257 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 258 const char *name) 259 { 260 char *p, *path; 261 struct pf_ruleset *ruleset; 262 263 r->anchor = NULL; 264 r->anchor_relative = 0; 265 r->anchor_wildcard = 0; 266 if (!name[0]) 267 return (0); 268 path = (char *)rs_malloc(MAXPATHLEN); 269 if (path == NULL) 270 return (1); 271 if (name[0] == '/') 272 strlcpy(path, name + 1, MAXPATHLEN); 273 else { 274 /* relative path */ 275 r->anchor_relative = 1; 276 if (s->anchor == NULL || !s->anchor->path[0]) 277 path[0] = 0; 278 else 279 strlcpy(path, s->anchor->path, MAXPATHLEN); 280 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 281 if (!path[0]) { 282 DPFPRINTF(LOG_NOTICE, 283 "pf_anchor_setup: .. beyond root"); 284 rs_free(path); 285 return (1); 286 } 287 if ((p = strrchr(path, '/')) != NULL) 288 *p = 0; 289 else 290 path[0] = 0; 291 r->anchor_relative++; 292 name += 3; 293 } 294 if (path[0]) 295 strlcat(path, "/", MAXPATHLEN); 296 strlcat(path, name, MAXPATHLEN); 297 } 298 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 299 r->anchor_wildcard = 1; 300 *p = 0; 301 } 302 ruleset = pf_find_or_create_ruleset(path); 303 rs_free(path); 304 if (ruleset == NULL || ruleset->anchor == NULL) { 305 DPFPRINTF(LOG_NOTICE, 306 "pf_anchor_setup: ruleset"); 307 return (1); 308 } 309 r->anchor = ruleset->anchor; 310 r->anchor->refcnt++; 311 return (0); 312 } 313 314 int 315 pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, 316 struct pfioc_rule *pr) 317 { 318 pr->anchor_call[0] = 0; 319 if (r->anchor == NULL) 320 return (0); 321 if (!r->anchor_relative) { 322 strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call)); 323 strlcat(pr->anchor_call, r->anchor->path, 324 sizeof(pr->anchor_call)); 325 } else { 326 char *a, *p; 327 int i; 328 329 a = (char *)rs_malloc(MAXPATHLEN); 330 if (a == NULL) 331 return (1); 332 if (rs->anchor == NULL) 333 a[0] = 0; 334 else 335 strlcpy(a, rs->anchor->path, MAXPATHLEN); 336 for (i = 1; i < r->anchor_relative; ++i) { 337 if ((p = strrchr(a, '/')) == NULL) 338 p = a; 339 *p = 0; 340 strlcat(pr->anchor_call, "../", 341 sizeof(pr->anchor_call)); 342 } 343 if (strncmp(a, r->anchor->path, strlen(a))) { 344 DPFPRINTF(LOG_NOTICE, 345 "pf_anchor_copyout: '%s' '%s'", a, 346 r->anchor->path); 347 rs_free(a); 348 return (1); 349 } 350 if (strlen(r->anchor->path) > strlen(a)) 351 strlcat(pr->anchor_call, r->anchor->path + (a[0] ? 352 strlen(a) + 1 : 0), sizeof(pr->anchor_call)); 353 rs_free(a); 354 } 355 if (r->anchor_wildcard) 356 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*", 357 sizeof(pr->anchor_call)); 358 return (0); 359 } 360 361 void 362 pf_anchor_remove(struct pf_rule *r) 363 { 364 if (r->anchor == NULL) 365 return; 366 if (r->anchor->refcnt <= 0) { 367 DPFPRINTF(LOG_NOTICE, 368 "pf_anchor_remove: broken refcount"); 369 r->anchor = NULL; 370 return; 371 } 372 if (!--r->anchor->refcnt) 373 pf_remove_if_empty_ruleset(&r->anchor->ruleset); 374 r->anchor = NULL; 375 } 376