1 /* $OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $ */ 2 3 /* 4 * Copyright 2005 Henning Brauer <henning@openbsd.org> 5 * Copyright 2005 Ryan McBride <mcbride@openbsd.org> 6 * Copyright (c) 2001 Daniel Hartmeier 7 * Copyright (c) 2003 Cedric Berger 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 14 * - Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * - Redistributions in binary form must reproduce the above 17 * copyright notice, this list of conditions and the following 18 * disclaimer in the documentation and/or other materials provided 19 * with the distribution. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 24 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 25 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 27 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 29 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 31 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 32 * POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include "opt_inet.h" 36 #include "opt_inet6.h" 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/malloc.h> 41 #include <sys/mbuf.h> 42 #include <sys/eventhandler.h> 43 #include <sys/filio.h> 44 #include <sys/msgport2.h> 45 #include <sys/socket.h> 46 #include <sys/socketvar.h> 47 #include <sys/kernel.h> 48 #include <sys/thread2.h> 49 #include <sys/time.h> 50 51 #include <net/if.h> 52 #include <net/if_types.h> 53 #include <net/netisr2.h> 54 #include <net/netmsg2.h> 55 #include <net/route.h> 56 57 #include <netinet/in.h> 58 #include <netinet/in_var.h> 59 #include <netinet/in_systm.h> 60 #include <netinet/ip.h> 61 #include <netinet/ip_var.h> 62 63 #include <net/pf/pfvar.h> 64 65 #ifdef INET6 66 #include <netinet/ip6.h> 67 #endif /* INET6 */ 68 69 struct pfi_kif *pfi_all = NULL; 70 struct pfi_ifhead pfi_ifs; 71 long pfi_update = 1; 72 struct pfr_addr *pfi_buffer; 73 int pfi_buffer_cnt; 74 int pfi_buffer_max; 75 76 eventhandler_tag pfi_clone_cookie = NULL; 77 eventhandler_tag pfi_attach_cookie = NULL; 78 eventhandler_tag pfi_detach_cookie = NULL; 79 80 void pfi_kif_update(struct pfi_kif *); 81 void pfi_dynaddr_update(struct pfi_dynaddr *dyn); 82 void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, 83 int, int); 84 void pfi_kifaddr_update(void *); 85 void pfi_instance_add(struct ifnet *, int, int); 86 void pfi_address_add(struct sockaddr *, int, int); 87 int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 88 int pfi_skip_if(const char *, struct pfi_kif *); 89 int pfi_unmask(void *); 90 void pfi_kifaddr_update_event(void *, struct ifnet *, 91 enum ifaddr_event, struct ifaddr *); 92 /*XXX jl void pfi_attach_clone_event(void *, struct if_clone *);*/ 93 void pfi_attach_ifnet_event(void *, struct ifnet *); 94 void pfi_detach_ifnet_event(void *, struct ifnet *); 95 96 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 97 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 98 99 #define PFI_BUFFER_MAX 0x10000 100 MALLOC_DEFINE(PFI_MTYPE, "pf_if", "pf interface table"); 101 static MALLOC_DEFINE(M_PFIADDRPL, "pfiaddrpl", "pf interface address pool list"); 102 103 104 void 105 pfi_initialize(void) 106 { 107 struct ifnet *ifp; 108 109 if (pfi_all != NULL) /* already initialized */ 110 return; 111 112 pfi_buffer_max = 64; 113 pfi_buffer = kmalloc(pfi_buffer_max * sizeof(*pfi_buffer), 114 PFI_MTYPE, M_WAITOK); 115 116 if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL) 117 panic("pfi_kif_get for pfi_all failed"); 118 119 /* XXX ALMOST MPSAFE */ 120 ifnet_lock(); 121 TAILQ_FOREACH(ifp, &ifnetlist, if_link) { 122 if (ifp->if_dunit != IF_DUNIT_NONE) 123 pfi_attach_ifnet(ifp); 124 } 125 ifnet_unlock(); 126 pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_attach_event, 127 pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY); 128 pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_detach_event, 129 pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY); 130 /* XXX jl pfi_clone_cookie = EVENTHANDLER_REGISTER(if_clone_event, 131 pfi_attach_clone_event, NULL, EVENTHANDLER_PRI_ANY); */ 132 133 if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL) 134 panic("pfi_kif_get for pfi_all failed"); 135 } 136 137 void 138 pfi_cleanup(void) 139 { 140 struct pfi_kif *p, key; 141 struct ifnet *ifp; 142 143 EVENTHANDLER_DEREGISTER(ifnet_attach_event, pfi_attach_cookie); 144 EVENTHANDLER_DEREGISTER(ifnet_detach_event, pfi_detach_cookie); 145 EVENTHANDLER_DEREGISTER(if_clone_event, pfi_clone_cookie); 146 147 /* release PFI_IFLAG_INSTANCE */ 148 /* XXX ALMOST MPSAFE */ 149 ifnet_lock(); 150 TAILQ_FOREACH(ifp, &ifnetlist, if_link) { 151 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name)); 152 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key); 153 if (p != NULL) 154 pfi_detach_ifnet(ifp); 155 } 156 ifnet_unlock(); 157 158 /* XXX clear all other interface group */ 159 while ((p = RB_MIN(pfi_ifhead, &pfi_ifs))) { 160 RB_REMOVE(pfi_ifhead, &pfi_ifs, p); 161 162 kfree(p, PFI_MTYPE); 163 } 164 kfree(pfi_buffer, PFI_MTYPE); 165 pfi_buffer = NULL; 166 pfi_all = NULL; 167 } 168 169 /* 170 * Wrapper functions for FreeBSD eventhandler 171 */ 172 void 173 pfi_kifaddr_update_event(void *arg, struct ifnet *ifp, 174 enum ifaddr_event event __unused, struct ifaddr *ifa __unused) 175 { 176 struct pfi_kif *p = arg; 177 178 /* 179 * Check to see if it is 'our' interface as we do not have per 180 * interface hooks and thus get an update for every interface. 181 */ 182 if (p && p->pfik_ifp == ifp) 183 pfi_kifaddr_update(p); 184 } 185 186 /* XXX jl 187 void 188 pfi_attach_clone_event(void *arg __unused, struct if_clone *ifc) 189 { 190 pfi_attach_clone(ifc); 191 } 192 */ 193 194 void 195 pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp) 196 { 197 if (ifp->if_dunit != IF_DUNIT_NONE) 198 pfi_attach_ifnet(ifp); 199 } 200 201 void 202 pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp) 203 { 204 pfi_detach_ifnet(ifp); 205 } 206 207 struct pfi_kif * 208 pfi_kif_get(const char *kif_name) 209 { 210 struct pfi_kif *kif; 211 struct pfi_kif_cmp s; 212 213 bzero(&s, sizeof(s)); 214 strlcpy(s.pfik_ifname, kif_name, sizeof(s.pfik_ifname)); 215 if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&s)) != NULL) 216 return (kif); 217 218 /* create new one */ 219 if ((kif = kmalloc(sizeof(*kif), PFI_MTYPE, M_WAITOK | M_ZERO)) == NULL) 220 return (NULL); 221 222 strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name)); 223 kif->pfik_tzero = time_second; 224 TAILQ_INIT(&kif->pfik_dynaddrs); 225 226 RB_INSERT(pfi_ifhead, &pfi_ifs, kif); 227 return (kif); 228 } 229 230 void 231 pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what) 232 { 233 switch (what) { 234 case PFI_KIF_REF_RULE: 235 kif->pfik_rules++; 236 break; 237 case PFI_KIF_REF_STATE: 238 kif->pfik_states++; 239 break; 240 default: 241 panic("pfi_kif_ref with unknown type"); 242 } 243 } 244 245 void 246 pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what) 247 { 248 if (kif == NULL) 249 return; 250 251 switch (what) { 252 case PFI_KIF_REF_NONE: 253 break; 254 case PFI_KIF_REF_RULE: 255 if (kif->pfik_rules <= 0) { 256 kprintf("pfi_kif_unref: rules refcount <= 0\n"); 257 return; 258 } 259 kif->pfik_rules--; 260 break; 261 case PFI_KIF_REF_STATE: 262 if (kif->pfik_states <= 0) { 263 kprintf("pfi_kif_unref: state refcount <= 0\n"); 264 return; 265 } 266 kif->pfik_states--; 267 break; 268 default: 269 panic("pfi_kif_unref with unknown type"); 270 } 271 272 if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == pfi_all) 273 return; 274 275 if (kif->pfik_rules || kif->pfik_states) 276 return; 277 278 RB_REMOVE(pfi_ifhead, &pfi_ifs, kif); 279 kfree(kif, PFI_MTYPE); 280 } 281 282 int 283 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif) 284 { 285 struct ifg_list *p; 286 287 if (rule_kif == NULL || rule_kif == packet_kif) 288 return (1); 289 290 if (rule_kif->pfik_group != NULL) 291 TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next) 292 if (p->ifgl_group == rule_kif->pfik_group) 293 return (1); 294 295 return (0); 296 } 297 298 void 299 pfi_attach_ifnet(struct ifnet *ifp) 300 { 301 struct pfi_kif *kif; 302 303 pfi_initialize(); 304 crit_enter(); 305 pfi_update++; 306 if ((kif = pfi_kif_get(ifp->if_xname)) == NULL) 307 panic("pfi_kif_get failed"); 308 309 kif->pfik_ifp = ifp; 310 ifp->if_pf_kif = (caddr_t)kif; 311 312 pfi_kif_update(kif); 313 314 crit_exit(); 315 } 316 317 void 318 pfi_detach_ifnet(struct ifnet *ifp) 319 { 320 struct pfi_kif *kif; 321 322 if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL) 323 return; 324 325 crit_enter(); 326 pfi_update++; 327 pfi_kif_update(kif); 328 329 kif->pfik_ifp = NULL; 330 ifp->if_pf_kif = NULL; 331 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 332 crit_exit(); 333 } 334 335 void 336 pfi_attach_ifgroup(struct ifg_group *ifg) 337 { 338 struct pfi_kif *kif; 339 340 pfi_initialize(); 341 crit_enter(); 342 pfi_update++; 343 if ((kif = pfi_kif_get(ifg->ifg_group)) == NULL) 344 panic("pfi_kif_get failed"); 345 346 kif->pfik_group = ifg; 347 ifg->ifg_pf_kif = (caddr_t)kif; 348 349 crit_exit(); 350 } 351 352 void 353 pfi_detach_ifgroup(struct ifg_group *ifg) 354 { 355 struct pfi_kif *kif; 356 357 if ((kif = (struct pfi_kif *)ifg->ifg_pf_kif) == NULL) 358 return; 359 360 crit_enter(); 361 pfi_update++; 362 363 kif->pfik_group = NULL; 364 ifg->ifg_pf_kif = NULL; 365 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 366 crit_exit(); 367 } 368 369 void 370 pfi_group_change(const char *group) 371 { 372 struct pfi_kif *kif; 373 374 crit_enter(); 375 pfi_update++; 376 if ((kif = pfi_kif_get(group)) == NULL) 377 panic("pfi_kif_get failed"); 378 379 pfi_kif_update(kif); 380 381 crit_exit(); 382 } 383 384 int 385 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 386 { 387 switch (af) { 388 #ifdef INET 389 case AF_INET: 390 switch (dyn->pfid_acnt4) { 391 case 0: 392 return (0); 393 case 1: 394 return (PF_MATCHA(0, &dyn->pfid_addr4, 395 &dyn->pfid_mask4, a, AF_INET)); 396 default: 397 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 398 } 399 break; 400 #endif /* INET */ 401 #ifdef INET6 402 case AF_INET6: 403 switch (dyn->pfid_acnt6) { 404 case 0: 405 return (0); 406 case 1: 407 return (PF_MATCHA(0, &dyn->pfid_addr6, 408 &dyn->pfid_mask6, a, AF_INET6)); 409 default: 410 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 411 } 412 break; 413 #endif /* INET6 */ 414 default: 415 return (0); 416 } 417 } 418 419 int 420 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 421 { 422 struct pfi_dynaddr *dyn; 423 char tblname[PF_TABLE_NAME_SIZE]; 424 struct pf_ruleset *ruleset = NULL; 425 int rv = 0; 426 427 if (aw->type != PF_ADDR_DYNIFTL) 428 return (0); 429 if ((dyn = kmalloc(sizeof(struct pfi_dynaddr), M_PFIADDRPL, M_WAITOK|M_NULLOK|M_ZERO)) 430 == NULL) 431 return (1); 432 433 crit_enter(); 434 if (!strcmp(aw->v.ifname, "self")) 435 dyn->pfid_kif = pfi_kif_get(IFG_ALL); 436 else 437 dyn->pfid_kif = pfi_kif_get(aw->v.ifname); 438 if (dyn->pfid_kif == NULL) { 439 rv = 1; 440 goto _bad; 441 } 442 pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE); 443 444 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 445 if (af == AF_INET && dyn->pfid_net == 32) 446 dyn->pfid_net = 128; 447 strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 448 if (aw->iflags & PFI_AFLAG_NETWORK) 449 strlcat(tblname, ":network", sizeof(tblname)); 450 if (aw->iflags & PFI_AFLAG_BROADCAST) 451 strlcat(tblname, ":broadcast", sizeof(tblname)); 452 if (aw->iflags & PFI_AFLAG_PEER) 453 strlcat(tblname, ":peer", sizeof(tblname)); 454 if (aw->iflags & PFI_AFLAG_NOALIAS) 455 strlcat(tblname, ":0", sizeof(tblname)); 456 if (dyn->pfid_net != 128) 457 ksnprintf(tblname + strlen(tblname), 458 sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 459 if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) { 460 rv = 1; 461 goto _bad; 462 } 463 464 if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) { 465 rv = 1; 466 goto _bad; 467 } 468 469 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 470 dyn->pfid_iflags = aw->iflags; 471 dyn->pfid_af = af; 472 473 TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); 474 aw->p.dyn = dyn; 475 pfi_kif_update(dyn->pfid_kif); 476 crit_exit(); 477 return (0); 478 479 _bad: 480 if (dyn->pfid_kt != NULL) 481 pfr_detach_table(dyn->pfid_kt); 482 if (ruleset != NULL) 483 pf_remove_if_empty_ruleset(ruleset); 484 if (dyn->pfid_kif != NULL) 485 pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE); 486 kfree(dyn, M_PFIADDRPL); 487 crit_exit(); 488 return (rv); 489 } 490 491 void 492 pfi_kif_update(struct pfi_kif *kif) 493 { 494 struct ifg_list *ifgl; 495 struct pfi_dynaddr *p; 496 497 /* update all dynaddr */ 498 TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) 499 pfi_dynaddr_update(p); 500 501 /* again for all groups kif is member of */ 502 if (kif->pfik_ifp != NULL) 503 TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next) 504 pfi_kif_update((struct pfi_kif *) 505 ifgl->ifgl_group->ifg_pf_kif); 506 } 507 508 void 509 pfi_dynaddr_update(struct pfi_dynaddr *dyn) 510 { 511 struct pfi_kif *kif; 512 struct pfr_ktable *kt; 513 514 if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) 515 panic("pfi_dynaddr_update"); 516 517 kif = dyn->pfid_kif; 518 kt = dyn->pfid_kt; 519 520 if (kt->pfrkt_larg != pfi_update) { 521 /* this table needs to be brought up-to-date */ 522 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 523 kt->pfrkt_larg = pfi_update; 524 } 525 pfr_dynaddr_update(kt, dyn); 526 } 527 528 void 529 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 530 { 531 int e, size2 = 0; 532 struct ifg_member *ifgm; 533 534 pfi_buffer_cnt = 0; 535 536 if (kif->pfik_ifp != NULL) 537 pfi_instance_add(kif->pfik_ifp, net, flags); 538 else if (kif->pfik_group != NULL) 539 TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next) 540 pfi_instance_add(ifgm->ifgm_ifp, net, flags); 541 542 if ((e = pfr_set_addrs(&kt->pfrkt_t, pfi_buffer, pfi_buffer_cnt, &size2, 543 NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) 544 kprintf("pfi_table_update: cannot set %d new addresses " 545 "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 546 } 547 548 struct netmsg_pfiadd { 549 struct netmsg_base base; 550 struct ifnet *ifp; 551 int net; 552 int flags; 553 }; 554 555 static void 556 pfi_instance_add_dispatch(netmsg_t nmsg) 557 { 558 struct netmsg_pfiadd *msg = (struct netmsg_pfiadd *)nmsg; 559 struct ifaddr_container *ifac; 560 int got4 = 0, got6 = 0; 561 int net2, af; 562 struct ifnet *ifp = msg->ifp; 563 int net = msg->net, flags = msg->flags; 564 565 if (ifp == NULL) 566 goto done; 567 /* 568 * The ifaddr processing in the following loop will block, 569 * however, this function is called in netisr0, in which 570 * ifaddr list changes happen, so we don't care about the 571 * blockness of the ifaddr processing here. 572 */ 573 TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) { 574 struct ifaddr *ia = ifac->ifa; 575 576 if (ia->ifa_addr == NULL) 577 continue; 578 af = ia->ifa_addr->sa_family; 579 if (af != AF_INET && af != AF_INET6) 580 continue; 581 /* 582 * XXX: For point-to-point interfaces, (ifname:0) and IPv4, 583 * jump over address without a proper route to work 584 * around a problem with ppp not fully removing the 585 * address used during IPCP. 586 */ 587 if ((ifp->if_flags & IFF_POINTOPOINT) && 588 !(ia->ifa_flags & IFA_ROUTE) && 589 (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET)) 590 continue; 591 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 592 continue; 593 if ((flags & PFI_AFLAG_BROADCAST) && 594 !(ifp->if_flags & IFF_BROADCAST)) 595 continue; 596 if ((flags & PFI_AFLAG_PEER) && 597 !(ifp->if_flags & IFF_POINTOPOINT)) 598 continue; 599 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 600 IN6_IS_ADDR_LINKLOCAL( 601 &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 602 continue; 603 if (flags & PFI_AFLAG_NOALIAS) { 604 if (af == AF_INET && got4) 605 continue; 606 if (af == AF_INET6 && got6) 607 continue; 608 } 609 if (af == AF_INET) 610 got4 = 1; 611 else if (af == AF_INET6) 612 got6 = 1; 613 net2 = net; 614 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 615 if (af == AF_INET) 616 net2 = pfi_unmask(&((struct sockaddr_in *) 617 ia->ifa_netmask)->sin_addr); 618 else if (af == AF_INET6) 619 net2 = pfi_unmask(&((struct sockaddr_in6 *) 620 ia->ifa_netmask)->sin6_addr); 621 } 622 if (af == AF_INET && net2 > 32) 623 net2 = 32; 624 if (flags & PFI_AFLAG_BROADCAST) 625 pfi_address_add(ia->ifa_broadaddr, af, net2); 626 else if (flags & PFI_AFLAG_PEER) 627 pfi_address_add(ia->ifa_dstaddr, af, net2); 628 else 629 pfi_address_add(ia->ifa_addr, af, net2); 630 } 631 done: 632 netisr_replymsg(&nmsg->base, 0); 633 } 634 635 void 636 pfi_instance_add(struct ifnet *ifp, int net, int flags) 637 { 638 struct netmsg_pfiadd msg; 639 640 netmsg_init(&msg.base, NULL, &curthread->td_msgport, 0, 641 pfi_instance_add_dispatch); 642 msg.ifp = ifp; 643 msg.net = net; 644 msg.flags = flags; 645 netisr_domsg(&msg.base, 0); 646 } 647 648 void 649 pfi_address_add(struct sockaddr *sa, int af, int net) 650 { 651 struct pfr_addr *p; 652 int i; 653 654 if (pfi_buffer_cnt >= pfi_buffer_max) { 655 int new_max = pfi_buffer_max * 2; 656 657 if (new_max > PFI_BUFFER_MAX) { 658 kprintf("pfi_address_add: address buffer full (%d/%d)\n", 659 pfi_buffer_cnt, PFI_BUFFER_MAX); 660 return; 661 } 662 p = kmalloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, M_WAITOK); 663 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer)); 664 /* no need to zero buffer */ 665 kfree(pfi_buffer, PFI_MTYPE); 666 pfi_buffer = p; 667 pfi_buffer_max = new_max; 668 } 669 if (af == AF_INET && net > 32) 670 net = 128; 671 p = pfi_buffer + pfi_buffer_cnt++; 672 bzero(p, sizeof(*p)); 673 p->pfra_af = af; 674 p->pfra_net = net; 675 if (af == AF_INET) 676 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 677 else if (af == AF_INET6) { 678 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 679 if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) 680 p->pfra_ip6addr.s6_addr16[1] = 0; 681 } 682 /* mask network address bits */ 683 if (net < 128) 684 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 685 for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 686 ((caddr_t)p)[i] = 0; 687 } 688 689 void 690 pfi_dynaddr_remove(struct pf_addr_wrap *aw) 691 { 692 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 693 aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 694 return; 695 696 crit_enter(); 697 TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry); 698 pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE); 699 aw->p.dyn->pfid_kif = NULL; 700 pfr_detach_table(aw->p.dyn->pfid_kt); 701 aw->p.dyn->pfid_kt = NULL; 702 kfree(aw->p.dyn, M_PFIADDRPL); 703 aw->p.dyn = NULL; 704 crit_exit(); 705 } 706 707 void 708 pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 709 { 710 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 711 aw->p.dyn->pfid_kif == NULL) 712 return; 713 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 714 } 715 716 void 717 pfi_kifaddr_update(void *v) 718 { 719 struct pfi_kif *kif = (struct pfi_kif *)v; 720 721 crit_enter(); 722 pfi_update++; 723 pfi_kif_update(kif); 724 crit_exit(); 725 } 726 727 int 728 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 729 { 730 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 731 } 732 733 void 734 pfi_update_status(const char *name, struct pf_status *pfs) 735 { 736 struct pfi_kif *p; 737 struct pfi_kif_cmp key; 738 struct ifg_member p_member, *ifgm; 739 TAILQ_HEAD(, ifg_member) ifg_members; 740 int i, j, k; 741 742 strlcpy(key.pfik_ifname, name, sizeof(key.pfik_ifname)); 743 crit_enter(); 744 p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&key); 745 if (p == NULL) { 746 crit_exit(); 747 return; 748 } 749 if (p->pfik_group != NULL) { 750 bcopy(&p->pfik_group->ifg_members, &ifg_members, 751 sizeof(ifg_members)); 752 } else { 753 /* build a temporary list for p only */ 754 bzero(&p_member, sizeof(p_member)); 755 p_member.ifgm_ifp = p->pfik_ifp; 756 TAILQ_INIT(&ifg_members); 757 TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next); 758 } 759 if (pfs) { 760 bzero(pfs->pcounters, sizeof(pfs->pcounters)); 761 bzero(pfs->bcounters, sizeof(pfs->bcounters)); 762 } 763 TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) { 764 if (ifgm->ifgm_ifp == NULL) 765 continue; 766 p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif; 767 768 /* just clear statistics */ 769 if (pfs == NULL) { 770 bzero(p->pfik_packets, sizeof(p->pfik_packets)); 771 bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 772 p->pfik_tzero = time_second; 773 continue; 774 } 775 for (i = 0; i < 2; i++) 776 for (j = 0; j < 2; j++) 777 for (k = 0; k < 2; k++) { 778 pfs->pcounters[i][j][k] += 779 p->pfik_packets[i][j][k]; 780 pfs->bcounters[i][j] += 781 p->pfik_bytes[i][j][k]; 782 } 783 } 784 crit_exit(); 785 } 786 787 int 788 pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size) 789 { 790 struct pfi_kif *p, *nextp; 791 int n = 0; 792 793 crit_enter(); 794 for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) { 795 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); 796 if (pfi_skip_if(name, p)) 797 continue; 798 if (*size > n++) { 799 if (!p->pfik_tzero) 800 p->pfik_tzero = time_second; 801 pfi_kif_ref(p, PFI_KIF_REF_RULE); 802 if (copyout(p, buf++, sizeof(*buf))) { 803 pfi_kif_unref(p, PFI_KIF_REF_RULE); 804 crit_exit(); 805 return (EFAULT); 806 } 807 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); 808 pfi_kif_unref(p, PFI_KIF_REF_RULE); 809 } 810 } 811 crit_exit(); 812 *size = n; 813 return (0); 814 } 815 816 int 817 pfi_skip_if(const char *filter, struct pfi_kif *p) 818 { 819 int n; 820 821 if (filter == NULL || !*filter) 822 return (0); 823 if (!strcmp(p->pfik_name, filter)) 824 return (0); /* exact match */ 825 n = strlen(filter); 826 if (n < 1 || n >= IFNAMSIZ) 827 return (1); /* sanity check */ 828 if (filter[n-1] >= '0' && filter[n-1] <= '9') 829 return (1); /* only do exact match in that case */ 830 if (strncmp(p->pfik_name, filter, n)) 831 return (1); /* prefix doesn't match */ 832 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 833 } 834 835 int 836 pfi_set_flags(const char *name, int flags) 837 { 838 struct pfi_kif *p; 839 840 crit_enter(); 841 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 842 if (pfi_skip_if(name, p)) 843 continue; 844 p->pfik_flags |= flags; 845 } 846 crit_exit(); 847 return (0); 848 } 849 850 int 851 pfi_clear_flags(const char *name, int flags) 852 { 853 struct pfi_kif *p; 854 855 crit_enter(); 856 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 857 if (pfi_skip_if(name, p)) 858 continue; 859 p->pfik_flags &= ~flags; 860 } 861 crit_exit(); 862 return (0); 863 } 864 865 /* from pf_print_state.c */ 866 int 867 pfi_unmask(void *addr) 868 { 869 struct pf_addr *m = addr; 870 int i = 31, j = 0, b = 0; 871 u_int32_t tmp; 872 873 while (j < 4 && m->addr32[j] == 0xffffffff) { 874 b += 32; 875 j++; 876 } 877 if (j < 4) { 878 tmp = ntohl(m->addr32[j]); 879 for (i = 31; tmp & (1 << i); --i) 880 b++; 881 } 882 return (b); 883 } 884 885