xref: /dragonfly/sys/net/pf/pf_if.c (revision bb8c85ff) 
1 /*	$OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $ */
2 
3 /*
4  * Copyright 2005 Henning Brauer <henning@openbsd.org>
5  * Copyright 2005 Ryan McBride <mcbride@openbsd.org>
6  * Copyright (c) 2001 Daniel Hartmeier
7  * Copyright (c) 2003 Cedric Berger
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  *
14  *    - Redistributions of source code must retain the above copyright
15  *      notice, this list of conditions and the following disclaimer.
16  *    - Redistributions in binary form must reproduce the above
17  *      copyright notice, this list of conditions and the following
18  *      disclaimer in the documentation and/or other materials provided
19  *      with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/malloc.h>
41 #include <sys/mbuf.h>
42 #include <sys/eventhandler.h>
43 #include <sys/filio.h>
44 #include <sys/msgport2.h>
45 #include <sys/socket.h>
46 #include <sys/socketvar.h>
47 #include <sys/kernel.h>
48 #include <sys/thread2.h>
49 #include <sys/time.h>
50 
51 #include <net/if.h>
52 #include <net/if_types.h>
53 #include <net/netisr2.h>
54 #include <net/netmsg2.h>
55 #include <net/route.h>
56 
57 #include <netinet/in.h>
58 #include <netinet/in_var.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/ip.h>
61 #include <netinet/ip_var.h>
62 
63 #include <net/pf/pfvar.h>
64 
65 #ifdef INET6
66 #include <netinet/ip6.h>
67 #endif /* INET6 */
68 
69 struct pfi_kif		 *pfi_all = NULL;
70 struct pfi_ifhead	  pfi_ifs;
71 long			  pfi_update = 1;
72 struct pfr_addr		 *pfi_buffer;
73 int			  pfi_buffer_cnt;
74 int			  pfi_buffer_max;
75 
76 eventhandler_tag	 pfi_clone_cookie = NULL;
77 eventhandler_tag	 pfi_attach_cookie = NULL;
78 eventhandler_tag	 pfi_detach_cookie = NULL;
79 
80 void		 pfi_kif_update(struct pfi_kif *);
81 void		 pfi_dynaddr_update(struct pfi_dynaddr *dyn);
82 void		 pfi_table_update(struct pfr_ktable *, struct pfi_kif *,
83 		    int, int);
84 void		 pfi_kifaddr_update(void *);
85 void		 pfi_instance_add(struct ifnet *, int, int);
86 void		 pfi_address_add(struct sockaddr *, int, int);
87 int		 pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
88 int		 pfi_skip_if(const char *, struct pfi_kif *);
89 int		 pfi_unmask(void *);
90 void		 pfi_kifaddr_update_event(void *, struct ifnet *,
91 		     enum ifaddr_event, struct ifaddr *);
92 /*XXX jl void		 pfi_attach_clone_event(void *, struct if_clone *);*/
93 void		 pfi_attach_ifnet_event(void *, struct ifnet *);
94 void		 pfi_detach_ifnet_event(void *, struct ifnet *);
95 
96 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
97 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
98 
99 #define PFI_BUFFER_MAX		0x10000
100 MALLOC_DEFINE(PFI_MTYPE, "pf_if", "pf interface table");
101 static MALLOC_DEFINE(M_PFIADDRPL, "pfiaddrpl", "pf interface address pool list");
102 
103 
104 void
105 pfi_initialize(void)
106 {
107 	struct ifnet	*ifp;
108 
109 	if (pfi_all != NULL)	/* already initialized */
110 		return;
111 
112 	pfi_buffer_max = 64;
113 	pfi_buffer = kmalloc(pfi_buffer_max * sizeof(*pfi_buffer),
114 	    PFI_MTYPE, M_WAITOK);
115 
116 	if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
117 		panic("pfi_kif_get for pfi_all failed");
118 
119 	/* XXX ALMOST MPSAFE */
120 	ifnet_lock();
121 	TAILQ_FOREACH(ifp, &ifnetlist, if_link) {
122 		if (ifp->if_dunit != IF_DUNIT_NONE)
123 			pfi_attach_ifnet(ifp);
124 	}
125 	ifnet_unlock();
126 	pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_attach_event,
127 	    pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
128 	pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_detach_event,
129 	    pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
130 /* XXX jl	pfi_clone_cookie = EVENTHANDLER_REGISTER(if_clone_event,
131 	    pfi_attach_clone_event, NULL, EVENTHANDLER_PRI_ANY); */
132 
133 	if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
134 		panic("pfi_kif_get for pfi_all failed");
135 }
136 
137 void
138 pfi_cleanup(void)
139 {
140 	struct pfi_kif *p, key;
141 	struct ifnet *ifp;
142 
143 	EVENTHANDLER_DEREGISTER(ifnet_attach_event, pfi_attach_cookie);
144 	EVENTHANDLER_DEREGISTER(ifnet_detach_event, pfi_detach_cookie);
145 	EVENTHANDLER_DEREGISTER(if_clone_event, pfi_clone_cookie);
146 
147 	/* release PFI_IFLAG_INSTANCE */
148 	/* XXX ALMOST MPSAFE */
149 	ifnet_lock();
150 	TAILQ_FOREACH(ifp, &ifnetlist, if_link) {
151 		strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name));
152 		p = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
153 		if (p != NULL)
154 			pfi_detach_ifnet(ifp);
155 	}
156 	ifnet_unlock();
157 
158 	/* XXX clear all other interface group */
159 	while ((p = RB_MIN(pfi_ifhead, &pfi_ifs))) {
160 		RB_REMOVE(pfi_ifhead, &pfi_ifs, p);
161 
162 		kfree(p, PFI_MTYPE);
163 	}
164 	kfree(pfi_buffer, PFI_MTYPE);
165 	pfi_buffer = NULL;
166 	pfi_all = NULL;
167 }
168 
169 /*
170  * Wrapper functions for FreeBSD eventhandler
171  */
172 void
173 pfi_kifaddr_update_event(void *arg, struct ifnet *ifp,
174     enum ifaddr_event event __unused, struct ifaddr *ifa __unused)
175 {
176 	struct pfi_kif *p = arg;
177 
178 	/*
179 	 * Check to see if it is 'our' interface as we do not have per
180 	 * interface hooks and thus get an update for every interface.
181 	 */
182 	if (p && p->pfik_ifp == ifp)
183 		pfi_kifaddr_update(p);
184 }
185 
186 /* XXX jl
187 void
188 pfi_attach_clone_event(void *arg __unused, struct if_clone *ifc)
189 {
190 	pfi_attach_clone(ifc);
191 }
192 */
193 
194 void
195 pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp)
196 {
197 	if (ifp->if_dunit != IF_DUNIT_NONE)
198 		pfi_attach_ifnet(ifp);
199 }
200 
201 void
202 pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp)
203 {
204 	pfi_detach_ifnet(ifp);
205 }
206 
207 struct pfi_kif *
208 pfi_kif_get(const char *kif_name)
209 {
210 	struct pfi_kif		*kif;
211 	struct pfi_kif_cmp	 s;
212 
213 	bzero(&s, sizeof(s));
214 	strlcpy(s.pfik_ifname, kif_name, sizeof(s.pfik_ifname));
215 	if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&s)) != NULL)
216 		return (kif);
217 
218 	/* create new one */
219 	if ((kif = kmalloc(sizeof(*kif), PFI_MTYPE, M_WAITOK | M_ZERO)) == NULL)
220 		return (NULL);
221 
222 	strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name));
223 	kif->pfik_tzero = time_second;
224 	TAILQ_INIT(&kif->pfik_dynaddrs);
225 
226 	RB_INSERT(pfi_ifhead, &pfi_ifs, kif);
227 	return (kif);
228 }
229 
230 void
231 pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what)
232 {
233 	switch (what) {
234 	case PFI_KIF_REF_RULE:
235 		kif->pfik_rules++;
236 		break;
237 	case PFI_KIF_REF_STATE:
238 		kif->pfik_states++;
239 		break;
240 	default:
241 		panic("pfi_kif_ref with unknown type");
242 	}
243 }
244 
245 void
246 pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
247 {
248 	if (kif == NULL)
249 		return;
250 
251 	switch (what) {
252 	case PFI_KIF_REF_NONE:
253 		break;
254 	case PFI_KIF_REF_RULE:
255 		if (kif->pfik_rules <= 0) {
256 			kprintf("pfi_kif_unref: rules refcount <= 0\n");
257 			return;
258 		}
259 		kif->pfik_rules--;
260 		break;
261 	case PFI_KIF_REF_STATE:
262 		if (kif->pfik_states <= 0) {
263 			kprintf("pfi_kif_unref: state refcount <= 0\n");
264 			return;
265 		}
266 		kif->pfik_states--;
267 		break;
268 	default:
269 		panic("pfi_kif_unref with unknown type");
270 	}
271 
272 	if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == pfi_all)
273 		return;
274 
275 	if (kif->pfik_rules || kif->pfik_states)
276 		return;
277 
278 	RB_REMOVE(pfi_ifhead, &pfi_ifs, kif);
279 	kfree(kif, PFI_MTYPE);
280 }
281 
282 int
283 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
284 {
285 	struct ifg_list	*p;
286 
287 	if (rule_kif == NULL || rule_kif == packet_kif)
288 		return (1);
289 
290 	if (rule_kif->pfik_group != NULL)
291 		TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next)
292 			if (p->ifgl_group == rule_kif->pfik_group)
293 				return (1);
294 
295 	return (0);
296 }
297 
298 void
299 pfi_attach_ifnet(struct ifnet *ifp)
300 {
301 	struct pfi_kif		*kif;
302 
303 	pfi_initialize();
304 	crit_enter();
305 	pfi_update++;
306 	if ((kif = pfi_kif_get(ifp->if_xname)) == NULL)
307 		panic("pfi_kif_get failed");
308 
309 	kif->pfik_ifp = ifp;
310 	ifp->if_pf_kif = (caddr_t)kif;
311 
312 	pfi_kif_update(kif);
313 
314 	crit_exit();
315 }
316 
317 void
318 pfi_detach_ifnet(struct ifnet *ifp)
319 {
320 	struct pfi_kif		*kif;
321 
322 	if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL)
323 		return;
324 
325 	crit_enter();
326 	pfi_update++;
327 	pfi_kif_update(kif);
328 
329 	kif->pfik_ifp = NULL;
330 	ifp->if_pf_kif = NULL;
331 	pfi_kif_unref(kif, PFI_KIF_REF_NONE);
332 	crit_exit();
333 }
334 
335 void
336 pfi_attach_ifgroup(struct ifg_group *ifg)
337 {
338 	struct pfi_kif	*kif;
339 
340 	pfi_initialize();
341 	crit_enter();
342 	pfi_update++;
343 	if ((kif = pfi_kif_get(ifg->ifg_group)) == NULL)
344 		panic("pfi_kif_get failed");
345 
346 	kif->pfik_group = ifg;
347 	ifg->ifg_pf_kif = (caddr_t)kif;
348 
349 	crit_exit();
350 }
351 
352 void
353 pfi_detach_ifgroup(struct ifg_group *ifg)
354 {
355 	struct pfi_kif	*kif;
356 
357 	if ((kif = (struct pfi_kif *)ifg->ifg_pf_kif) == NULL)
358 		return;
359 
360 	crit_enter();
361 	pfi_update++;
362 
363 	kif->pfik_group = NULL;
364 	ifg->ifg_pf_kif = NULL;
365 	pfi_kif_unref(kif, PFI_KIF_REF_NONE);
366 	crit_exit();
367 }
368 
369 void
370 pfi_group_change(const char *group)
371 {
372 	struct pfi_kif		*kif;
373 
374 	crit_enter();
375 	pfi_update++;
376 	if ((kif = pfi_kif_get(group)) == NULL)
377 		panic("pfi_kif_get failed");
378 
379 	pfi_kif_update(kif);
380 
381 	crit_exit();
382 }
383 
384 int
385 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
386 {
387 	switch (af) {
388 #ifdef INET
389 	case AF_INET:
390 		switch (dyn->pfid_acnt4) {
391 		case 0:
392 			return (0);
393 		case 1:
394 			return (PF_MATCHA(0, &dyn->pfid_addr4,
395 			    &dyn->pfid_mask4, a, AF_INET));
396 		default:
397 			return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
398 		}
399 		break;
400 #endif /* INET */
401 #ifdef INET6
402 	case AF_INET6:
403 		switch (dyn->pfid_acnt6) {
404 		case 0:
405 			return (0);
406 		case 1:
407 			return (PF_MATCHA(0, &dyn->pfid_addr6,
408 			    &dyn->pfid_mask6, a, AF_INET6));
409 		default:
410 			return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
411 		}
412 		break;
413 #endif /* INET6 */
414 	default:
415 		return (0);
416 	}
417 }
418 
419 int
420 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
421 {
422 	struct pfi_dynaddr	*dyn;
423 	char			 tblname[PF_TABLE_NAME_SIZE];
424 	struct pf_ruleset	*ruleset = NULL;
425 	int			 rv = 0;
426 
427 	if (aw->type != PF_ADDR_DYNIFTL)
428 		return (0);
429 	if ((dyn = kmalloc(sizeof(struct pfi_dynaddr), M_PFIADDRPL, M_WAITOK|M_NULLOK|M_ZERO))
430 	    == NULL)
431 		return (1);
432 
433 	crit_enter();
434 	if (!strcmp(aw->v.ifname, "self"))
435 		dyn->pfid_kif = pfi_kif_get(IFG_ALL);
436 	else
437 		dyn->pfid_kif = pfi_kif_get(aw->v.ifname);
438 	if (dyn->pfid_kif == NULL) {
439 		rv = 1;
440 		goto _bad;
441 	}
442 	pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE);
443 
444 	dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
445 	if (af == AF_INET && dyn->pfid_net == 32)
446 		dyn->pfid_net = 128;
447 	strlcpy(tblname, aw->v.ifname, sizeof(tblname));
448 	if (aw->iflags & PFI_AFLAG_NETWORK)
449 		strlcat(tblname, ":network", sizeof(tblname));
450 	if (aw->iflags & PFI_AFLAG_BROADCAST)
451 		strlcat(tblname, ":broadcast", sizeof(tblname));
452 	if (aw->iflags & PFI_AFLAG_PEER)
453 		strlcat(tblname, ":peer", sizeof(tblname));
454 	if (aw->iflags & PFI_AFLAG_NOALIAS)
455 		strlcat(tblname, ":0", sizeof(tblname));
456 	if (dyn->pfid_net != 128)
457 		ksnprintf(tblname + strlen(tblname),
458 		    sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
459 	if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
460 		rv = 1;
461 		goto _bad;
462 	}
463 
464 	if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) {
465 		rv = 1;
466 		goto _bad;
467 	}
468 
469 	dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE;
470 	dyn->pfid_iflags = aw->iflags;
471 	dyn->pfid_af = af;
472 
473 	TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
474 	aw->p.dyn = dyn;
475 	pfi_kif_update(dyn->pfid_kif);
476 	crit_exit();
477 	return (0);
478 
479 _bad:
480 	if (dyn->pfid_kt != NULL)
481 		pfr_detach_table(dyn->pfid_kt);
482 	if (ruleset != NULL)
483 		pf_remove_if_empty_ruleset(ruleset);
484 	if (dyn->pfid_kif != NULL)
485 		pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE);
486 	kfree(dyn, M_PFIADDRPL);
487 	crit_exit();
488 	return (rv);
489 }
490 
491 void
492 pfi_kif_update(struct pfi_kif *kif)
493 {
494 	struct ifg_list		*ifgl;
495 	struct pfi_dynaddr	*p;
496 
497 	/* update all dynaddr */
498 	TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
499 		pfi_dynaddr_update(p);
500 
501 	/* again for all groups kif is member of */
502 	if (kif->pfik_ifp != NULL)
503 		TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)
504 			pfi_kif_update((struct pfi_kif *)
505 			    ifgl->ifgl_group->ifg_pf_kif);
506 }
507 
508 void
509 pfi_dynaddr_update(struct pfi_dynaddr *dyn)
510 {
511 	struct pfi_kif		*kif;
512 	struct pfr_ktable	*kt;
513 
514 	if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL)
515 		panic("pfi_dynaddr_update");
516 
517 	kif = dyn->pfid_kif;
518 	kt = dyn->pfid_kt;
519 
520 	if (kt->pfrkt_larg != pfi_update) {
521 		/* this table needs to be brought up-to-date */
522 		pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags);
523 		kt->pfrkt_larg = pfi_update;
524 	}
525 	pfr_dynaddr_update(kt, dyn);
526 }
527 
528 void
529 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
530 {
531 	int			 e, size2 = 0;
532 	struct ifg_member	*ifgm;
533 
534 	pfi_buffer_cnt = 0;
535 
536 	if (kif->pfik_ifp != NULL)
537 		pfi_instance_add(kif->pfik_ifp, net, flags);
538 	else if (kif->pfik_group != NULL)
539 		TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next)
540 			pfi_instance_add(ifgm->ifgm_ifp, net, flags);
541 
542 	if ((e = pfr_set_addrs(&kt->pfrkt_t, pfi_buffer, pfi_buffer_cnt, &size2,
543 	    NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
544 		kprintf("pfi_table_update: cannot set %d new addresses "
545 		    "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);
546 }
547 
548 struct netmsg_pfiadd {
549 	struct netmsg_base	base;
550 	struct ifnet		*ifp;
551 	int			net;
552 	int			flags;
553 };
554 
555 static void
556 pfi_instance_add_dispatch(netmsg_t nmsg)
557 {
558 	struct netmsg_pfiadd *msg = (struct netmsg_pfiadd *)nmsg;
559 	struct ifaddr_container *ifac;
560 	int		 got4 = 0, got6 = 0;
561 	int		 net2, af;
562 	struct ifnet *ifp = msg->ifp;
563 	int net = msg->net, flags = msg->flags;
564 
565 	if (ifp == NULL)
566 		goto done;
567 	/*
568 	 * The ifaddr processing in the following loop will block,
569 	 * however, this function is called in netisr0, in which
570 	 * ifaddr list changes happen, so we don't care about the
571 	 * blockness of the ifaddr processing here.
572 	 */
573 	TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) {
574 		struct ifaddr *ia = ifac->ifa;
575 
576 		if (ia->ifa_addr == NULL)
577 			continue;
578 		af = ia->ifa_addr->sa_family;
579 		if (af != AF_INET && af != AF_INET6)
580 			continue;
581 		/*
582 		 * XXX: For point-to-point interfaces, (ifname:0) and IPv4,
583 		 *	jump over address without a proper route to work
584 		 *	around a problem with ppp not fully removing the
585 		 *	address used during IPCP.
586 		 */
587 		if ((ifp->if_flags & IFF_POINTOPOINT) &&
588 		    !(ia->ifa_flags & IFA_ROUTE) &&
589 		    (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET))
590 			continue;
591 		if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6)
592 			continue;
593 		if ((flags & PFI_AFLAG_BROADCAST) &&
594 		    !(ifp->if_flags & IFF_BROADCAST))
595 			continue;
596 		if ((flags & PFI_AFLAG_PEER) &&
597 		    !(ifp->if_flags & IFF_POINTOPOINT))
598 			continue;
599 		if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
600 		    IN6_IS_ADDR_LINKLOCAL(
601 		    &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
602 			continue;
603 		if (flags & PFI_AFLAG_NOALIAS) {
604 			if (af == AF_INET && got4)
605 				continue;
606 			if (af == AF_INET6 && got6)
607 				continue;
608 		}
609 		if (af == AF_INET)
610 			got4 = 1;
611 		else if (af == AF_INET6)
612 			got6 = 1;
613 		net2 = net;
614 		if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
615 			if (af == AF_INET)
616 				net2 = pfi_unmask(&((struct sockaddr_in *)
617 				    ia->ifa_netmask)->sin_addr);
618 			else if (af == AF_INET6)
619 				net2 = pfi_unmask(&((struct sockaddr_in6 *)
620 				    ia->ifa_netmask)->sin6_addr);
621 		}
622 		if (af == AF_INET && net2 > 32)
623 			net2 = 32;
624 		if (flags & PFI_AFLAG_BROADCAST)
625 			pfi_address_add(ia->ifa_broadaddr, af, net2);
626 		else if (flags & PFI_AFLAG_PEER)
627 			pfi_address_add(ia->ifa_dstaddr, af, net2);
628 		else
629 			pfi_address_add(ia->ifa_addr, af, net2);
630 	}
631 done:
632 	netisr_replymsg(&nmsg->base, 0);
633 }
634 
635 void
636 pfi_instance_add(struct ifnet *ifp, int net, int flags)
637 {
638 	struct netmsg_pfiadd msg;
639 
640 	netmsg_init(&msg.base, NULL, &curthread->td_msgport, 0,
641 	    pfi_instance_add_dispatch);
642 	msg.ifp = ifp;
643 	msg.net = net;
644 	msg.flags = flags;
645 	netisr_domsg(&msg.base, 0);
646 }
647 
648 void
649 pfi_address_add(struct sockaddr *sa, int af, int net)
650 {
651 	struct pfr_addr	*p;
652 	int		 i;
653 
654 	if (pfi_buffer_cnt >= pfi_buffer_max) {
655 		int		 new_max = pfi_buffer_max * 2;
656 
657 		if (new_max > PFI_BUFFER_MAX) {
658 			kprintf("pfi_address_add: address buffer full (%d/%d)\n",
659 			    pfi_buffer_cnt, PFI_BUFFER_MAX);
660 			return;
661 		}
662 		p = kmalloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, M_WAITOK);
663 		memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer));
664 		/* no need to zero buffer */
665 		kfree(pfi_buffer, PFI_MTYPE);
666 		pfi_buffer = p;
667 		pfi_buffer_max = new_max;
668 	}
669 	if (af == AF_INET && net > 32)
670 		net = 128;
671 	p = pfi_buffer + pfi_buffer_cnt++;
672 	bzero(p, sizeof(*p));
673 	p->pfra_af = af;
674 	p->pfra_net = net;
675 	if (af == AF_INET)
676 		p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr;
677 	else if (af == AF_INET6) {
678 		p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr;
679 		if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr))
680 			p->pfra_ip6addr.s6_addr16[1] = 0;
681 	}
682 	/* mask network address bits */
683 	if (net < 128)
684 		((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
685 	for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++)
686 		((caddr_t)p)[i] = 0;
687 }
688 
689 void
690 pfi_dynaddr_remove(struct pf_addr_wrap *aw)
691 {
692 	if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
693 	    aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL)
694 		return;
695 
696 	crit_enter();
697 	TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry);
698 	pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE);
699 	aw->p.dyn->pfid_kif = NULL;
700 	pfr_detach_table(aw->p.dyn->pfid_kt);
701 	aw->p.dyn->pfid_kt = NULL;
702 	kfree(aw->p.dyn, M_PFIADDRPL);
703 	aw->p.dyn = NULL;
704 	crit_exit();
705 }
706 
707 void
708 pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
709 {
710 	if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
711 	    aw->p.dyn->pfid_kif == NULL)
712 		return;
713 	aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
714 }
715 
716 void
717 pfi_kifaddr_update(void *v)
718 {
719 	struct pfi_kif		*kif = (struct pfi_kif *)v;
720 
721 	crit_enter();
722 	pfi_update++;
723 	pfi_kif_update(kif);
724 	crit_exit();
725 }
726 
727 int
728 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
729 {
730 	return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
731 }
732 
733 void
734 pfi_update_status(const char *name, struct pf_status *pfs)
735 {
736 	struct pfi_kif		*p;
737 	struct pfi_kif_cmp 	 key;
738 	struct ifg_member	 p_member, *ifgm;
739 	TAILQ_HEAD(, ifg_member) ifg_members;
740 	int			 i, j, k;
741 
742 	strlcpy(key.pfik_ifname, name, sizeof(key.pfik_ifname));
743 	crit_enter();
744 	p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&key);
745 	if (p == NULL) {
746 		crit_exit();
747 		return;
748 	}
749 	if (p->pfik_group != NULL) {
750 		bcopy(&p->pfik_group->ifg_members, &ifg_members,
751 		    sizeof(ifg_members));
752 	} else {
753 		/* build a temporary list for p only */
754 		bzero(&p_member, sizeof(p_member));
755 		p_member.ifgm_ifp = p->pfik_ifp;
756 		TAILQ_INIT(&ifg_members);
757 		TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next);
758 	}
759 	if (pfs) {
760 		bzero(pfs->pcounters, sizeof(pfs->pcounters));
761 		bzero(pfs->bcounters, sizeof(pfs->bcounters));
762 	}
763 	TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) {
764 		if (ifgm->ifgm_ifp == NULL)
765 			continue;
766 		p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif;
767 
768 		/* just clear statistics */
769 		if (pfs == NULL) {
770 			bzero(p->pfik_packets, sizeof(p->pfik_packets));
771 			bzero(p->pfik_bytes, sizeof(p->pfik_bytes));
772 			p->pfik_tzero = time_second;
773 			continue;
774 		}
775 		for (i = 0; i < 2; i++)
776 			for (j = 0; j < 2; j++)
777 				for (k = 0; k < 2; k++) {
778 					pfs->pcounters[i][j][k] +=
779 						p->pfik_packets[i][j][k];
780 					pfs->bcounters[i][j] +=
781 						p->pfik_bytes[i][j][k];
782 				}
783 	}
784 	crit_exit();
785 }
786 
787 int
788 pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size)
789 {
790 	struct pfi_kif	*p, *nextp;
791 	int		 n = 0;
792 
793 	crit_enter();
794 	for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) {
795 		nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
796 		if (pfi_skip_if(name, p))
797 			continue;
798 		if (*size > n++) {
799 			if (!p->pfik_tzero)
800 				p->pfik_tzero = time_second;
801 			pfi_kif_ref(p, PFI_KIF_REF_RULE);
802 			if (copyout(p, buf++, sizeof(*buf))) {
803 				pfi_kif_unref(p, PFI_KIF_REF_RULE);
804 				crit_exit();
805 				return (EFAULT);
806 			}
807 			nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
808 			pfi_kif_unref(p, PFI_KIF_REF_RULE);
809 		}
810 	}
811 	crit_exit();
812 	*size = n;
813 	return (0);
814 }
815 
816 int
817 pfi_skip_if(const char *filter, struct pfi_kif *p)
818 {
819 	int	n;
820 
821 	if (filter == NULL || !*filter)
822 		return (0);
823 	if (!strcmp(p->pfik_name, filter))
824 		return (0);	/* exact match */
825 	n = strlen(filter);
826 	if (n < 1 || n >= IFNAMSIZ)
827 		return (1);	/* sanity check */
828 	if (filter[n-1] >= '0' && filter[n-1] <= '9')
829 		return (1);	/* only do exact match in that case */
830 	if (strncmp(p->pfik_name, filter, n))
831 		return (1);	/* prefix doesn't match */
832 	return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
833 }
834 
835 int
836 pfi_set_flags(const char *name, int flags)
837 {
838 	struct pfi_kif	*p;
839 
840 	crit_enter();
841 	RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
842 		if (pfi_skip_if(name, p))
843 			continue;
844 		p->pfik_flags |= flags;
845 	}
846 	crit_exit();
847 	return (0);
848 }
849 
850 int
851 pfi_clear_flags(const char *name, int flags)
852 {
853 	struct pfi_kif	*p;
854 
855 	crit_enter();
856 	RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
857 		if (pfi_skip_if(name, p))
858 			continue;
859 		p->pfik_flags &= ~flags;
860 	}
861 	crit_exit();
862 	return (0);
863 }
864 
865 /* from pf_print_state.c */
866 int
867 pfi_unmask(void *addr)
868 {
869 	struct pf_addr *m = addr;
870 	int i = 31, j = 0, b = 0;
871 	u_int32_t tmp;
872 
873 	while (j < 4 && m->addr32[j] == 0xffffffff) {
874 		b += 32;
875 		j++;
876 	}
877 	if (j < 4) {
878 		tmp = ntohl(m->addr32[j]);
879 		for (i = 31; tmp & (1 << i); --i)
880 			b++;
881 	}
882 	return (b);
883 }
884 
885