1 /* $OpenBSD: pf_ruleset.c,v 1.1 2006/10/27 13:56:51 mcbride Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include <sys/param.h> 39 #include <sys/socket.h> 40 #ifdef _KERNEL 41 # include <sys/systm.h> 42 #endif /* _KERNEL */ 43 #include <sys/mbuf.h> 44 45 #include <netinet/in.h> 46 #include <netinet/in_systm.h> 47 #include <netinet/ip.h> 48 #include <netinet/tcp.h> 49 50 #include <net/if.h> 51 #include <net/pf/pfvar.h> 52 53 #ifdef INET6 54 #include <netinet/ip6.h> 55 #endif /* INET6 */ 56 57 58 #ifdef _KERNEL 59 # define DPFPRINTF(format, x...) \ 60 if (pf_status.debug >= PF_DEBUG_NOISY) \ 61 kprintf(format , ##x) 62 #define rs_malloc(x) kmalloc(x, M_PFRS, M_WAITOK) 63 #define rs_free(x) kfree(x, M_PFRS) 64 #define printf kprintf 65 66 static MALLOC_DEFINE(M_PFRS, "pfrulesetpl", "pf ruleset pool list"); 67 68 #else 69 /* Userland equivalents so we can lend code to pfctl et al. */ 70 71 # include <arpa/inet.h> 72 # include <errno.h> 73 # include <stdio.h> 74 # include <stdlib.h> 75 # include <string.h> 76 # define rs_malloc(x) malloc(x) 77 # define rs_free(x) free(x) 78 79 # ifdef PFDEBUG 80 # include <sys/stdarg.h> 81 # define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) 82 # else 83 # define DPFPRINTF(format, x...) ((void)0) 84 # endif /* PFDEBUG */ 85 #endif /* _KERNEL */ 86 87 struct pf_anchor_global pf_anchors; 88 struct pf_anchor pf_main_anchor; 89 90 /* 91 * XXX: hum? 92 int pf_get_ruleset_number(u_int8_t); 93 void pf_init_ruleset(struct pf_ruleset *); 94 int pf_anchor_setup(struct pf_rule *, 95 const struct pf_ruleset *, const char *); 96 int pf_anchor_copyout(const struct pf_ruleset *, 97 const struct pf_rule *, struct pfioc_rule *); 98 void pf_anchor_remove(struct pf_rule *); 99 */ 100 101 static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *); 102 103 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 104 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 105 106 static __inline int 107 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) 108 { 109 int c = strcmp(a->path, b->path); 110 111 return (c ? (c < 0 ? -1 : 1) : 0); 112 } 113 114 int 115 pf_get_ruleset_number(u_int8_t action) 116 { 117 switch (action) { 118 case PF_SCRUB: 119 case PF_NOSCRUB: 120 return (PF_RULESET_SCRUB); 121 break; 122 case PF_PASS: 123 case PF_DROP: 124 return (PF_RULESET_FILTER); 125 break; 126 case PF_NAT: 127 case PF_NONAT: 128 return (PF_RULESET_NAT); 129 break; 130 case PF_BINAT: 131 case PF_NOBINAT: 132 return (PF_RULESET_BINAT); 133 break; 134 case PF_RDR: 135 case PF_NORDR: 136 return (PF_RULESET_RDR); 137 break; 138 default: 139 return (PF_RULESET_MAX); 140 break; 141 } 142 } 143 144 void 145 pf_init_ruleset(struct pf_ruleset *ruleset) 146 { 147 int i; 148 149 memset(ruleset, 0, sizeof(struct pf_ruleset)); 150 for (i = 0; i < PF_RULESET_MAX; i++) { 151 TAILQ_INIT(&ruleset->rules[i].queues[0]); 152 TAILQ_INIT(&ruleset->rules[i].queues[1]); 153 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 154 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 155 } 156 } 157 158 struct pf_anchor * 159 pf_find_anchor(const char *path) 160 { 161 struct pf_anchor *key, *found; 162 163 key = (struct pf_anchor *)rs_malloc(sizeof(*key)); 164 memset(key, 0, sizeof(*key)); 165 strlcpy(key->path, path, sizeof(key->path)); 166 found = RB_FIND(pf_anchor_global, &pf_anchors, key); 167 rs_free(key); 168 return (found); 169 } 170 171 struct pf_ruleset * 172 pf_find_ruleset(const char *path) 173 { 174 struct pf_anchor *anchor; 175 176 while (*path == '/') 177 path++; 178 if (!*path) 179 return (&pf_main_ruleset); 180 anchor = pf_find_anchor(path); 181 if (anchor == NULL) 182 return (NULL); 183 else 184 return (&anchor->ruleset); 185 } 186 187 struct pf_ruleset * 188 pf_find_or_create_ruleset(const char *path) 189 { 190 char *p, *q, *r; 191 struct pf_ruleset *ruleset; 192 struct pf_anchor *anchor = NULL, *dup, *parent = NULL; 193 194 if (path[0] == 0) 195 return (&pf_main_ruleset); 196 while (*path == '/') 197 path++; 198 ruleset = pf_find_ruleset(path); 199 if (ruleset != NULL) 200 return (ruleset); 201 p = (char *)rs_malloc(MAXPATHLEN); 202 bzero(p, MAXPATHLEN); 203 strlcpy(p, path, MAXPATHLEN); 204 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 205 *q = 0; 206 if ((ruleset = pf_find_ruleset(p)) != NULL) { 207 parent = ruleset->anchor; 208 break; 209 } 210 } 211 if (q == NULL) 212 q = p; 213 else 214 q++; 215 strlcpy(p, path, MAXPATHLEN); 216 if (!*q) { 217 rs_free(p); 218 return (NULL); 219 } 220 while ((r = strchr(q, '/')) != NULL || *q) { 221 if (r != NULL) 222 *r = 0; 223 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 224 (parent != NULL && strlen(parent->path) >= 225 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 226 rs_free(p); 227 return (NULL); 228 } 229 anchor = (struct pf_anchor *)rs_malloc(sizeof(*anchor)); 230 if (anchor == NULL) { 231 rs_free(p); 232 return (NULL); 233 } 234 memset(anchor, 0, sizeof(*anchor)); 235 RB_INIT(&anchor->children); 236 strlcpy(anchor->name, q, sizeof(anchor->name)); 237 if (parent != NULL) { 238 strlcpy(anchor->path, parent->path, 239 sizeof(anchor->path)); 240 strlcat(anchor->path, "/", sizeof(anchor->path)); 241 } 242 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 243 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != 244 NULL) { 245 printf("pf_find_or_create_ruleset: RB_INSERT1 " 246 "'%s' '%s' collides with '%s' '%s'\n", 247 anchor->path, anchor->name, dup->path, dup->name); 248 rs_free(anchor); 249 rs_free(p); 250 return (NULL); 251 } 252 if (parent != NULL) { 253 anchor->parent = parent; 254 if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 255 anchor)) != NULL) { 256 printf("pf_find_or_create_ruleset: " 257 "RB_INSERT2 '%s' '%s' collides with " 258 "'%s' '%s'\n", anchor->path, anchor->name, 259 dup->path, dup->name); 260 RB_REMOVE(pf_anchor_global, &pf_anchors, 261 anchor); 262 rs_free(anchor); 263 rs_free(p); 264 return (NULL); 265 } 266 } 267 pf_init_ruleset(&anchor->ruleset); 268 anchor->ruleset.anchor = anchor; 269 parent = anchor; 270 if (r != NULL) 271 q = r + 1; 272 else 273 *q = 0; 274 } 275 rs_free(p); 276 return (&anchor->ruleset); 277 } 278 279 void 280 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 281 { 282 struct pf_anchor *parent; 283 int i; 284 285 while (ruleset != NULL) { 286 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 287 !RB_EMPTY(&ruleset->anchor->children) || 288 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 289 ruleset->topen) 290 return; 291 for (i = 0; i < PF_RULESET_MAX; ++i) 292 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 293 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 294 ruleset->rules[i].inactive.open) 295 return; 296 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); 297 if ((parent = ruleset->anchor->parent) != NULL) 298 RB_REMOVE(pf_anchor_node, &parent->children, 299 ruleset->anchor); 300 rs_free(ruleset->anchor); 301 if (parent == NULL) 302 return; 303 ruleset = &parent->ruleset; 304 } 305 } 306 307 int 308 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 309 const char *name) 310 { 311 char *p, *path; 312 struct pf_ruleset *ruleset; 313 314 r->anchor = NULL; 315 r->anchor_relative = 0; 316 r->anchor_wildcard = 0; 317 if (!name[0]) 318 return (0); 319 path = (char *)rs_malloc(MAXPATHLEN); 320 bzero(path, MAXPATHLEN); 321 if (name[0] == '/') 322 strlcpy(path, name + 1, MAXPATHLEN); 323 else { 324 /* relative path */ 325 r->anchor_relative = 1; 326 if (s->anchor == NULL || !s->anchor->path[0]) 327 path[0] = 0; 328 else 329 strlcpy(path, s->anchor->path, MAXPATHLEN); 330 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 331 if (!path[0]) { 332 printf("pf_anchor_setup: .. beyond root\n"); 333 rs_free(path); 334 return (1); 335 } 336 if ((p = strrchr(path, '/')) != NULL) 337 *p = 0; 338 else 339 path[0] = 0; 340 r->anchor_relative++; 341 name += 3; 342 } 343 if (path[0]) 344 strlcat(path, "/", MAXPATHLEN); 345 strlcat(path, name, MAXPATHLEN); 346 } 347 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 348 r->anchor_wildcard = 1; 349 *p = 0; 350 } 351 ruleset = pf_find_or_create_ruleset(path); 352 rs_free(path); 353 if (ruleset == NULL || ruleset->anchor == NULL) { 354 printf("pf_anchor_setup: ruleset\n"); 355 return (1); 356 } 357 r->anchor = ruleset->anchor; 358 r->anchor->refcnt++; 359 return (0); 360 } 361 362 int 363 pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, 364 struct pfioc_rule *pr) 365 { 366 pr->anchor_call[0] = 0; 367 if (r->anchor == NULL) 368 return (0); 369 if (!r->anchor_relative) { 370 strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call)); 371 strlcat(pr->anchor_call, r->anchor->path, 372 sizeof(pr->anchor_call)); 373 } else { 374 char *a, *p; 375 int i; 376 377 a = (char *)rs_malloc(MAXPATHLEN); 378 bzero(a, MAXPATHLEN); 379 if (rs->anchor == NULL) 380 a[0] = 0; 381 else 382 strlcpy(a, rs->anchor->path, MAXPATHLEN); 383 for (i = 1; i < r->anchor_relative; ++i) { 384 if ((p = strrchr(a, '/')) == NULL) 385 p = a; 386 *p = 0; 387 strlcat(pr->anchor_call, "../", 388 sizeof(pr->anchor_call)); 389 } 390 if (strncmp(a, r->anchor->path, strlen(a))) { 391 printf("pf_anchor_copyout: '%s' '%s'\n", a, 392 r->anchor->path); 393 rs_free(a); 394 return (1); 395 } 396 if (strlen(r->anchor->path) > strlen(a)) 397 strlcat(pr->anchor_call, r->anchor->path + (a[0] ? 398 strlen(a) + 1 : 0), sizeof(pr->anchor_call)); 399 rs_free(a); 400 } 401 if (r->anchor_wildcard) 402 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*", 403 sizeof(pr->anchor_call)); 404 return (0); 405 } 406 407 void 408 pf_anchor_remove(struct pf_rule *r) 409 { 410 if (r->anchor == NULL) 411 return; 412 if (r->anchor->refcnt <= 0) { 413 printf("pf_anchor_remove: broken refcount\n"); 414 r->anchor = NULL; 415 return; 416 } 417 if (!--r->anchor->refcnt) 418 pf_remove_if_empty_ruleset(&r->anchor->ruleset); 419 r->anchor = NULL; 420 } 421