1 /* $OpenBSD: pf_ruleset.c,v 1.1 2006/10/27 13:56:51 mcbride Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include <sys/param.h> 39 #include <sys/socket.h> 40 #ifdef _KERNEL 41 # include <sys/systm.h> 42 #endif /* _KERNEL */ 43 #include <sys/mbuf.h> 44 45 #include <netinet/in.h> 46 #include <netinet/in_systm.h> 47 #include <netinet/ip.h> 48 #include <netinet/tcp.h> 49 50 #include <net/if.h> 51 #include <net/pf/pfvar.h> 52 53 #ifdef INET6 54 #include <netinet/ip6.h> 55 #endif /* INET6 */ 56 57 58 #ifdef _KERNEL 59 # define DPFPRINTF(format, x...) \ 60 if (pf_status.debug >= PF_DEBUG_NOISY) \ 61 kprintf(format , ##x) 62 #define rs_malloc(x) kmalloc(x, M_TEMP, M_WAITOK) 63 #define rs_free(x) kfree(x, M_TEMP) 64 #define printf kprintf 65 #else 66 /* Userland equivalents so we can lend code to pfctl et al. */ 67 68 # include <arpa/inet.h> 69 # include <errno.h> 70 # include <stdio.h> 71 # include <stdlib.h> 72 # include <string.h> 73 # define rs_malloc(x) malloc(x) 74 # define rs_free(x) free(x) 75 76 # ifdef PFDEBUG 77 # include <sys/stdarg.h> 78 # define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) 79 # else 80 # define DPFPRINTF(format, x...) ((void)0) 81 # endif /* PFDEBUG */ 82 #endif /* _KERNEL */ 83 84 85 struct pf_anchor_global pf_anchors; 86 struct pf_anchor pf_main_anchor; 87 88 /* 89 * XXX: hum? 90 int pf_get_ruleset_number(u_int8_t); 91 void pf_init_ruleset(struct pf_ruleset *); 92 int pf_anchor_setup(struct pf_rule *, 93 const struct pf_ruleset *, const char *); 94 int pf_anchor_copyout(const struct pf_ruleset *, 95 const struct pf_rule *, struct pfioc_rule *); 96 void pf_anchor_remove(struct pf_rule *); 97 */ 98 99 static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *); 100 101 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 102 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 103 104 static __inline int 105 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) 106 { 107 int c = strcmp(a->path, b->path); 108 109 return (c ? (c < 0 ? -1 : 1) : 0); 110 } 111 112 int 113 pf_get_ruleset_number(u_int8_t action) 114 { 115 switch (action) { 116 case PF_SCRUB: 117 case PF_NOSCRUB: 118 return (PF_RULESET_SCRUB); 119 break; 120 case PF_PASS: 121 case PF_DROP: 122 return (PF_RULESET_FILTER); 123 break; 124 case PF_NAT: 125 case PF_NONAT: 126 return (PF_RULESET_NAT); 127 break; 128 case PF_BINAT: 129 case PF_NOBINAT: 130 return (PF_RULESET_BINAT); 131 break; 132 case PF_RDR: 133 case PF_NORDR: 134 return (PF_RULESET_RDR); 135 break; 136 default: 137 return (PF_RULESET_MAX); 138 break; 139 } 140 } 141 142 void 143 pf_init_ruleset(struct pf_ruleset *ruleset) 144 { 145 int i; 146 147 memset(ruleset, 0, sizeof(struct pf_ruleset)); 148 for (i = 0; i < PF_RULESET_MAX; i++) { 149 TAILQ_INIT(&ruleset->rules[i].queues[0]); 150 TAILQ_INIT(&ruleset->rules[i].queues[1]); 151 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 152 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 153 } 154 } 155 156 struct pf_anchor * 157 pf_find_anchor(const char *path) 158 { 159 struct pf_anchor *key, *found; 160 161 key = (struct pf_anchor *)rs_malloc(sizeof(*key)); 162 memset(key, 0, sizeof(*key)); 163 strlcpy(key->path, path, sizeof(key->path)); 164 found = RB_FIND(pf_anchor_global, &pf_anchors, key); 165 rs_free(key); 166 return (found); 167 } 168 169 struct pf_ruleset * 170 pf_find_ruleset(const char *path) 171 { 172 struct pf_anchor *anchor; 173 174 while (*path == '/') 175 path++; 176 if (!*path) 177 return (&pf_main_ruleset); 178 anchor = pf_find_anchor(path); 179 if (anchor == NULL) 180 return (NULL); 181 else 182 return (&anchor->ruleset); 183 } 184 185 struct pf_ruleset * 186 pf_find_or_create_ruleset(const char *path) 187 { 188 char *p, *q, *r; 189 struct pf_ruleset *ruleset; 190 struct pf_anchor *anchor = NULL, *dup, *parent = NULL; 191 192 if (path[0] == 0) 193 return (&pf_main_ruleset); 194 while (*path == '/') 195 path++; 196 ruleset = pf_find_ruleset(path); 197 if (ruleset != NULL) 198 return (ruleset); 199 p = (char *)rs_malloc(MAXPATHLEN); 200 bzero(p, MAXPATHLEN); 201 strlcpy(p, path, MAXPATHLEN); 202 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 203 *q = 0; 204 if ((ruleset = pf_find_ruleset(p)) != NULL) { 205 parent = ruleset->anchor; 206 break; 207 } 208 } 209 if (q == NULL) 210 q = p; 211 else 212 q++; 213 strlcpy(p, path, MAXPATHLEN); 214 if (!*q) { 215 rs_free(p); 216 return (NULL); 217 } 218 while ((r = strchr(q, '/')) != NULL || *q) { 219 if (r != NULL) 220 *r = 0; 221 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 222 (parent != NULL && strlen(parent->path) >= 223 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 224 rs_free(p); 225 return (NULL); 226 } 227 anchor = (struct pf_anchor *)rs_malloc(sizeof(*anchor)); 228 if (anchor == NULL) { 229 rs_free(p); 230 return (NULL); 231 } 232 memset(anchor, 0, sizeof(*anchor)); 233 RB_INIT(&anchor->children); 234 strlcpy(anchor->name, q, sizeof(anchor->name)); 235 if (parent != NULL) { 236 strlcpy(anchor->path, parent->path, 237 sizeof(anchor->path)); 238 strlcat(anchor->path, "/", sizeof(anchor->path)); 239 } 240 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 241 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != 242 NULL) { 243 printf("pf_find_or_create_ruleset: RB_INSERT1 " 244 "'%s' '%s' collides with '%s' '%s'\n", 245 anchor->path, anchor->name, dup->path, dup->name); 246 rs_free(anchor); 247 rs_free(p); 248 return (NULL); 249 } 250 if (parent != NULL) { 251 anchor->parent = parent; 252 if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 253 anchor)) != NULL) { 254 printf("pf_find_or_create_ruleset: " 255 "RB_INSERT2 '%s' '%s' collides with " 256 "'%s' '%s'\n", anchor->path, anchor->name, 257 dup->path, dup->name); 258 RB_REMOVE(pf_anchor_global, &pf_anchors, 259 anchor); 260 rs_free(anchor); 261 rs_free(p); 262 return (NULL); 263 } 264 } 265 pf_init_ruleset(&anchor->ruleset); 266 anchor->ruleset.anchor = anchor; 267 parent = anchor; 268 if (r != NULL) 269 q = r + 1; 270 else 271 *q = 0; 272 } 273 rs_free(p); 274 return (&anchor->ruleset); 275 } 276 277 void 278 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 279 { 280 struct pf_anchor *parent; 281 int i; 282 283 while (ruleset != NULL) { 284 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 285 !RB_EMPTY(&ruleset->anchor->children) || 286 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 287 ruleset->topen) 288 return; 289 for (i = 0; i < PF_RULESET_MAX; ++i) 290 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 291 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 292 ruleset->rules[i].inactive.open) 293 return; 294 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); 295 if ((parent = ruleset->anchor->parent) != NULL) 296 RB_REMOVE(pf_anchor_node, &parent->children, 297 ruleset->anchor); 298 rs_free(ruleset->anchor); 299 if (parent == NULL) 300 return; 301 ruleset = &parent->ruleset; 302 } 303 } 304 305 int 306 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 307 const char *name) 308 { 309 char *p, *path; 310 struct pf_ruleset *ruleset; 311 312 r->anchor = NULL; 313 r->anchor_relative = 0; 314 r->anchor_wildcard = 0; 315 if (!name[0]) 316 return (0); 317 path = (char *)rs_malloc(MAXPATHLEN); 318 bzero(path, MAXPATHLEN); 319 if (name[0] == '/') 320 strlcpy(path, name + 1, MAXPATHLEN); 321 else { 322 /* relative path */ 323 r->anchor_relative = 1; 324 if (s->anchor == NULL || !s->anchor->path[0]) 325 path[0] = 0; 326 else 327 strlcpy(path, s->anchor->path, MAXPATHLEN); 328 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 329 if (!path[0]) { 330 printf("pf_anchor_setup: .. beyond root\n"); 331 rs_free(path); 332 return (1); 333 } 334 if ((p = strrchr(path, '/')) != NULL) 335 *p = 0; 336 else 337 path[0] = 0; 338 r->anchor_relative++; 339 name += 3; 340 } 341 if (path[0]) 342 strlcat(path, "/", MAXPATHLEN); 343 strlcat(path, name, MAXPATHLEN); 344 } 345 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 346 r->anchor_wildcard = 1; 347 *p = 0; 348 } 349 ruleset = pf_find_or_create_ruleset(path); 350 rs_free(path); 351 if (ruleset == NULL || ruleset->anchor == NULL) { 352 printf("pf_anchor_setup: ruleset\n"); 353 return (1); 354 } 355 r->anchor = ruleset->anchor; 356 r->anchor->refcnt++; 357 return (0); 358 } 359 360 int 361 pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, 362 struct pfioc_rule *pr) 363 { 364 pr->anchor_call[0] = 0; 365 if (r->anchor == NULL) 366 return (0); 367 if (!r->anchor_relative) { 368 strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call)); 369 strlcat(pr->anchor_call, r->anchor->path, 370 sizeof(pr->anchor_call)); 371 } else { 372 char *a, *p; 373 int i; 374 375 a = (char *)rs_malloc(MAXPATHLEN); 376 bzero(a, MAXPATHLEN); 377 if (rs->anchor == NULL) 378 a[0] = 0; 379 else 380 strlcpy(a, rs->anchor->path, MAXPATHLEN); 381 for (i = 1; i < r->anchor_relative; ++i) { 382 if ((p = strrchr(a, '/')) == NULL) 383 p = a; 384 *p = 0; 385 strlcat(pr->anchor_call, "../", 386 sizeof(pr->anchor_call)); 387 } 388 if (strncmp(a, r->anchor->path, strlen(a))) { 389 printf("pf_anchor_copyout: '%s' '%s'\n", a, 390 r->anchor->path); 391 rs_free(a); 392 return (1); 393 } 394 if (strlen(r->anchor->path) > strlen(a)) 395 strlcat(pr->anchor_call, r->anchor->path + (a[0] ? 396 strlen(a) + 1 : 0), sizeof(pr->anchor_call)); 397 rs_free(a); 398 } 399 if (r->anchor_wildcard) 400 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*", 401 sizeof(pr->anchor_call)); 402 return (0); 403 } 404 405 void 406 pf_anchor_remove(struct pf_rule *r) 407 { 408 if (r->anchor == NULL) 409 return; 410 if (r->anchor->refcnt <= 0) { 411 printf("pf_anchor_remove: broken refcount\n"); 412 r->anchor = NULL; 413 return; 414 } 415 if (!--r->anchor->refcnt) 416 pf_remove_if_empty_ruleset(&r->anchor->ruleset); 417 r->anchor = NULL; 418 } 419