xref: /dragonfly/usr.sbin/pfctl/pfctl_radix.c (revision ed5d5720) 
1 /*	$OpenBSD: pfctl_radix.c,v 1.24 2004/02/10 18:29:30 henning Exp $ */
2 /*	$DragonFly: src/usr.sbin/pfctl/pfctl_radix.c,v 1.1 2004/09/21 21:25:28 joerg Exp $ */
3 
4 /*
5  * Copyright (c) 2002 Cedric Berger
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  */
33 
34 #include <sys/types.h>
35 #include <sys/ioctl.h>
36 #include <sys/socket.h>
37 
38 #include <net/if.h>
39 #include <net/pf/pfvar.h>
40 
41 #include <errno.h>
42 #include <string.h>
43 #include <ctype.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <limits.h>
47 #include <err.h>
48 
49 #include "pfctl.h"
50 
51 #define BUF_SIZE 256
52 
53 extern int dev_fd;
54 
55 static int	 pfr_next_token(char buf[], FILE *);
56 
57 
58 int
59 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
60 {
61 	struct pfioc_table io;
62 
63 	bzero(&io, sizeof io);
64 	io.pfrio_flags = flags;
65 	if (filter != NULL)
66 		io.pfrio_table = *filter;
67 	if (ioctl(dev_fd, DIOCRCLRTABLES, &io))
68 		return (-1);
69 	if (ndel != NULL)
70 		*ndel = io.pfrio_ndel;
71 	return (0);
72 }
73 
74 int
75 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
76 {
77 	struct pfioc_table io;
78 
79 	if (size < 0 || (size && tbl == NULL)) {
80 		errno = EINVAL;
81 		return (-1);
82 	}
83 	bzero(&io, sizeof io);
84 	io.pfrio_flags = flags;
85 	io.pfrio_buffer = tbl;
86 	io.pfrio_esize = sizeof(*tbl);
87 	io.pfrio_size = size;
88 	if (ioctl(dev_fd, DIOCRADDTABLES, &io))
89 		return (-1);
90 	if (nadd != NULL)
91 		*nadd = io.pfrio_nadd;
92 	return (0);
93 }
94 
95 int
96 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
97 {
98 	struct pfioc_table io;
99 
100 	if (size < 0 || (size && tbl == NULL)) {
101 		errno = EINVAL;
102 		return (-1);
103 	}
104 	bzero(&io, sizeof io);
105 	io.pfrio_flags = flags;
106 	io.pfrio_buffer = tbl;
107 	io.pfrio_esize = sizeof(*tbl);
108 	io.pfrio_size = size;
109 	if (ioctl(dev_fd, DIOCRDELTABLES, &io))
110 		return (-1);
111 	if (ndel != NULL)
112 		*ndel = io.pfrio_ndel;
113 	return (0);
114 }
115 
116 int
117 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
118 	int flags)
119 {
120 	struct pfioc_table io;
121 
122 	if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
123 		errno = EINVAL;
124 		return (-1);
125 	}
126 	bzero(&io, sizeof io);
127 	io.pfrio_flags = flags;
128 	if (filter != NULL)
129 		io.pfrio_table = *filter;
130 	io.pfrio_buffer = tbl;
131 	io.pfrio_esize = sizeof(*tbl);
132 	io.pfrio_size = *size;
133 	if (ioctl(dev_fd, DIOCRGETTABLES, &io))
134 		return (-1);
135 	*size = io.pfrio_size;
136 	return (0);
137 }
138 
139 int
140 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
141 	int flags)
142 {
143 	struct pfioc_table io;
144 
145 	if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
146 		errno = EINVAL;
147 		return (-1);
148 	}
149 	bzero(&io, sizeof io);
150 	io.pfrio_flags = flags;
151 	if (filter != NULL)
152 		io.pfrio_table = *filter;
153 	io.pfrio_buffer = tbl;
154 	io.pfrio_esize = sizeof(*tbl);
155 	io.pfrio_size = *size;
156 	if (ioctl(dev_fd, DIOCRGETTSTATS, &io))
157 		return (-1);
158 	*size = io.pfrio_size;
159 	return (0);
160 }
161 
162 int
163 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
164 {
165 	struct pfioc_table io;
166 
167 	if (tbl == NULL) {
168 		errno = EINVAL;
169 		return (-1);
170 	}
171 	bzero(&io, sizeof io);
172 	io.pfrio_flags = flags;
173 	io.pfrio_table = *tbl;
174 	if (ioctl(dev_fd, DIOCRCLRADDRS, &io))
175 		return (-1);
176 	if (ndel != NULL)
177 		*ndel = io.pfrio_ndel;
178 	return (0);
179 }
180 
181 int
182 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
183     int *nadd, int flags)
184 {
185 	struct pfioc_table io;
186 
187 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
188 		errno = EINVAL;
189 		return (-1);
190 	}
191 	bzero(&io, sizeof io);
192 	io.pfrio_flags = flags;
193 	io.pfrio_table = *tbl;
194 	io.pfrio_buffer = addr;
195 	io.pfrio_esize = sizeof(*addr);
196 	io.pfrio_size = size;
197 	if (ioctl(dev_fd, DIOCRADDADDRS, &io))
198 		return (-1);
199 	if (nadd != NULL)
200 		*nadd = io.pfrio_nadd;
201 	return (0);
202 }
203 
204 int
205 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
206     int *ndel, int flags)
207 {
208 	struct pfioc_table io;
209 
210 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
211 		errno = EINVAL;
212 		return (-1);
213 	}
214 	bzero(&io, sizeof io);
215 	io.pfrio_flags = flags;
216 	io.pfrio_table = *tbl;
217 	io.pfrio_buffer = addr;
218 	io.pfrio_esize = sizeof(*addr);
219 	io.pfrio_size = size;
220 	if (ioctl(dev_fd, DIOCRDELADDRS, &io))
221 		return (-1);
222 	if (ndel != NULL)
223 		*ndel = io.pfrio_ndel;
224 	return (0);
225 }
226 
227 int
228 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
229     int *size2, int *nadd, int *ndel, int *nchange, int flags)
230 {
231 	struct pfioc_table io;
232 
233 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
234 		errno = EINVAL;
235 		return (-1);
236 	}
237 	bzero(&io, sizeof io);
238 	io.pfrio_flags = flags;
239 	io.pfrio_table = *tbl;
240 	io.pfrio_buffer = addr;
241 	io.pfrio_esize = sizeof(*addr);
242 	io.pfrio_size = size;
243 	io.pfrio_size2 = (size2 != NULL) ? *size2 : 0;
244 	if (ioctl(dev_fd, DIOCRSETADDRS, &io))
245 		return (-1);
246 	if (nadd != NULL)
247 		*nadd = io.pfrio_nadd;
248 	if (ndel != NULL)
249 		*ndel = io.pfrio_ndel;
250 	if (nchange != NULL)
251 		*nchange = io.pfrio_nchange;
252 	if (size2 != NULL)
253 		*size2 = io.pfrio_size2;
254 	return (0);
255 }
256 
257 int
258 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
259     int flags)
260 {
261 	struct pfioc_table io;
262 
263 	if (tbl == NULL || size == NULL || *size < 0 ||
264 	    (*size && addr == NULL)) {
265 		errno = EINVAL;
266 		return (-1);
267 	}
268 	bzero(&io, sizeof io);
269 	io.pfrio_flags = flags;
270 	io.pfrio_table = *tbl;
271 	io.pfrio_buffer = addr;
272 	io.pfrio_esize = sizeof(*addr);
273 	io.pfrio_size = *size;
274 	if (ioctl(dev_fd, DIOCRGETADDRS, &io))
275 		return (-1);
276 	*size = io.pfrio_size;
277 	return (0);
278 }
279 
280 int
281 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
282     int flags)
283 {
284 	struct pfioc_table io;
285 
286 	if (tbl == NULL || size == NULL || *size < 0 ||
287 	    (*size && addr == NULL)) {
288 		errno = EINVAL;
289 		return (-1);
290 	}
291 	bzero(&io, sizeof io);
292 	io.pfrio_flags = flags;
293 	io.pfrio_table = *tbl;
294 	io.pfrio_buffer = addr;
295 	io.pfrio_esize = sizeof(*addr);
296 	io.pfrio_size = *size;
297 	if (ioctl(dev_fd, DIOCRGETASTATS, &io))
298 		return (-1);
299 	*size = io.pfrio_size;
300 	return (0);
301 }
302 
303 int
304 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
305     int *nzero, int flags)
306 {
307 	struct pfioc_table io;
308 
309 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
310 		errno = EINVAL;
311 		return (-1);
312 	}
313 	bzero(&io, sizeof io);
314 	io.pfrio_flags = flags;
315 	io.pfrio_table = *tbl;
316 	io.pfrio_buffer = addr;
317 	io.pfrio_esize = sizeof(*addr);
318 	io.pfrio_size = size;
319 	if (ioctl(dev_fd, DIOCRCLRASTATS, &io))
320 		return (-1);
321 	if (nzero != NULL)
322 		*nzero = io.pfrio_nzero;
323 	return (0);
324 }
325 
326 int
327 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
328 {
329 	struct pfioc_table io;
330 
331 	if (size < 0 || (size && !tbl)) {
332 		errno = EINVAL;
333 		return (-1);
334 	}
335 	bzero(&io, sizeof io);
336 	io.pfrio_flags = flags;
337 	io.pfrio_buffer = tbl;
338 	io.pfrio_esize = sizeof(*tbl);
339 	io.pfrio_size = size;
340 	if (ioctl(dev_fd, DIOCRCLRTSTATS, &io))
341 		return (-1);
342 	if (nzero)
343 		*nzero = io.pfrio_nzero;
344 	return (0);
345 }
346 
347 int
348 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
349     int *nchange, int *ndel, int flags)
350 {
351 	struct pfioc_table io;
352 
353 	if (size < 0 || (size && !tbl)) {
354 		errno = EINVAL;
355 		return (-1);
356 	}
357 	bzero(&io, sizeof io);
358 	io.pfrio_flags = flags;
359 	io.pfrio_buffer = tbl;
360 	io.pfrio_esize = sizeof(*tbl);
361 	io.pfrio_size = size;
362 	io.pfrio_setflag = setflag;
363 	io.pfrio_clrflag = clrflag;
364 	if (ioctl(dev_fd, DIOCRSETTFLAGS, &io))
365 		return (-1);
366 	if (nchange)
367 		*nchange = io.pfrio_nchange;
368 	if (ndel)
369 		*ndel = io.pfrio_ndel;
370 	return (0);
371 }
372 
373 int
374 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
375     int *nmatch, int flags)
376 {
377 	struct pfioc_table io;
378 
379 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
380 		errno = EINVAL;
381 		return (-1);
382 	}
383 	bzero(&io, sizeof io);
384 	io.pfrio_flags = flags;
385 	io.pfrio_table = *tbl;
386 	io.pfrio_buffer = addr;
387 	io.pfrio_esize = sizeof(*addr);
388 	io.pfrio_size = size;
389 	if (ioctl(dev_fd, DIOCRTSTADDRS, &io))
390 		return (-1);
391 	if (nmatch)
392 		*nmatch = io.pfrio_nmatch;
393 	return (0);
394 }
395 
396 int
397 pfr_ina_begin(struct pfr_table *trs, int *ticket, int *ndel, int flags)
398 {
399 	struct pfioc_table io;
400 
401 	bzero(&io, sizeof io);
402 	if (trs != NULL)
403 		io.pfrio_table = *trs;
404 	io.pfrio_flags = flags;
405 	if (ioctl(dev_fd, DIOCRINABEGIN, &io))
406 		return (-1);
407 	if (ndel != NULL)
408 		*ndel = io.pfrio_ndel;
409 	if (ticket != NULL)
410 		*ticket = io.pfrio_ticket;
411 	return (0);
412 }
413 
414 int
415 pfr_ina_commit(struct pfr_table *trs, int ticket, int *nadd, int *nchange,
416     int flags)
417 {
418 	struct pfioc_table io;
419 
420 	bzero(&io, sizeof io);
421 	if (trs != NULL)
422 		io.pfrio_table = *trs;
423 	io.pfrio_flags = flags;
424 	io.pfrio_ticket = ticket;
425 	if (ioctl(dev_fd, DIOCRINACOMMIT, &io))
426 		return (-1);
427 	if (nadd != NULL)
428 		*nadd = io.pfrio_nadd;
429 	if (nchange != NULL)
430 		*nchange = io.pfrio_nchange;
431 	return (0);
432 }
433 
434 int
435 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
436     int *nadd, int *naddr, int ticket, int flags)
437 {
438 	struct pfioc_table io;
439 
440 	if (tbl == NULL || size < 0 || (size && addr == NULL)) {
441 		errno = EINVAL;
442 		return (-1);
443 	}
444 	bzero(&io, sizeof io);
445 	io.pfrio_flags = flags;
446 	io.pfrio_table = *tbl;
447 	io.pfrio_buffer = addr;
448 	io.pfrio_esize = sizeof(*addr);
449 	io.pfrio_size = size;
450 	io.pfrio_ticket = ticket;
451 	if (ioctl(dev_fd, DIOCRINADEFINE, &io))
452 		return (-1);
453 	if (nadd != NULL)
454 		*nadd = io.pfrio_nadd;
455 	if (naddr != NULL)
456 		*naddr = io.pfrio_naddr;
457 	return (0);
458 }
459 
460 /* interface management code */
461 
462 int
463 pfi_get_ifaces(const char *filter, struct pfi_if *buf, int *size, int flags)
464 {
465 	struct pfioc_iface io;
466 
467 	if (size == NULL || *size < 0 || (*size && buf == NULL)) {
468 		errno = EINVAL;
469 		return (-1);
470 	}
471 	bzero(&io, sizeof io);
472 	io.pfiio_flags = flags;
473 	if (filter != NULL)
474 		if (strlcpy(io.pfiio_name, filter, sizeof(io.pfiio_name)) >=
475 		    sizeof(io.pfiio_name)) {
476 			errno = EINVAL;
477 			return (-1);
478 		}
479 	io.pfiio_buffer = buf;
480 	io.pfiio_esize = sizeof(*buf);
481 	io.pfiio_size = *size;
482 	if (ioctl(dev_fd, DIOCIGETIFACES, &io))
483 		return (-1);
484 	*size = io.pfiio_size;
485 	return (0);
486 }
487 
488 /* buffer management code */
489 
490 size_t buf_esize[PFRB_MAX] = { 0,
491 	sizeof(struct pfr_table), sizeof(struct pfr_tstats),
492 	sizeof(struct pfr_addr), sizeof(struct pfr_astats),
493 	sizeof(struct pfi_if), sizeof(struct pfioc_trans_e)
494 };
495 
496 /*
497  * add one element to the buffer
498  */
499 int
500 pfr_buf_add(struct pfr_buffer *b, const void *e)
501 {
502 	size_t bs;
503 
504 	if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX ||
505 	    e == NULL) {
506 		errno = EINVAL;
507 		return (-1);
508 	}
509 	bs = buf_esize[b->pfrb_type];
510 	if (b->pfrb_size == b->pfrb_msize)
511 		if (pfr_buf_grow(b, 0))
512 			return (-1);
513 	memcpy(((caddr_t)b->pfrb_caddr) + bs * b->pfrb_size, e, bs);
514 	b->pfrb_size++;
515 	return (0);
516 }
517 
518 /*
519  * return next element of the buffer (or first one if prev is NULL)
520  * see PFRB_FOREACH macro
521  */
522 const void *
523 pfr_buf_next(struct pfr_buffer *b, const void *prev)
524 {
525 	size_t bs;
526 
527 	if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX)
528 		return (NULL);
529 	if (b->pfrb_size == 0)
530 		return (NULL);
531 	if (prev == NULL)
532 		return (b->pfrb_caddr);
533 	bs = buf_esize[b->pfrb_type];
534 	if ((((c_caddr_t)prev)-((c_caddr_t)b->pfrb_caddr)) / bs + 1 >=
535 	    (size_t)b->pfrb_size)
536 		return (NULL);
537 	return (((c_caddr_t)prev) + bs);
538 }
539 
540 /*
541  * minsize:
542  *    0: make the buffer somewhat bigger
543  *    n: make room for "n" entries in the buffer
544  */
545 int
546 pfr_buf_grow(struct pfr_buffer *b, int minsize)
547 {
548 	caddr_t p;
549 	size_t bs;
550 
551 	if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX) {
552 		errno = EINVAL;
553 		return (-1);
554 	}
555 	if (minsize != 0 && minsize <= b->pfrb_msize)
556 		return (0);
557 	bs = buf_esize[b->pfrb_type];
558 	if (!b->pfrb_msize) {
559 		if (minsize < 64)
560 			minsize = 64;
561 		b->pfrb_caddr = calloc(bs, minsize);
562 		if (b->pfrb_caddr == NULL)
563 			return (-1);
564 		b->pfrb_msize = minsize;
565 	} else {
566 		if (minsize == 0)
567 			minsize = b->pfrb_msize * 2;
568 		if (minsize < 0 || (size_t)minsize >= SIZE_T_MAX / bs) {
569 			/* msize overflow */
570 			errno = ENOMEM;
571 			return (-1);
572 		}
573 		p = realloc(b->pfrb_caddr, minsize * bs);
574 		if (p == NULL)
575 			return (-1);
576 		bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs);
577 		b->pfrb_caddr = p;
578 		b->pfrb_msize = minsize;
579 	}
580 	return (0);
581 }
582 
583 /*
584  * reset buffer and free memory.
585  */
586 void
587 pfr_buf_clear(struct pfr_buffer *b)
588 {
589 	if (b == NULL)
590 		return;
591 	if (b->pfrb_caddr != NULL)
592 		free(b->pfrb_caddr);
593 	b->pfrb_caddr = NULL;
594 	b->pfrb_size = b->pfrb_msize = 0;
595 }
596 
597 int
598 pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
599     int (*append_addr)(struct pfr_buffer *, char *, int))
600 {
601 	FILE	*fp;
602 	char	 buf[BUF_SIZE];
603 	int	 rv;
604 
605 	if (file == NULL)
606 		return (0);
607 	if (!strcmp(file, "-"))
608 		fp = stdin;
609 	else {
610 		fp = fopen(file, "r");
611 		if (fp == NULL)
612 			return (-1);
613 	}
614 	while ((rv = pfr_next_token(buf, fp)) == 1)
615 		if (append_addr(b, buf, nonetwork)) {
616 			rv = -1;
617 			break;
618 		}
619 	if (fp != stdin)
620 		fclose(fp);
621 	return (rv);
622 }
623 
624 int
625 pfr_next_token(char buf[BUF_SIZE], FILE *fp)
626 {
627 	static char	next_ch = ' ';
628 	int		i = 0;
629 
630 	for (;;) {
631 		/* skip spaces */
632 		while (isspace(next_ch) && !feof(fp))
633 			next_ch = fgetc(fp);
634 		/* remove from '#' until end of line */
635 		if (next_ch == '#')
636 			while (!feof(fp)) {
637 				next_ch = fgetc(fp);
638 				if (next_ch == '\n')
639 					break;
640 			}
641 		else
642 			break;
643 	}
644 	if (feof(fp)) {
645 		next_ch = ' ';
646 		return (0);
647 	}
648 	do {
649 		if (i < BUF_SIZE)
650 			buf[i++] = next_ch;
651 		next_ch = fgetc(fp);
652 	} while (!feof(fp) && !isspace(next_ch));
653 	if (i >= BUF_SIZE) {
654 		errno = EINVAL;
655 		return (-1);
656 	}
657 	buf[i] = '\0';
658 	return (1);
659 }
660 
661 const char *
662 pfr_strerror(int errnum)
663 {
664 	switch (errnum) {
665 	case ESRCH:
666 		return "Table does not exist";
667 	case ENOENT:
668 		return "Anchor or Ruleset does not exist";
669 	default:
670 		return strerror(errnum);
671 	}
672 }
673