1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2002 Cedric Berger 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * - Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * - Redistributions in binary form must reproduce the above 14 * copyright notice, this list of conditions and the following 15 * disclaimer in the documentation and/or other materials provided 16 * with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 21 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 22 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 24 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 25 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 26 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 28 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 * 31 * $OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $ 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include "opt_inet.h" 38 #include "opt_inet6.h" 39 40 #include <sys/param.h> 41 #include <sys/kernel.h> 42 #include <sys/lock.h> 43 #include <sys/malloc.h> 44 #include <sys/mbuf.h> 45 #include <sys/mutex.h> 46 #include <sys/refcount.h> 47 #include <sys/socket.h> 48 #include <vm/uma.h> 49 50 #include <net/if.h> 51 #include <net/vnet.h> 52 #include <net/pfvar.h> 53 54 #define ACCEPT_FLAGS(flags, oklist) \ 55 do { \ 56 if ((flags & ~(oklist)) & \ 57 PFR_FLAG_ALLMASK) \ 58 return (EINVAL); \ 59 } while (0) 60 61 #define FILLIN_SIN(sin, addr) \ 62 do { \ 63 (sin).sin_len = sizeof(sin); \ 64 (sin).sin_family = AF_INET; \ 65 (sin).sin_addr = (addr); \ 66 } while (0) 67 68 #define FILLIN_SIN6(sin6, addr) \ 69 do { \ 70 (sin6).sin6_len = sizeof(sin6); \ 71 (sin6).sin6_family = AF_INET6; \ 72 (sin6).sin6_addr = (addr); \ 73 } while (0) 74 75 #define SWAP(type, a1, a2) \ 76 do { \ 77 type tmp = a1; \ 78 a1 = a2; \ 79 a2 = tmp; \ 80 } while (0) 81 82 #define SUNION2PF(su, af) (((af)==AF_INET) ? \ 83 (struct pf_addr *)&(su)->sin.sin_addr : \ 84 (struct pf_addr *)&(su)->sin6.sin6_addr) 85 86 #define AF_BITS(af) (((af)==AF_INET)?32:128) 87 #define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af)) 88 #define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af)) 89 #define KENTRY_RNF_ROOT(ke) \ 90 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0) 91 92 #define NO_ADDRESSES (-1) 93 #define ENQUEUE_UNMARKED_ONLY (1) 94 #define INVERT_NEG_FLAG (1) 95 96 struct pfr_walktree { 97 enum pfrw_op { 98 PFRW_MARK, 99 PFRW_SWEEP, 100 PFRW_ENQUEUE, 101 PFRW_GET_ADDRS, 102 PFRW_GET_ASTATS, 103 PFRW_POOL_GET, 104 PFRW_DYNADDR_UPDATE 105 } pfrw_op; 106 union { 107 struct pfr_addr *pfrw1_addr; 108 struct pfr_astats *pfrw1_astats; 109 struct pfr_kentryworkq *pfrw1_workq; 110 struct pfr_kentry *pfrw1_kentry; 111 struct pfi_dynaddr *pfrw1_dyn; 112 } pfrw_1; 113 int pfrw_free; 114 }; 115 #define pfrw_addr pfrw_1.pfrw1_addr 116 #define pfrw_astats pfrw_1.pfrw1_astats 117 #define pfrw_workq pfrw_1.pfrw1_workq 118 #define pfrw_kentry pfrw_1.pfrw1_kentry 119 #define pfrw_dyn pfrw_1.pfrw1_dyn 120 #define pfrw_cnt pfrw_free 121 122 #define senderr(e) do { rv = (e); goto _bad; } while (0) 123 124 static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures"); 125 VNET_DEFINE_STATIC(uma_zone_t, pfr_kentry_z); 126 #define V_pfr_kentry_z VNET(pfr_kentry_z) 127 VNET_DEFINE_STATIC(uma_zone_t, pfr_kcounters_z); 128 #define V_pfr_kcounters_z VNET(pfr_kcounters_z) 129 130 static struct pf_addr pfr_ffaddr = { 131 .addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff } 132 }; 133 134 static void pfr_copyout_addr(struct pfr_addr *, 135 struct pfr_kentry *ke); 136 static int pfr_validate_addr(struct pfr_addr *); 137 static void pfr_enqueue_addrs(struct pfr_ktable *, 138 struct pfr_kentryworkq *, int *, int); 139 static void pfr_mark_addrs(struct pfr_ktable *); 140 static struct pfr_kentry 141 *pfr_lookup_addr(struct pfr_ktable *, 142 struct pfr_addr *, int); 143 static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *); 144 static void pfr_destroy_kentries(struct pfr_kentryworkq *); 145 static void pfr_destroy_kentry(struct pfr_kentry *); 146 static void pfr_insert_kentries(struct pfr_ktable *, 147 struct pfr_kentryworkq *, long); 148 static void pfr_remove_kentries(struct pfr_ktable *, 149 struct pfr_kentryworkq *); 150 static void pfr_clstats_kentries(struct pfr_kentryworkq *, long, 151 int); 152 static void pfr_reset_feedback(struct pfr_addr *, int); 153 static void pfr_prepare_network(union sockaddr_union *, int, int); 154 static int pfr_route_kentry(struct pfr_ktable *, 155 struct pfr_kentry *); 156 static int pfr_unroute_kentry(struct pfr_ktable *, 157 struct pfr_kentry *); 158 static int pfr_walktree(struct radix_node *, void *); 159 static int pfr_validate_table(struct pfr_table *, int, int); 160 static int pfr_fix_anchor(char *); 161 static void pfr_commit_ktable(struct pfr_ktable *, long); 162 static void pfr_insert_ktables(struct pfr_ktableworkq *); 163 static void pfr_insert_ktable(struct pfr_ktable *); 164 static void pfr_setflags_ktables(struct pfr_ktableworkq *); 165 static void pfr_setflags_ktable(struct pfr_ktable *, int); 166 static void pfr_clstats_ktables(struct pfr_ktableworkq *, long, 167 int); 168 static void pfr_clstats_ktable(struct pfr_ktable *, long, int); 169 static struct pfr_ktable 170 *pfr_create_ktable(struct pfr_table *, long, int); 171 static void pfr_destroy_ktables(struct pfr_ktableworkq *, int); 172 static void pfr_destroy_ktable(struct pfr_ktable *, int); 173 static int pfr_ktable_compare(struct pfr_ktable *, 174 struct pfr_ktable *); 175 static struct pfr_ktable 176 *pfr_lookup_table(struct pfr_table *); 177 static void pfr_clean_node_mask(struct pfr_ktable *, 178 struct pfr_kentryworkq *); 179 static int pfr_skip_table(struct pfr_table *, 180 struct pfr_ktable *, int); 181 static struct pfr_kentry 182 *pfr_kentry_byidx(struct pfr_ktable *, int, int); 183 184 static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 185 static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare); 186 187 VNET_DEFINE_STATIC(struct pfr_ktablehead, pfr_ktables); 188 #define V_pfr_ktables VNET(pfr_ktables) 189 190 VNET_DEFINE_STATIC(struct pfr_table, pfr_nulltable); 191 #define V_pfr_nulltable VNET(pfr_nulltable) 192 193 VNET_DEFINE_STATIC(int, pfr_ktable_cnt); 194 #define V_pfr_ktable_cnt VNET(pfr_ktable_cnt) 195 196 void 197 pfr_initialize(void) 198 { 199 200 V_pfr_kentry_z = uma_zcreate("pf table entries", 201 sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 202 0); 203 V_pfr_kcounters_z = uma_zcreate("pf table counters", 204 sizeof(struct pfr_kcounters), NULL, NULL, NULL, NULL, 205 UMA_ALIGN_PTR, 0); 206 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z; 207 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT; 208 } 209 210 void 211 pfr_cleanup(void) 212 { 213 214 uma_zdestroy(V_pfr_kentry_z); 215 uma_zdestroy(V_pfr_kcounters_z); 216 } 217 218 int 219 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags) 220 { 221 struct pfr_ktable *kt; 222 struct pfr_kentryworkq workq; 223 224 PF_RULES_WASSERT(); 225 226 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 227 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 228 return (EINVAL); 229 kt = pfr_lookup_table(tbl); 230 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 231 return (ESRCH); 232 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 233 return (EPERM); 234 pfr_enqueue_addrs(kt, &workq, ndel, 0); 235 236 if (!(flags & PFR_FLAG_DUMMY)) { 237 pfr_remove_kentries(kt, &workq); 238 KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__)); 239 } 240 return (0); 241 } 242 243 int 244 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 245 int *nadd, int flags) 246 { 247 struct pfr_ktable *kt, *tmpkt; 248 struct pfr_kentryworkq workq; 249 struct pfr_kentry *p, *q; 250 struct pfr_addr *ad; 251 int i, rv, xadd = 0; 252 long tzero = time_second; 253 254 PF_RULES_WASSERT(); 255 256 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 257 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 258 return (EINVAL); 259 kt = pfr_lookup_table(tbl); 260 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 261 return (ESRCH); 262 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 263 return (EPERM); 264 tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0); 265 if (tmpkt == NULL) 266 return (ENOMEM); 267 SLIST_INIT(&workq); 268 for (i = 0, ad = addr; i < size; i++, ad++) { 269 if (pfr_validate_addr(ad)) 270 senderr(EINVAL); 271 p = pfr_lookup_addr(kt, ad, 1); 272 q = pfr_lookup_addr(tmpkt, ad, 1); 273 if (flags & PFR_FLAG_FEEDBACK) { 274 if (q != NULL) 275 ad->pfra_fback = PFR_FB_DUPLICATE; 276 else if (p == NULL) 277 ad->pfra_fback = PFR_FB_ADDED; 278 else if (p->pfrke_not != ad->pfra_not) 279 ad->pfra_fback = PFR_FB_CONFLICT; 280 else 281 ad->pfra_fback = PFR_FB_NONE; 282 } 283 if (p == NULL && q == NULL) { 284 p = pfr_create_kentry(ad); 285 if (p == NULL) 286 senderr(ENOMEM); 287 if (pfr_route_kentry(tmpkt, p)) { 288 pfr_destroy_kentry(p); 289 ad->pfra_fback = PFR_FB_NONE; 290 } else { 291 SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 292 xadd++; 293 } 294 } 295 } 296 pfr_clean_node_mask(tmpkt, &workq); 297 if (!(flags & PFR_FLAG_DUMMY)) 298 pfr_insert_kentries(kt, &workq, tzero); 299 else 300 pfr_destroy_kentries(&workq); 301 if (nadd != NULL) 302 *nadd = xadd; 303 pfr_destroy_ktable(tmpkt, 0); 304 return (0); 305 _bad: 306 pfr_clean_node_mask(tmpkt, &workq); 307 pfr_destroy_kentries(&workq); 308 if (flags & PFR_FLAG_FEEDBACK) 309 pfr_reset_feedback(addr, size); 310 pfr_destroy_ktable(tmpkt, 0); 311 return (rv); 312 } 313 314 int 315 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 316 int *ndel, int flags) 317 { 318 struct pfr_ktable *kt; 319 struct pfr_kentryworkq workq; 320 struct pfr_kentry *p; 321 struct pfr_addr *ad; 322 int i, rv, xdel = 0, log = 1; 323 324 PF_RULES_WASSERT(); 325 326 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 327 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL)) 328 return (EINVAL); 329 kt = pfr_lookup_table(tbl); 330 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 331 return (ESRCH); 332 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 333 return (EPERM); 334 /* 335 * there are two algorithms to choose from here. 336 * with: 337 * n: number of addresses to delete 338 * N: number of addresses in the table 339 * 340 * one is O(N) and is better for large 'n' 341 * one is O(n*LOG(N)) and is better for small 'n' 342 * 343 * following code try to decide which one is best. 344 */ 345 for (i = kt->pfrkt_cnt; i > 0; i >>= 1) 346 log++; 347 if (size > kt->pfrkt_cnt/log) { 348 /* full table scan */ 349 pfr_mark_addrs(kt); 350 } else { 351 /* iterate over addresses to delete */ 352 for (i = 0, ad = addr; i < size; i++, ad++) { 353 if (pfr_validate_addr(ad)) 354 return (EINVAL); 355 p = pfr_lookup_addr(kt, ad, 1); 356 if (p != NULL) 357 p->pfrke_mark = 0; 358 } 359 } 360 SLIST_INIT(&workq); 361 for (i = 0, ad = addr; i < size; i++, ad++) { 362 if (pfr_validate_addr(ad)) 363 senderr(EINVAL); 364 p = pfr_lookup_addr(kt, ad, 1); 365 if (flags & PFR_FLAG_FEEDBACK) { 366 if (p == NULL) 367 ad->pfra_fback = PFR_FB_NONE; 368 else if (p->pfrke_not != ad->pfra_not) 369 ad->pfra_fback = PFR_FB_CONFLICT; 370 else if (p->pfrke_mark) 371 ad->pfra_fback = PFR_FB_DUPLICATE; 372 else 373 ad->pfra_fback = PFR_FB_DELETED; 374 } 375 if (p != NULL && p->pfrke_not == ad->pfra_not && 376 !p->pfrke_mark) { 377 p->pfrke_mark = 1; 378 SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 379 xdel++; 380 } 381 } 382 if (!(flags & PFR_FLAG_DUMMY)) 383 pfr_remove_kentries(kt, &workq); 384 if (ndel != NULL) 385 *ndel = xdel; 386 return (0); 387 _bad: 388 if (flags & PFR_FLAG_FEEDBACK) 389 pfr_reset_feedback(addr, size); 390 return (rv); 391 } 392 393 int 394 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 395 int *size2, int *nadd, int *ndel, int *nchange, int flags, 396 u_int32_t ignore_pfrt_flags) 397 { 398 struct pfr_ktable *kt, *tmpkt; 399 struct pfr_kentryworkq addq, delq, changeq; 400 struct pfr_kentry *p, *q; 401 struct pfr_addr ad; 402 int i, rv, xadd = 0, xdel = 0, xchange = 0; 403 long tzero = time_second; 404 405 PF_RULES_WASSERT(); 406 407 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 408 if (pfr_validate_table(tbl, ignore_pfrt_flags, flags & 409 PFR_FLAG_USERIOCTL)) 410 return (EINVAL); 411 kt = pfr_lookup_table(tbl); 412 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 413 return (ESRCH); 414 if (kt->pfrkt_flags & PFR_TFLAG_CONST) 415 return (EPERM); 416 tmpkt = pfr_create_ktable(&V_pfr_nulltable, 0, 0); 417 if (tmpkt == NULL) 418 return (ENOMEM); 419 pfr_mark_addrs(kt); 420 SLIST_INIT(&addq); 421 SLIST_INIT(&delq); 422 SLIST_INIT(&changeq); 423 for (i = 0; i < size; i++) { 424 /* 425 * XXXGL: undertand pf_if usage of this function 426 * and make ad a moving pointer 427 */ 428 bcopy(addr + i, &ad, sizeof(ad)); 429 if (pfr_validate_addr(&ad)) 430 senderr(EINVAL); 431 ad.pfra_fback = PFR_FB_NONE; 432 p = pfr_lookup_addr(kt, &ad, 1); 433 if (p != NULL) { 434 if (p->pfrke_mark) { 435 ad.pfra_fback = PFR_FB_DUPLICATE; 436 goto _skip; 437 } 438 p->pfrke_mark = 1; 439 if (p->pfrke_not != ad.pfra_not) { 440 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq); 441 ad.pfra_fback = PFR_FB_CHANGED; 442 xchange++; 443 } 444 } else { 445 q = pfr_lookup_addr(tmpkt, &ad, 1); 446 if (q != NULL) { 447 ad.pfra_fback = PFR_FB_DUPLICATE; 448 goto _skip; 449 } 450 p = pfr_create_kentry(&ad); 451 if (p == NULL) 452 senderr(ENOMEM); 453 if (pfr_route_kentry(tmpkt, p)) { 454 pfr_destroy_kentry(p); 455 ad.pfra_fback = PFR_FB_NONE; 456 } else { 457 SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 458 ad.pfra_fback = PFR_FB_ADDED; 459 xadd++; 460 } 461 } 462 _skip: 463 if (flags & PFR_FLAG_FEEDBACK) 464 bcopy(&ad, addr + i, sizeof(ad)); 465 } 466 pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY); 467 if ((flags & PFR_FLAG_FEEDBACK) && *size2) { 468 if (*size2 < size+xdel) { 469 *size2 = size+xdel; 470 senderr(0); 471 } 472 i = 0; 473 SLIST_FOREACH(p, &delq, pfrke_workq) { 474 pfr_copyout_addr(&ad, p); 475 ad.pfra_fback = PFR_FB_DELETED; 476 bcopy(&ad, addr + size + i, sizeof(ad)); 477 i++; 478 } 479 } 480 pfr_clean_node_mask(tmpkt, &addq); 481 if (!(flags & PFR_FLAG_DUMMY)) { 482 pfr_insert_kentries(kt, &addq, tzero); 483 pfr_remove_kentries(kt, &delq); 484 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG); 485 } else 486 pfr_destroy_kentries(&addq); 487 if (nadd != NULL) 488 *nadd = xadd; 489 if (ndel != NULL) 490 *ndel = xdel; 491 if (nchange != NULL) 492 *nchange = xchange; 493 if ((flags & PFR_FLAG_FEEDBACK) && size2) 494 *size2 = size+xdel; 495 pfr_destroy_ktable(tmpkt, 0); 496 return (0); 497 _bad: 498 pfr_clean_node_mask(tmpkt, &addq); 499 pfr_destroy_kentries(&addq); 500 if (flags & PFR_FLAG_FEEDBACK) 501 pfr_reset_feedback(addr, size); 502 pfr_destroy_ktable(tmpkt, 0); 503 return (rv); 504 } 505 506 int 507 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size, 508 int *nmatch, int flags) 509 { 510 struct pfr_ktable *kt; 511 struct pfr_kentry *p; 512 struct pfr_addr *ad; 513 int i, xmatch = 0; 514 515 PF_RULES_RASSERT(); 516 517 ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE); 518 if (pfr_validate_table(tbl, 0, 0)) 519 return (EINVAL); 520 kt = pfr_lookup_table(tbl); 521 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 522 return (ESRCH); 523 524 for (i = 0, ad = addr; i < size; i++, ad++) { 525 if (pfr_validate_addr(ad)) 526 return (EINVAL); 527 if (ADDR_NETWORK(ad)) 528 return (EINVAL); 529 p = pfr_lookup_addr(kt, ad, 0); 530 if (flags & PFR_FLAG_REPLACE) 531 pfr_copyout_addr(ad, p); 532 ad->pfra_fback = (p == NULL) ? PFR_FB_NONE : 533 (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH); 534 if (p != NULL && !p->pfrke_not) 535 xmatch++; 536 } 537 if (nmatch != NULL) 538 *nmatch = xmatch; 539 return (0); 540 } 541 542 int 543 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size, 544 int flags) 545 { 546 struct pfr_ktable *kt; 547 struct pfr_walktree w; 548 int rv; 549 550 PF_RULES_RASSERT(); 551 552 ACCEPT_FLAGS(flags, 0); 553 if (pfr_validate_table(tbl, 0, 0)) 554 return (EINVAL); 555 kt = pfr_lookup_table(tbl); 556 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 557 return (ESRCH); 558 if (kt->pfrkt_cnt > *size) { 559 *size = kt->pfrkt_cnt; 560 return (0); 561 } 562 563 bzero(&w, sizeof(w)); 564 w.pfrw_op = PFRW_GET_ADDRS; 565 w.pfrw_addr = addr; 566 w.pfrw_free = kt->pfrkt_cnt; 567 rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 568 if (!rv) 569 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, 570 pfr_walktree, &w); 571 if (rv) 572 return (rv); 573 574 KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__, 575 w.pfrw_free)); 576 577 *size = kt->pfrkt_cnt; 578 return (0); 579 } 580 581 int 582 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size, 583 int flags) 584 { 585 struct pfr_ktable *kt; 586 struct pfr_walktree w; 587 struct pfr_kentryworkq workq; 588 int rv; 589 long tzero = time_second; 590 591 PF_RULES_RASSERT(); 592 593 /* XXX PFR_FLAG_CLSTATS disabled */ 594 ACCEPT_FLAGS(flags, 0); 595 if (pfr_validate_table(tbl, 0, 0)) 596 return (EINVAL); 597 kt = pfr_lookup_table(tbl); 598 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 599 return (ESRCH); 600 if (kt->pfrkt_cnt > *size) { 601 *size = kt->pfrkt_cnt; 602 return (0); 603 } 604 605 bzero(&w, sizeof(w)); 606 w.pfrw_op = PFRW_GET_ASTATS; 607 w.pfrw_astats = addr; 608 w.pfrw_free = kt->pfrkt_cnt; 609 rv = kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 610 if (!rv) 611 rv = kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, 612 pfr_walktree, &w); 613 if (!rv && (flags & PFR_FLAG_CLSTATS)) { 614 pfr_enqueue_addrs(kt, &workq, NULL, 0); 615 pfr_clstats_kentries(&workq, tzero, 0); 616 } 617 if (rv) 618 return (rv); 619 620 if (w.pfrw_free) { 621 printf("pfr_get_astats: corruption detected (%d).\n", 622 w.pfrw_free); 623 return (ENOTTY); 624 } 625 *size = kt->pfrkt_cnt; 626 return (0); 627 } 628 629 int 630 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size, 631 int *nzero, int flags) 632 { 633 struct pfr_ktable *kt; 634 struct pfr_kentryworkq workq; 635 struct pfr_kentry *p; 636 struct pfr_addr *ad; 637 int i, rv, xzero = 0; 638 639 PF_RULES_WASSERT(); 640 641 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK); 642 if (pfr_validate_table(tbl, 0, 0)) 643 return (EINVAL); 644 kt = pfr_lookup_table(tbl); 645 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 646 return (ESRCH); 647 SLIST_INIT(&workq); 648 for (i = 0, ad = addr; i < size; i++, ad++) { 649 if (pfr_validate_addr(ad)) 650 senderr(EINVAL); 651 p = pfr_lookup_addr(kt, ad, 1); 652 if (flags & PFR_FLAG_FEEDBACK) { 653 ad->pfra_fback = (p != NULL) ? 654 PFR_FB_CLEARED : PFR_FB_NONE; 655 } 656 if (p != NULL) { 657 SLIST_INSERT_HEAD(&workq, p, pfrke_workq); 658 xzero++; 659 } 660 } 661 662 if (!(flags & PFR_FLAG_DUMMY)) 663 pfr_clstats_kentries(&workq, 0, 0); 664 if (nzero != NULL) 665 *nzero = xzero; 666 return (0); 667 _bad: 668 if (flags & PFR_FLAG_FEEDBACK) 669 pfr_reset_feedback(addr, size); 670 return (rv); 671 } 672 673 static int 674 pfr_validate_addr(struct pfr_addr *ad) 675 { 676 int i; 677 678 switch (ad->pfra_af) { 679 #ifdef INET 680 case AF_INET: 681 if (ad->pfra_net > 32) 682 return (-1); 683 break; 684 #endif /* INET */ 685 #ifdef INET6 686 case AF_INET6: 687 if (ad->pfra_net > 128) 688 return (-1); 689 break; 690 #endif /* INET6 */ 691 default: 692 return (-1); 693 } 694 if (ad->pfra_net < 128 && 695 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8)))) 696 return (-1); 697 for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++) 698 if (((caddr_t)ad)[i]) 699 return (-1); 700 if (ad->pfra_not && ad->pfra_not != 1) 701 return (-1); 702 if (ad->pfra_fback) 703 return (-1); 704 return (0); 705 } 706 707 static void 708 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq, 709 int *naddr, int sweep) 710 { 711 struct pfr_walktree w; 712 713 SLIST_INIT(workq); 714 bzero(&w, sizeof(w)); 715 w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE; 716 w.pfrw_workq = workq; 717 if (kt->pfrkt_ip4 != NULL) 718 if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, 719 pfr_walktree, &w)) 720 printf("pfr_enqueue_addrs: IPv4 walktree failed.\n"); 721 if (kt->pfrkt_ip6 != NULL) 722 if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, 723 pfr_walktree, &w)) 724 printf("pfr_enqueue_addrs: IPv6 walktree failed.\n"); 725 if (naddr != NULL) 726 *naddr = w.pfrw_cnt; 727 } 728 729 static void 730 pfr_mark_addrs(struct pfr_ktable *kt) 731 { 732 struct pfr_walktree w; 733 734 bzero(&w, sizeof(w)); 735 w.pfrw_op = PFRW_MARK; 736 if (kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w)) 737 printf("pfr_mark_addrs: IPv4 walktree failed.\n"); 738 if (kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w)) 739 printf("pfr_mark_addrs: IPv6 walktree failed.\n"); 740 } 741 742 743 static struct pfr_kentry * 744 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact) 745 { 746 union sockaddr_union sa, mask; 747 struct radix_head *head = NULL; 748 struct pfr_kentry *ke; 749 750 PF_RULES_ASSERT(); 751 752 bzero(&sa, sizeof(sa)); 753 if (ad->pfra_af == AF_INET) { 754 FILLIN_SIN(sa.sin, ad->pfra_ip4addr); 755 head = &kt->pfrkt_ip4->rh; 756 } else if ( ad->pfra_af == AF_INET6 ) { 757 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr); 758 head = &kt->pfrkt_ip6->rh; 759 } 760 if (ADDR_NETWORK(ad)) { 761 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net); 762 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head); 763 if (ke && KENTRY_RNF_ROOT(ke)) 764 ke = NULL; 765 } else { 766 ke = (struct pfr_kentry *)rn_match(&sa, head); 767 if (ke && KENTRY_RNF_ROOT(ke)) 768 ke = NULL; 769 if (exact && ke && KENTRY_NETWORK(ke)) 770 ke = NULL; 771 } 772 return (ke); 773 } 774 775 static struct pfr_kentry * 776 pfr_create_kentry(struct pfr_addr *ad) 777 { 778 struct pfr_kentry *ke; 779 780 ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO); 781 if (ke == NULL) 782 return (NULL); 783 784 if (ad->pfra_af == AF_INET) 785 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr); 786 else if (ad->pfra_af == AF_INET6) 787 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr); 788 ke->pfrke_af = ad->pfra_af; 789 ke->pfrke_net = ad->pfra_net; 790 ke->pfrke_not = ad->pfra_not; 791 return (ke); 792 } 793 794 static void 795 pfr_destroy_kentries(struct pfr_kentryworkq *workq) 796 { 797 struct pfr_kentry *p, *q; 798 799 for (p = SLIST_FIRST(workq); p != NULL; p = q) { 800 q = SLIST_NEXT(p, pfrke_workq); 801 pfr_destroy_kentry(p); 802 } 803 } 804 805 static void 806 pfr_destroy_kentry(struct pfr_kentry *ke) 807 { 808 if (ke->pfrke_counters) 809 uma_zfree(V_pfr_kcounters_z, ke->pfrke_counters); 810 uma_zfree(V_pfr_kentry_z, ke); 811 } 812 813 static void 814 pfr_insert_kentries(struct pfr_ktable *kt, 815 struct pfr_kentryworkq *workq, long tzero) 816 { 817 struct pfr_kentry *p; 818 int rv, n = 0; 819 820 SLIST_FOREACH(p, workq, pfrke_workq) { 821 rv = pfr_route_kentry(kt, p); 822 if (rv) { 823 printf("pfr_insert_kentries: cannot route entry " 824 "(code=%d).\n", rv); 825 break; 826 } 827 p->pfrke_tzero = tzero; 828 n++; 829 } 830 kt->pfrkt_cnt += n; 831 } 832 833 int 834 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero) 835 { 836 struct pfr_kentry *p; 837 int rv; 838 839 p = pfr_lookup_addr(kt, ad, 1); 840 if (p != NULL) 841 return (0); 842 p = pfr_create_kentry(ad); 843 if (p == NULL) 844 return (ENOMEM); 845 846 rv = pfr_route_kentry(kt, p); 847 if (rv) 848 return (rv); 849 850 p->pfrke_tzero = tzero; 851 kt->pfrkt_cnt++; 852 853 return (0); 854 } 855 856 static void 857 pfr_remove_kentries(struct pfr_ktable *kt, 858 struct pfr_kentryworkq *workq) 859 { 860 struct pfr_kentry *p; 861 int n = 0; 862 863 SLIST_FOREACH(p, workq, pfrke_workq) { 864 pfr_unroute_kentry(kt, p); 865 n++; 866 } 867 kt->pfrkt_cnt -= n; 868 pfr_destroy_kentries(workq); 869 } 870 871 static void 872 pfr_clean_node_mask(struct pfr_ktable *kt, 873 struct pfr_kentryworkq *workq) 874 { 875 struct pfr_kentry *p; 876 877 SLIST_FOREACH(p, workq, pfrke_workq) 878 pfr_unroute_kentry(kt, p); 879 } 880 881 static void 882 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange) 883 { 884 struct pfr_kentry *p; 885 886 SLIST_FOREACH(p, workq, pfrke_workq) { 887 if (negchange) 888 p->pfrke_not = !p->pfrke_not; 889 if (p->pfrke_counters) { 890 uma_zfree(V_pfr_kcounters_z, p->pfrke_counters); 891 p->pfrke_counters = NULL; 892 } 893 p->pfrke_tzero = tzero; 894 } 895 } 896 897 static void 898 pfr_reset_feedback(struct pfr_addr *addr, int size) 899 { 900 struct pfr_addr *ad; 901 int i; 902 903 for (i = 0, ad = addr; i < size; i++, ad++) 904 ad->pfra_fback = PFR_FB_NONE; 905 } 906 907 static void 908 pfr_prepare_network(union sockaddr_union *sa, int af, int net) 909 { 910 int i; 911 912 bzero(sa, sizeof(*sa)); 913 if (af == AF_INET) { 914 sa->sin.sin_len = sizeof(sa->sin); 915 sa->sin.sin_family = AF_INET; 916 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0; 917 } else if (af == AF_INET6) { 918 sa->sin6.sin6_len = sizeof(sa->sin6); 919 sa->sin6.sin6_family = AF_INET6; 920 for (i = 0; i < 4; i++) { 921 if (net <= 32) { 922 sa->sin6.sin6_addr.s6_addr32[i] = 923 net ? htonl(-1 << (32-net)) : 0; 924 break; 925 } 926 sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF; 927 net -= 32; 928 } 929 } 930 } 931 932 static int 933 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 934 { 935 union sockaddr_union mask; 936 struct radix_node *rn; 937 struct radix_head *head = NULL; 938 939 PF_RULES_WASSERT(); 940 941 bzero(ke->pfrke_node, sizeof(ke->pfrke_node)); 942 if (ke->pfrke_af == AF_INET) 943 head = &kt->pfrkt_ip4->rh; 944 else if (ke->pfrke_af == AF_INET6) 945 head = &kt->pfrkt_ip6->rh; 946 947 if (KENTRY_NETWORK(ke)) { 948 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 949 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node); 950 } else 951 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node); 952 953 return (rn == NULL ? -1 : 0); 954 } 955 956 static int 957 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke) 958 { 959 union sockaddr_union mask; 960 struct radix_node *rn; 961 struct radix_head *head = NULL; 962 963 if (ke->pfrke_af == AF_INET) 964 head = &kt->pfrkt_ip4->rh; 965 else if (ke->pfrke_af == AF_INET6) 966 head = &kt->pfrkt_ip6->rh; 967 968 if (KENTRY_NETWORK(ke)) { 969 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net); 970 rn = rn_delete(&ke->pfrke_sa, &mask, head); 971 } else 972 rn = rn_delete(&ke->pfrke_sa, NULL, head); 973 974 if (rn == NULL) { 975 printf("pfr_unroute_kentry: delete failed.\n"); 976 return (-1); 977 } 978 return (0); 979 } 980 981 static void 982 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke) 983 { 984 bzero(ad, sizeof(*ad)); 985 if (ke == NULL) 986 return; 987 ad->pfra_af = ke->pfrke_af; 988 ad->pfra_net = ke->pfrke_net; 989 ad->pfra_not = ke->pfrke_not; 990 if (ad->pfra_af == AF_INET) 991 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr; 992 else if (ad->pfra_af == AF_INET6) 993 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr; 994 } 995 996 static int 997 pfr_walktree(struct radix_node *rn, void *arg) 998 { 999 struct pfr_kentry *ke = (struct pfr_kentry *)rn; 1000 struct pfr_walktree *w = arg; 1001 1002 switch (w->pfrw_op) { 1003 case PFRW_MARK: 1004 ke->pfrke_mark = 0; 1005 break; 1006 case PFRW_SWEEP: 1007 if (ke->pfrke_mark) 1008 break; 1009 /* FALLTHROUGH */ 1010 case PFRW_ENQUEUE: 1011 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq); 1012 w->pfrw_cnt++; 1013 break; 1014 case PFRW_GET_ADDRS: 1015 if (w->pfrw_free-- > 0) { 1016 pfr_copyout_addr(w->pfrw_addr, ke); 1017 w->pfrw_addr++; 1018 } 1019 break; 1020 case PFRW_GET_ASTATS: 1021 if (w->pfrw_free-- > 0) { 1022 struct pfr_astats as; 1023 1024 pfr_copyout_addr(&as.pfras_a, ke); 1025 1026 if (ke->pfrke_counters) { 1027 bcopy(ke->pfrke_counters->pfrkc_packets, 1028 as.pfras_packets, sizeof(as.pfras_packets)); 1029 bcopy(ke->pfrke_counters->pfrkc_bytes, 1030 as.pfras_bytes, sizeof(as.pfras_bytes)); 1031 } else { 1032 bzero(as.pfras_packets, sizeof(as.pfras_packets)); 1033 bzero(as.pfras_bytes, sizeof(as.pfras_bytes)); 1034 as.pfras_a.pfra_fback = PFR_FB_NOCOUNT; 1035 } 1036 as.pfras_tzero = ke->pfrke_tzero; 1037 1038 bcopy(&as, w->pfrw_astats, sizeof(as)); 1039 w->pfrw_astats++; 1040 } 1041 break; 1042 case PFRW_POOL_GET: 1043 if (ke->pfrke_not) 1044 break; /* negative entries are ignored */ 1045 if (!w->pfrw_cnt--) { 1046 w->pfrw_kentry = ke; 1047 return (1); /* finish search */ 1048 } 1049 break; 1050 case PFRW_DYNADDR_UPDATE: 1051 { 1052 union sockaddr_union pfr_mask; 1053 1054 if (ke->pfrke_af == AF_INET) { 1055 if (w->pfrw_dyn->pfid_acnt4++ > 0) 1056 break; 1057 pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net); 1058 w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa, 1059 AF_INET); 1060 w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask, 1061 AF_INET); 1062 } else if (ke->pfrke_af == AF_INET6){ 1063 if (w->pfrw_dyn->pfid_acnt6++ > 0) 1064 break; 1065 pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net); 1066 w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa, 1067 AF_INET6); 1068 w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask, 1069 AF_INET6); 1070 } 1071 break; 1072 } 1073 } 1074 return (0); 1075 } 1076 1077 int 1078 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags) 1079 { 1080 struct pfr_ktableworkq workq; 1081 struct pfr_ktable *p; 1082 int xdel = 0; 1083 1084 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS); 1085 if (pfr_fix_anchor(filter->pfrt_anchor)) 1086 return (EINVAL); 1087 if (pfr_table_count(filter, flags) < 0) 1088 return (ENOENT); 1089 1090 SLIST_INIT(&workq); 1091 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1092 if (pfr_skip_table(filter, p, flags)) 1093 continue; 1094 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR)) 1095 continue; 1096 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1097 continue; 1098 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1099 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1100 xdel++; 1101 } 1102 if (!(flags & PFR_FLAG_DUMMY)) 1103 pfr_setflags_ktables(&workq); 1104 if (ndel != NULL) 1105 *ndel = xdel; 1106 return (0); 1107 } 1108 1109 int 1110 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags) 1111 { 1112 struct pfr_ktableworkq addq, changeq; 1113 struct pfr_ktable *p, *q, *r, key; 1114 int i, rv, xadd = 0; 1115 long tzero = time_second; 1116 1117 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1118 SLIST_INIT(&addq); 1119 SLIST_INIT(&changeq); 1120 for (i = 0; i < size; i++) { 1121 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1122 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK, 1123 flags & PFR_FLAG_USERIOCTL)) 1124 senderr(EINVAL); 1125 key.pfrkt_flags |= PFR_TFLAG_ACTIVE; 1126 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1127 if (p == NULL) { 1128 p = pfr_create_ktable(&key.pfrkt_t, tzero, 1); 1129 if (p == NULL) 1130 senderr(ENOMEM); 1131 SLIST_FOREACH(q, &addq, pfrkt_workq) { 1132 if (!pfr_ktable_compare(p, q)) { 1133 pfr_destroy_ktable(p, 0); 1134 goto _skip; 1135 } 1136 } 1137 SLIST_INSERT_HEAD(&addq, p, pfrkt_workq); 1138 xadd++; 1139 if (!key.pfrkt_anchor[0]) 1140 goto _skip; 1141 1142 /* find or create root table */ 1143 bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor)); 1144 r = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1145 if (r != NULL) { 1146 p->pfrkt_root = r; 1147 goto _skip; 1148 } 1149 SLIST_FOREACH(q, &addq, pfrkt_workq) { 1150 if (!pfr_ktable_compare(&key, q)) { 1151 p->pfrkt_root = q; 1152 goto _skip; 1153 } 1154 } 1155 key.pfrkt_flags = 0; 1156 r = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1157 if (r == NULL) 1158 senderr(ENOMEM); 1159 SLIST_INSERT_HEAD(&addq, r, pfrkt_workq); 1160 p->pfrkt_root = r; 1161 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1162 SLIST_FOREACH(q, &changeq, pfrkt_workq) 1163 if (!pfr_ktable_compare(&key, q)) 1164 goto _skip; 1165 p->pfrkt_nflags = (p->pfrkt_flags & 1166 ~PFR_TFLAG_USRMASK) | key.pfrkt_flags; 1167 SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq); 1168 xadd++; 1169 } 1170 _skip: 1171 ; 1172 } 1173 if (!(flags & PFR_FLAG_DUMMY)) { 1174 pfr_insert_ktables(&addq); 1175 pfr_setflags_ktables(&changeq); 1176 } else 1177 pfr_destroy_ktables(&addq, 0); 1178 if (nadd != NULL) 1179 *nadd = xadd; 1180 return (0); 1181 _bad: 1182 pfr_destroy_ktables(&addq, 0); 1183 return (rv); 1184 } 1185 1186 int 1187 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags) 1188 { 1189 struct pfr_ktableworkq workq; 1190 struct pfr_ktable *p, *q, key; 1191 int i, xdel = 0; 1192 1193 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1194 SLIST_INIT(&workq); 1195 for (i = 0; i < size; i++) { 1196 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1197 if (pfr_validate_table(&key.pfrkt_t, 0, 1198 flags & PFR_FLAG_USERIOCTL)) 1199 return (EINVAL); 1200 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1201 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1202 SLIST_FOREACH(q, &workq, pfrkt_workq) 1203 if (!pfr_ktable_compare(p, q)) 1204 goto _skip; 1205 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE; 1206 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1207 xdel++; 1208 } 1209 _skip: 1210 ; 1211 } 1212 1213 if (!(flags & PFR_FLAG_DUMMY)) 1214 pfr_setflags_ktables(&workq); 1215 if (ndel != NULL) 1216 *ndel = xdel; 1217 return (0); 1218 } 1219 1220 int 1221 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size, 1222 int flags) 1223 { 1224 struct pfr_ktable *p; 1225 int n, nn; 1226 1227 PF_RULES_RASSERT(); 1228 1229 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS); 1230 if (pfr_fix_anchor(filter->pfrt_anchor)) 1231 return (EINVAL); 1232 n = nn = pfr_table_count(filter, flags); 1233 if (n < 0) 1234 return (ENOENT); 1235 if (n > *size) { 1236 *size = n; 1237 return (0); 1238 } 1239 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1240 if (pfr_skip_table(filter, p, flags)) 1241 continue; 1242 if (n-- <= 0) 1243 continue; 1244 bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl)); 1245 } 1246 1247 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n)); 1248 1249 *size = nn; 1250 return (0); 1251 } 1252 1253 int 1254 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size, 1255 int flags) 1256 { 1257 struct pfr_ktable *p; 1258 struct pfr_ktableworkq workq; 1259 int n, nn; 1260 long tzero = time_second; 1261 1262 /* XXX PFR_FLAG_CLSTATS disabled */ 1263 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS); 1264 if (pfr_fix_anchor(filter->pfrt_anchor)) 1265 return (EINVAL); 1266 n = nn = pfr_table_count(filter, flags); 1267 if (n < 0) 1268 return (ENOENT); 1269 if (n > *size) { 1270 *size = n; 1271 return (0); 1272 } 1273 SLIST_INIT(&workq); 1274 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1275 if (pfr_skip_table(filter, p, flags)) 1276 continue; 1277 if (n-- <= 0) 1278 continue; 1279 bcopy(&p->pfrkt_ts, tbl++, sizeof(*tbl)); 1280 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1281 } 1282 if (flags & PFR_FLAG_CLSTATS) 1283 pfr_clstats_ktables(&workq, tzero, 1284 flags & PFR_FLAG_ADDRSTOO); 1285 1286 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n)); 1287 1288 *size = nn; 1289 return (0); 1290 } 1291 1292 int 1293 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags) 1294 { 1295 struct pfr_ktableworkq workq; 1296 struct pfr_ktable *p, key; 1297 int i, xzero = 0; 1298 long tzero = time_second; 1299 1300 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO); 1301 SLIST_INIT(&workq); 1302 for (i = 0; i < size; i++) { 1303 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1304 if (pfr_validate_table(&key.pfrkt_t, 0, 0)) 1305 return (EINVAL); 1306 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1307 if (p != NULL) { 1308 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1309 xzero++; 1310 } 1311 } 1312 if (!(flags & PFR_FLAG_DUMMY)) 1313 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO); 1314 if (nzero != NULL) 1315 *nzero = xzero; 1316 return (0); 1317 } 1318 1319 int 1320 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag, 1321 int *nchange, int *ndel, int flags) 1322 { 1323 struct pfr_ktableworkq workq; 1324 struct pfr_ktable *p, *q, key; 1325 int i, xchange = 0, xdel = 0; 1326 1327 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1328 if ((setflag & ~PFR_TFLAG_USRMASK) || 1329 (clrflag & ~PFR_TFLAG_USRMASK) || 1330 (setflag & clrflag)) 1331 return (EINVAL); 1332 SLIST_INIT(&workq); 1333 for (i = 0; i < size; i++) { 1334 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t)); 1335 if (pfr_validate_table(&key.pfrkt_t, 0, 1336 flags & PFR_FLAG_USERIOCTL)) 1337 return (EINVAL); 1338 p = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1339 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) { 1340 p->pfrkt_nflags = (p->pfrkt_flags | setflag) & 1341 ~clrflag; 1342 if (p->pfrkt_nflags == p->pfrkt_flags) 1343 goto _skip; 1344 SLIST_FOREACH(q, &workq, pfrkt_workq) 1345 if (!pfr_ktable_compare(p, q)) 1346 goto _skip; 1347 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1348 if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) && 1349 (clrflag & PFR_TFLAG_PERSIST) && 1350 !(p->pfrkt_flags & PFR_TFLAG_REFERENCED)) 1351 xdel++; 1352 else 1353 xchange++; 1354 } 1355 _skip: 1356 ; 1357 } 1358 if (!(flags & PFR_FLAG_DUMMY)) 1359 pfr_setflags_ktables(&workq); 1360 if (nchange != NULL) 1361 *nchange = xchange; 1362 if (ndel != NULL) 1363 *ndel = xdel; 1364 return (0); 1365 } 1366 1367 int 1368 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags) 1369 { 1370 struct pfr_ktableworkq workq; 1371 struct pfr_ktable *p; 1372 struct pf_ruleset *rs; 1373 int xdel = 0; 1374 1375 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1376 rs = pf_find_or_create_ruleset(trs->pfrt_anchor); 1377 if (rs == NULL) 1378 return (ENOMEM); 1379 SLIST_INIT(&workq); 1380 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1381 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1382 pfr_skip_table(trs, p, 0)) 1383 continue; 1384 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1385 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1386 xdel++; 1387 } 1388 if (!(flags & PFR_FLAG_DUMMY)) { 1389 pfr_setflags_ktables(&workq); 1390 if (ticket != NULL) 1391 *ticket = ++rs->tticket; 1392 rs->topen = 1; 1393 } else 1394 pf_remove_if_empty_ruleset(rs); 1395 if (ndel != NULL) 1396 *ndel = xdel; 1397 return (0); 1398 } 1399 1400 int 1401 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size, 1402 int *nadd, int *naddr, u_int32_t ticket, int flags) 1403 { 1404 struct pfr_ktableworkq tableq; 1405 struct pfr_kentryworkq addrq; 1406 struct pfr_ktable *kt, *rt, *shadow, key; 1407 struct pfr_kentry *p; 1408 struct pfr_addr *ad; 1409 struct pf_ruleset *rs; 1410 int i, rv, xadd = 0, xaddr = 0; 1411 1412 PF_RULES_WASSERT(); 1413 1414 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO); 1415 if (size && !(flags & PFR_FLAG_ADDRSTOO)) 1416 return (EINVAL); 1417 if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK, 1418 flags & PFR_FLAG_USERIOCTL)) 1419 return (EINVAL); 1420 rs = pf_find_ruleset(tbl->pfrt_anchor); 1421 if (rs == NULL || !rs->topen || ticket != rs->tticket) 1422 return (EBUSY); 1423 tbl->pfrt_flags |= PFR_TFLAG_INACTIVE; 1424 SLIST_INIT(&tableq); 1425 kt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, (struct pfr_ktable *)tbl); 1426 if (kt == NULL) { 1427 kt = pfr_create_ktable(tbl, 0, 1); 1428 if (kt == NULL) 1429 return (ENOMEM); 1430 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq); 1431 xadd++; 1432 if (!tbl->pfrt_anchor[0]) 1433 goto _skip; 1434 1435 /* find or create root table */ 1436 bzero(&key, sizeof(key)); 1437 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name)); 1438 rt = RB_FIND(pfr_ktablehead, &V_pfr_ktables, &key); 1439 if (rt != NULL) { 1440 kt->pfrkt_root = rt; 1441 goto _skip; 1442 } 1443 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1); 1444 if (rt == NULL) { 1445 pfr_destroy_ktables(&tableq, 0); 1446 return (ENOMEM); 1447 } 1448 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq); 1449 kt->pfrkt_root = rt; 1450 } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE)) 1451 xadd++; 1452 _skip: 1453 shadow = pfr_create_ktable(tbl, 0, 0); 1454 if (shadow == NULL) { 1455 pfr_destroy_ktables(&tableq, 0); 1456 return (ENOMEM); 1457 } 1458 SLIST_INIT(&addrq); 1459 for (i = 0, ad = addr; i < size; i++, ad++) { 1460 if (pfr_validate_addr(ad)) 1461 senderr(EINVAL); 1462 if (pfr_lookup_addr(shadow, ad, 1) != NULL) 1463 continue; 1464 p = pfr_create_kentry(ad); 1465 if (p == NULL) 1466 senderr(ENOMEM); 1467 if (pfr_route_kentry(shadow, p)) { 1468 pfr_destroy_kentry(p); 1469 continue; 1470 } 1471 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq); 1472 xaddr++; 1473 } 1474 if (!(flags & PFR_FLAG_DUMMY)) { 1475 if (kt->pfrkt_shadow != NULL) 1476 pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1477 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE; 1478 pfr_insert_ktables(&tableq); 1479 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ? 1480 xaddr : NO_ADDRESSES; 1481 kt->pfrkt_shadow = shadow; 1482 } else { 1483 pfr_clean_node_mask(shadow, &addrq); 1484 pfr_destroy_ktable(shadow, 0); 1485 pfr_destroy_ktables(&tableq, 0); 1486 pfr_destroy_kentries(&addrq); 1487 } 1488 if (nadd != NULL) 1489 *nadd = xadd; 1490 if (naddr != NULL) 1491 *naddr = xaddr; 1492 return (0); 1493 _bad: 1494 pfr_destroy_ktable(shadow, 0); 1495 pfr_destroy_ktables(&tableq, 0); 1496 pfr_destroy_kentries(&addrq); 1497 return (rv); 1498 } 1499 1500 int 1501 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags) 1502 { 1503 struct pfr_ktableworkq workq; 1504 struct pfr_ktable *p; 1505 struct pf_ruleset *rs; 1506 int xdel = 0; 1507 1508 PF_RULES_WASSERT(); 1509 1510 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1511 rs = pf_find_ruleset(trs->pfrt_anchor); 1512 if (rs == NULL || !rs->topen || ticket != rs->tticket) 1513 return (0); 1514 SLIST_INIT(&workq); 1515 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1516 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1517 pfr_skip_table(trs, p, 0)) 1518 continue; 1519 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE; 1520 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1521 xdel++; 1522 } 1523 if (!(flags & PFR_FLAG_DUMMY)) { 1524 pfr_setflags_ktables(&workq); 1525 rs->topen = 0; 1526 pf_remove_if_empty_ruleset(rs); 1527 } 1528 if (ndel != NULL) 1529 *ndel = xdel; 1530 return (0); 1531 } 1532 1533 int 1534 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd, 1535 int *nchange, int flags) 1536 { 1537 struct pfr_ktable *p, *q; 1538 struct pfr_ktableworkq workq; 1539 struct pf_ruleset *rs; 1540 int xadd = 0, xchange = 0; 1541 long tzero = time_second; 1542 1543 PF_RULES_WASSERT(); 1544 1545 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY); 1546 rs = pf_find_ruleset(trs->pfrt_anchor); 1547 if (rs == NULL || !rs->topen || ticket != rs->tticket) 1548 return (EBUSY); 1549 1550 SLIST_INIT(&workq); 1551 RB_FOREACH(p, pfr_ktablehead, &V_pfr_ktables) { 1552 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) || 1553 pfr_skip_table(trs, p, 0)) 1554 continue; 1555 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq); 1556 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE) 1557 xchange++; 1558 else 1559 xadd++; 1560 } 1561 1562 if (!(flags & PFR_FLAG_DUMMY)) { 1563 for (p = SLIST_FIRST(&workq); p != NULL; p = q) { 1564 q = SLIST_NEXT(p, pfrkt_workq); 1565 pfr_commit_ktable(p, tzero); 1566 } 1567 rs->topen = 0; 1568 pf_remove_if_empty_ruleset(rs); 1569 } 1570 if (nadd != NULL) 1571 *nadd = xadd; 1572 if (nchange != NULL) 1573 *nchange = xchange; 1574 1575 return (0); 1576 } 1577 1578 static void 1579 pfr_commit_ktable(struct pfr_ktable *kt, long tzero) 1580 { 1581 struct pfr_ktable *shadow = kt->pfrkt_shadow; 1582 int nflags; 1583 1584 PF_RULES_WASSERT(); 1585 1586 if (shadow->pfrkt_cnt == NO_ADDRESSES) { 1587 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1588 pfr_clstats_ktable(kt, tzero, 1); 1589 } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) { 1590 /* kt might contain addresses */ 1591 struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq; 1592 struct pfr_kentry *p, *q, *next; 1593 struct pfr_addr ad; 1594 1595 pfr_enqueue_addrs(shadow, &addrq, NULL, 0); 1596 pfr_mark_addrs(kt); 1597 SLIST_INIT(&addq); 1598 SLIST_INIT(&changeq); 1599 SLIST_INIT(&delq); 1600 SLIST_INIT(&garbageq); 1601 pfr_clean_node_mask(shadow, &addrq); 1602 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) { 1603 next = SLIST_NEXT(p, pfrke_workq); /* XXX */ 1604 pfr_copyout_addr(&ad, p); 1605 q = pfr_lookup_addr(kt, &ad, 1); 1606 if (q != NULL) { 1607 if (q->pfrke_not != p->pfrke_not) 1608 SLIST_INSERT_HEAD(&changeq, q, 1609 pfrke_workq); 1610 q->pfrke_mark = 1; 1611 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq); 1612 } else { 1613 p->pfrke_tzero = tzero; 1614 SLIST_INSERT_HEAD(&addq, p, pfrke_workq); 1615 } 1616 } 1617 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY); 1618 pfr_insert_kentries(kt, &addq, tzero); 1619 pfr_remove_kentries(kt, &delq); 1620 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG); 1621 pfr_destroy_kentries(&garbageq); 1622 } else { 1623 /* kt cannot contain addresses */ 1624 SWAP(struct radix_node_head *, kt->pfrkt_ip4, 1625 shadow->pfrkt_ip4); 1626 SWAP(struct radix_node_head *, kt->pfrkt_ip6, 1627 shadow->pfrkt_ip6); 1628 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt); 1629 pfr_clstats_ktable(kt, tzero, 1); 1630 } 1631 nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) | 1632 (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE) 1633 & ~PFR_TFLAG_INACTIVE; 1634 pfr_destroy_ktable(shadow, 0); 1635 kt->pfrkt_shadow = NULL; 1636 pfr_setflags_ktable(kt, nflags); 1637 } 1638 1639 static int 1640 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved) 1641 { 1642 int i; 1643 1644 if (!tbl->pfrt_name[0]) 1645 return (-1); 1646 if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR)) 1647 return (-1); 1648 if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1]) 1649 return (-1); 1650 for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++) 1651 if (tbl->pfrt_name[i]) 1652 return (-1); 1653 if (pfr_fix_anchor(tbl->pfrt_anchor)) 1654 return (-1); 1655 if (tbl->pfrt_flags & ~allowedflags) 1656 return (-1); 1657 return (0); 1658 } 1659 1660 /* 1661 * Rewrite anchors referenced by tables to remove slashes 1662 * and check for validity. 1663 */ 1664 static int 1665 pfr_fix_anchor(char *anchor) 1666 { 1667 size_t siz = MAXPATHLEN; 1668 int i; 1669 1670 if (anchor[0] == '/') { 1671 char *path; 1672 int off; 1673 1674 path = anchor; 1675 off = 1; 1676 while (*++path == '/') 1677 off++; 1678 bcopy(path, anchor, siz - off); 1679 memset(anchor + siz - off, 0, off); 1680 } 1681 if (anchor[siz - 1]) 1682 return (-1); 1683 for (i = strlen(anchor); i < siz; i++) 1684 if (anchor[i]) 1685 return (-1); 1686 return (0); 1687 } 1688 1689 int 1690 pfr_table_count(struct pfr_table *filter, int flags) 1691 { 1692 struct pf_ruleset *rs; 1693 1694 PF_RULES_ASSERT(); 1695 1696 if (flags & PFR_FLAG_ALLRSETS) 1697 return (V_pfr_ktable_cnt); 1698 if (filter->pfrt_anchor[0]) { 1699 rs = pf_find_ruleset(filter->pfrt_anchor); 1700 return ((rs != NULL) ? rs->tables : -1); 1701 } 1702 return (pf_main_ruleset.tables); 1703 } 1704 1705 static int 1706 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags) 1707 { 1708 if (flags & PFR_FLAG_ALLRSETS) 1709 return (0); 1710 if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor)) 1711 return (1); 1712 return (0); 1713 } 1714 1715 static void 1716 pfr_insert_ktables(struct pfr_ktableworkq *workq) 1717 { 1718 struct pfr_ktable *p; 1719 1720 SLIST_FOREACH(p, workq, pfrkt_workq) 1721 pfr_insert_ktable(p); 1722 } 1723 1724 static void 1725 pfr_insert_ktable(struct pfr_ktable *kt) 1726 { 1727 1728 PF_RULES_WASSERT(); 1729 1730 RB_INSERT(pfr_ktablehead, &V_pfr_ktables, kt); 1731 V_pfr_ktable_cnt++; 1732 if (kt->pfrkt_root != NULL) 1733 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++) 1734 pfr_setflags_ktable(kt->pfrkt_root, 1735 kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR); 1736 } 1737 1738 static void 1739 pfr_setflags_ktables(struct pfr_ktableworkq *workq) 1740 { 1741 struct pfr_ktable *p, *q; 1742 1743 for (p = SLIST_FIRST(workq); p; p = q) { 1744 q = SLIST_NEXT(p, pfrkt_workq); 1745 pfr_setflags_ktable(p, p->pfrkt_nflags); 1746 } 1747 } 1748 1749 static void 1750 pfr_setflags_ktable(struct pfr_ktable *kt, int newf) 1751 { 1752 struct pfr_kentryworkq addrq; 1753 1754 PF_RULES_WASSERT(); 1755 1756 if (!(newf & PFR_TFLAG_REFERENCED) && 1757 !(newf & PFR_TFLAG_REFDANCHOR) && 1758 !(newf & PFR_TFLAG_PERSIST)) 1759 newf &= ~PFR_TFLAG_ACTIVE; 1760 if (!(newf & PFR_TFLAG_ACTIVE)) 1761 newf &= ~PFR_TFLAG_USRMASK; 1762 if (!(newf & PFR_TFLAG_SETMASK)) { 1763 RB_REMOVE(pfr_ktablehead, &V_pfr_ktables, kt); 1764 if (kt->pfrkt_root != NULL) 1765 if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]) 1766 pfr_setflags_ktable(kt->pfrkt_root, 1767 kt->pfrkt_root->pfrkt_flags & 1768 ~PFR_TFLAG_REFDANCHOR); 1769 pfr_destroy_ktable(kt, 1); 1770 V_pfr_ktable_cnt--; 1771 return; 1772 } 1773 if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) { 1774 pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1775 pfr_remove_kentries(kt, &addrq); 1776 } 1777 if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) { 1778 pfr_destroy_ktable(kt->pfrkt_shadow, 1); 1779 kt->pfrkt_shadow = NULL; 1780 } 1781 kt->pfrkt_flags = newf; 1782 } 1783 1784 static void 1785 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse) 1786 { 1787 struct pfr_ktable *p; 1788 1789 SLIST_FOREACH(p, workq, pfrkt_workq) 1790 pfr_clstats_ktable(p, tzero, recurse); 1791 } 1792 1793 static void 1794 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse) 1795 { 1796 struct pfr_kentryworkq addrq; 1797 1798 if (recurse) { 1799 pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1800 pfr_clstats_kentries(&addrq, tzero, 0); 1801 } 1802 bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets)); 1803 bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes)); 1804 kt->pfrkt_match = kt->pfrkt_nomatch = 0; 1805 kt->pfrkt_tzero = tzero; 1806 } 1807 1808 static struct pfr_ktable * 1809 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset) 1810 { 1811 struct pfr_ktable *kt; 1812 struct pf_ruleset *rs; 1813 1814 PF_RULES_WASSERT(); 1815 1816 kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO); 1817 if (kt == NULL) 1818 return (NULL); 1819 kt->pfrkt_t = *tbl; 1820 1821 if (attachruleset) { 1822 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor); 1823 if (!rs) { 1824 pfr_destroy_ktable(kt, 0); 1825 return (NULL); 1826 } 1827 kt->pfrkt_rs = rs; 1828 rs->tables++; 1829 } 1830 1831 if (!rn_inithead((void **)&kt->pfrkt_ip4, 1832 offsetof(struct sockaddr_in, sin_addr) * 8) || 1833 !rn_inithead((void **)&kt->pfrkt_ip6, 1834 offsetof(struct sockaddr_in6, sin6_addr) * 8)) { 1835 pfr_destroy_ktable(kt, 0); 1836 return (NULL); 1837 } 1838 kt->pfrkt_tzero = tzero; 1839 1840 return (kt); 1841 } 1842 1843 static void 1844 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr) 1845 { 1846 struct pfr_ktable *p, *q; 1847 1848 for (p = SLIST_FIRST(workq); p; p = q) { 1849 q = SLIST_NEXT(p, pfrkt_workq); 1850 pfr_destroy_ktable(p, flushaddr); 1851 } 1852 } 1853 1854 static void 1855 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr) 1856 { 1857 struct pfr_kentryworkq addrq; 1858 1859 if (flushaddr) { 1860 pfr_enqueue_addrs(kt, &addrq, NULL, 0); 1861 pfr_clean_node_mask(kt, &addrq); 1862 pfr_destroy_kentries(&addrq); 1863 } 1864 if (kt->pfrkt_ip4 != NULL) 1865 rn_detachhead((void **)&kt->pfrkt_ip4); 1866 if (kt->pfrkt_ip6 != NULL) 1867 rn_detachhead((void **)&kt->pfrkt_ip6); 1868 if (kt->pfrkt_shadow != NULL) 1869 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr); 1870 if (kt->pfrkt_rs != NULL) { 1871 kt->pfrkt_rs->tables--; 1872 pf_remove_if_empty_ruleset(kt->pfrkt_rs); 1873 } 1874 free(kt, M_PFTABLE); 1875 } 1876 1877 static int 1878 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q) 1879 { 1880 int d; 1881 1882 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE))) 1883 return (d); 1884 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor)); 1885 } 1886 1887 static struct pfr_ktable * 1888 pfr_lookup_table(struct pfr_table *tbl) 1889 { 1890 /* struct pfr_ktable start like a struct pfr_table */ 1891 return (RB_FIND(pfr_ktablehead, &V_pfr_ktables, 1892 (struct pfr_ktable *)tbl)); 1893 } 1894 1895 int 1896 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af) 1897 { 1898 struct pfr_kentry *ke = NULL; 1899 int match; 1900 1901 PF_RULES_RASSERT(); 1902 1903 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1904 kt = kt->pfrkt_root; 1905 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1906 return (0); 1907 1908 switch (af) { 1909 #ifdef INET 1910 case AF_INET: 1911 { 1912 struct sockaddr_in sin; 1913 1914 bzero(&sin, sizeof(sin)); 1915 sin.sin_len = sizeof(sin); 1916 sin.sin_family = AF_INET; 1917 sin.sin_addr.s_addr = a->addr32[0]; 1918 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh); 1919 if (ke && KENTRY_RNF_ROOT(ke)) 1920 ke = NULL; 1921 break; 1922 } 1923 #endif /* INET */ 1924 #ifdef INET6 1925 case AF_INET6: 1926 { 1927 struct sockaddr_in6 sin6; 1928 1929 bzero(&sin6, sizeof(sin6)); 1930 sin6.sin6_len = sizeof(sin6); 1931 sin6.sin6_family = AF_INET6; 1932 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr)); 1933 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh); 1934 if (ke && KENTRY_RNF_ROOT(ke)) 1935 ke = NULL; 1936 break; 1937 } 1938 #endif /* INET6 */ 1939 } 1940 match = (ke && !ke->pfrke_not); 1941 if (match) 1942 kt->pfrkt_match++; 1943 else 1944 kt->pfrkt_nomatch++; 1945 return (match); 1946 } 1947 1948 void 1949 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af, 1950 u_int64_t len, int dir_out, int op_pass, int notrule) 1951 { 1952 struct pfr_kentry *ke = NULL; 1953 1954 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 1955 kt = kt->pfrkt_root; 1956 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 1957 return; 1958 1959 switch (af) { 1960 #ifdef INET 1961 case AF_INET: 1962 { 1963 struct sockaddr_in sin; 1964 1965 bzero(&sin, sizeof(sin)); 1966 sin.sin_len = sizeof(sin); 1967 sin.sin_family = AF_INET; 1968 sin.sin_addr.s_addr = a->addr32[0]; 1969 ke = (struct pfr_kentry *)rn_match(&sin, &kt->pfrkt_ip4->rh); 1970 if (ke && KENTRY_RNF_ROOT(ke)) 1971 ke = NULL; 1972 break; 1973 } 1974 #endif /* INET */ 1975 #ifdef INET6 1976 case AF_INET6: 1977 { 1978 struct sockaddr_in6 sin6; 1979 1980 bzero(&sin6, sizeof(sin6)); 1981 sin6.sin6_len = sizeof(sin6); 1982 sin6.sin6_family = AF_INET6; 1983 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr)); 1984 ke = (struct pfr_kentry *)rn_match(&sin6, &kt->pfrkt_ip6->rh); 1985 if (ke && KENTRY_RNF_ROOT(ke)) 1986 ke = NULL; 1987 break; 1988 } 1989 #endif /* INET6 */ 1990 default: 1991 panic("%s: unknown address family %u", __func__, af); 1992 } 1993 if ((ke == NULL || ke->pfrke_not) != notrule) { 1994 if (op_pass != PFR_OP_PASS) 1995 printf("pfr_update_stats: assertion failed.\n"); 1996 op_pass = PFR_OP_XPASS; 1997 } 1998 kt->pfrkt_packets[dir_out][op_pass]++; 1999 kt->pfrkt_bytes[dir_out][op_pass] += len; 2000 if (ke != NULL && op_pass != PFR_OP_XPASS && 2001 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) { 2002 if (ke->pfrke_counters == NULL) 2003 ke->pfrke_counters = uma_zalloc(V_pfr_kcounters_z, 2004 M_NOWAIT | M_ZERO); 2005 if (ke->pfrke_counters != NULL) { 2006 ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++; 2007 ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len; 2008 } 2009 } 2010 } 2011 2012 struct pfr_ktable * 2013 pfr_attach_table(struct pf_ruleset *rs, char *name) 2014 { 2015 struct pfr_ktable *kt, *rt; 2016 struct pfr_table tbl; 2017 struct pf_anchor *ac = rs->anchor; 2018 2019 PF_RULES_WASSERT(); 2020 2021 bzero(&tbl, sizeof(tbl)); 2022 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name)); 2023 if (ac != NULL) 2024 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor)); 2025 kt = pfr_lookup_table(&tbl); 2026 if (kt == NULL) { 2027 kt = pfr_create_ktable(&tbl, time_second, 1); 2028 if (kt == NULL) 2029 return (NULL); 2030 if (ac != NULL) { 2031 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor)); 2032 rt = pfr_lookup_table(&tbl); 2033 if (rt == NULL) { 2034 rt = pfr_create_ktable(&tbl, 0, 1); 2035 if (rt == NULL) { 2036 pfr_destroy_ktable(kt, 0); 2037 return (NULL); 2038 } 2039 pfr_insert_ktable(rt); 2040 } 2041 kt->pfrkt_root = rt; 2042 } 2043 pfr_insert_ktable(kt); 2044 } 2045 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++) 2046 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED); 2047 return (kt); 2048 } 2049 2050 void 2051 pfr_detach_table(struct pfr_ktable *kt) 2052 { 2053 2054 PF_RULES_WASSERT(); 2055 KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n", 2056 __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE])); 2057 2058 if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE]) 2059 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED); 2060 } 2061 2062 int 2063 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter, 2064 sa_family_t af) 2065 { 2066 struct pf_addr *addr, *cur, *mask; 2067 union sockaddr_union uaddr, umask; 2068 struct pfr_kentry *ke, *ke2 = NULL; 2069 int idx = -1, use_counter = 0; 2070 2071 switch (af) { 2072 case AF_INET: 2073 uaddr.sin.sin_len = sizeof(struct sockaddr_in); 2074 uaddr.sin.sin_family = AF_INET; 2075 break; 2076 case AF_INET6: 2077 uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6); 2078 uaddr.sin6.sin6_family = AF_INET6; 2079 break; 2080 } 2081 addr = SUNION2PF(&uaddr, af); 2082 2083 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL) 2084 kt = kt->pfrkt_root; 2085 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE)) 2086 return (-1); 2087 2088 if (pidx != NULL) 2089 idx = *pidx; 2090 if (counter != NULL && idx >= 0) 2091 use_counter = 1; 2092 if (idx < 0) 2093 idx = 0; 2094 2095 _next_block: 2096 ke = pfr_kentry_byidx(kt, idx, af); 2097 if (ke == NULL) { 2098 kt->pfrkt_nomatch++; 2099 return (1); 2100 } 2101 pfr_prepare_network(&umask, af, ke->pfrke_net); 2102 cur = SUNION2PF(&ke->pfrke_sa, af); 2103 mask = SUNION2PF(&umask, af); 2104 2105 if (use_counter) { 2106 /* is supplied address within block? */ 2107 if (!PF_MATCHA(0, cur, mask, counter, af)) { 2108 /* no, go to next block in table */ 2109 idx++; 2110 use_counter = 0; 2111 goto _next_block; 2112 } 2113 PF_ACPY(addr, counter, af); 2114 } else { 2115 /* use first address of block */ 2116 PF_ACPY(addr, cur, af); 2117 } 2118 2119 if (!KENTRY_NETWORK(ke)) { 2120 /* this is a single IP address - no possible nested block */ 2121 PF_ACPY(counter, addr, af); 2122 *pidx = idx; 2123 kt->pfrkt_match++; 2124 return (0); 2125 } 2126 for (;;) { 2127 /* we don't want to use a nested block */ 2128 switch (af) { 2129 case AF_INET: 2130 ke2 = (struct pfr_kentry *)rn_match(&uaddr, 2131 &kt->pfrkt_ip4->rh); 2132 break; 2133 case AF_INET6: 2134 ke2 = (struct pfr_kentry *)rn_match(&uaddr, 2135 &kt->pfrkt_ip6->rh); 2136 break; 2137 } 2138 /* no need to check KENTRY_RNF_ROOT() here */ 2139 if (ke2 == ke) { 2140 /* lookup return the same block - perfect */ 2141 PF_ACPY(counter, addr, af); 2142 *pidx = idx; 2143 kt->pfrkt_match++; 2144 return (0); 2145 } 2146 2147 /* we need to increase the counter past the nested block */ 2148 pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net); 2149 PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af); 2150 PF_AINC(addr, af); 2151 if (!PF_MATCHA(0, cur, mask, addr, af)) { 2152 /* ok, we reached the end of our main block */ 2153 /* go to next block in table */ 2154 idx++; 2155 use_counter = 0; 2156 goto _next_block; 2157 } 2158 } 2159 } 2160 2161 static struct pfr_kentry * 2162 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af) 2163 { 2164 struct pfr_walktree w; 2165 2166 bzero(&w, sizeof(w)); 2167 w.pfrw_op = PFRW_POOL_GET; 2168 w.pfrw_cnt = idx; 2169 2170 switch (af) { 2171 #ifdef INET 2172 case AF_INET: 2173 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 2174 return (w.pfrw_kentry); 2175 #endif /* INET */ 2176 #ifdef INET6 2177 case AF_INET6: 2178 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w); 2179 return (w.pfrw_kentry); 2180 #endif /* INET6 */ 2181 default: 2182 return (NULL); 2183 } 2184 } 2185 2186 void 2187 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn) 2188 { 2189 struct pfr_walktree w; 2190 2191 bzero(&w, sizeof(w)); 2192 w.pfrw_op = PFRW_DYNADDR_UPDATE; 2193 w.pfrw_dyn = dyn; 2194 2195 dyn->pfid_acnt4 = 0; 2196 dyn->pfid_acnt6 = 0; 2197 if (!dyn->pfid_af || dyn->pfid_af == AF_INET) 2198 kt->pfrkt_ip4->rnh_walktree(&kt->pfrkt_ip4->rh, pfr_walktree, &w); 2199 if (!dyn->pfid_af || dyn->pfid_af == AF_INET6) 2200 kt->pfrkt_ip6->rnh_walktree(&kt->pfrkt_ip6->rh, pfr_walktree, &w); 2201 } 2202