1*49c4be2fSozaki-r /* $NetBSD: pf_if.c,v 1.33 2017/03/14 09:03:08 ozaki-r Exp $ */
2fff57c55Syamt /* $OpenBSD: pf_if.c,v 1.47 2007/07/13 09:17:48 markus Exp $ */
36adffbf9Sitojun
46adffbf9Sitojun /*
5fff57c55Syamt * Copyright 2005 Henning Brauer <henning@openbsd.org>
6fff57c55Syamt * Copyright 2005 Ryan McBride <mcbride@openbsd.org>
76adffbf9Sitojun * Copyright (c) 2001 Daniel Hartmeier
86adffbf9Sitojun * Copyright (c) 2003 Cedric Berger
96adffbf9Sitojun * All rights reserved.
106adffbf9Sitojun *
116adffbf9Sitojun * Redistribution and use in source and binary forms, with or without
126adffbf9Sitojun * modification, are permitted provided that the following conditions
136adffbf9Sitojun * are met:
146adffbf9Sitojun *
156adffbf9Sitojun * - Redistributions of source code must retain the above copyright
166adffbf9Sitojun * notice, this list of conditions and the following disclaimer.
176adffbf9Sitojun * - Redistributions in binary form must reproduce the above
186adffbf9Sitojun * copyright notice, this list of conditions and the following
196adffbf9Sitojun * disclaimer in the documentation and/or other materials provided
206adffbf9Sitojun * with the distribution.
216adffbf9Sitojun *
226adffbf9Sitojun * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
236adffbf9Sitojun * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
246adffbf9Sitojun * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
256adffbf9Sitojun * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
266adffbf9Sitojun * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
276adffbf9Sitojun * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
286adffbf9Sitojun * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
296adffbf9Sitojun * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
306adffbf9Sitojun * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
316adffbf9Sitojun * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
326adffbf9Sitojun * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
336adffbf9Sitojun * POSSIBILITY OF SUCH DAMAGE.
346adffbf9Sitojun */
356adffbf9Sitojun
36a0dda790Slukem #include <sys/cdefs.h>
37*49c4be2fSozaki-r __KERNEL_RCSID(0, "$NetBSD: pf_if.c,v 1.33 2017/03/14 09:03:08 ozaki-r Exp $");
38a0dda790Slukem
39bfcdaa57Sitojun #ifdef _KERNEL_OPT
40bfcdaa57Sitojun #include "opt_inet.h"
41bfcdaa57Sitojun #endif
42bfcdaa57Sitojun
436adffbf9Sitojun #include <sys/param.h>
446adffbf9Sitojun #include <sys/systm.h>
456adffbf9Sitojun #include <sys/mbuf.h>
466adffbf9Sitojun #include <sys/filio.h>
476adffbf9Sitojun #include <sys/socket.h>
486adffbf9Sitojun #include <sys/socketvar.h>
496adffbf9Sitojun #include <sys/kernel.h>
506adffbf9Sitojun #include <sys/device.h>
516adffbf9Sitojun #include <sys/time.h>
526adffbf9Sitojun
536adffbf9Sitojun #include <net/if.h>
546adffbf9Sitojun #include <net/if_types.h>
556adffbf9Sitojun
566adffbf9Sitojun #include <netinet/in.h>
576adffbf9Sitojun #include <netinet/in_var.h>
586adffbf9Sitojun #include <netinet/in_systm.h>
596adffbf9Sitojun #include <netinet/ip.h>
606adffbf9Sitojun #include <netinet/ip_var.h>
616adffbf9Sitojun
626adffbf9Sitojun #include <net/pfvar.h>
636adffbf9Sitojun
646adffbf9Sitojun #ifdef INET6
656adffbf9Sitojun #include <netinet/ip6.h>
666adffbf9Sitojun #endif /* INET6 */
676adffbf9Sitojun
68fff57c55Syamt struct pfi_kif *pfi_all = NULL;
696adffbf9Sitojun struct pool pfi_addr_pl;
70fff57c55Syamt struct pfi_ifhead pfi_ifs;
716adffbf9Sitojun long pfi_update = 1;
726adffbf9Sitojun struct pfr_addr *pfi_buffer;
736adffbf9Sitojun int pfi_buffer_cnt;
746adffbf9Sitojun int pfi_buffer_max;
756adffbf9Sitojun
76fff57c55Syamt void pfi_kif_update(struct pfi_kif *);
77fff57c55Syamt void pfi_dynaddr_update(struct pfi_dynaddr *dyn);
786adffbf9Sitojun void pfi_table_update(struct pfr_ktable *, struct pfi_kif *,
796adffbf9Sitojun int, int);
80fff57c55Syamt void pfi_kifaddr_update(void *);
816adffbf9Sitojun void pfi_instance_add(struct ifnet *, int, int);
826adffbf9Sitojun void pfi_address_add(struct sockaddr *, int, int);
836adffbf9Sitojun int pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
84fff57c55Syamt int pfi_skip_if(const char *, struct pfi_kif *);
856adffbf9Sitojun int pfi_unmask(void *);
86fff57c55Syamt #ifdef __NetBSD__
87fff57c55Syamt void pfi_init_groups(struct ifnet *);
88fff57c55Syamt void pfi_destroy_groups(struct ifnet *);
89fff57c55Syamt
9098fd646fSchristos void pfil_ifnet_wrapper(void *, u_long, void *);
9198fd646fSchristos void pfil_ifaddr_wrapper(void *, u_long, void *);
92fff57c55Syamt #endif
936adffbf9Sitojun
946adffbf9Sitojun RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
956adffbf9Sitojun RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
966adffbf9Sitojun
976adffbf9Sitojun #define PFI_BUFFER_MAX 0x10000
986adffbf9Sitojun #define PFI_MTYPE M_IFADDR
996adffbf9Sitojun
1006adffbf9Sitojun void
pfi_initialize(void)1016adffbf9Sitojun pfi_initialize(void)
1026adffbf9Sitojun {
103bb387e19Sozaki-r int s;
10441c2e7d1Sozaki-r int bound;
105bb387e19Sozaki-r
106fff57c55Syamt if (pfi_all != NULL) /* already initialized */
1076adffbf9Sitojun return;
1086adffbf9Sitojun
10959d979c5Sad #ifdef __NetBSD__
11059d979c5Sad pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0,
11159d979c5Sad "pfiaddrpl", &pool_allocator_nointr, IPL_NONE);
11259d979c5Sad #else
1136adffbf9Sitojun pool_init(&pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0,
1146adffbf9Sitojun "pfiaddrpl", &pool_allocator_nointr);
115fff57c55Syamt #endif /* !__NetBSD__ */
1166adffbf9Sitojun pfi_buffer_max = 64;
1176adffbf9Sitojun pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer),
1186adffbf9Sitojun PFI_MTYPE, M_WAITOK);
119fff57c55Syamt
120fff57c55Syamt if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
121fff57c55Syamt panic("pfi_kif_get for pfi_all failed");
122fff57c55Syamt
123fff57c55Syamt #ifdef __NetBSD__
124210ed929Srmind ifnet_t *ifp;
12541c2e7d1Sozaki-r bound = curlwp_bind();
126bb387e19Sozaki-r s = pserialize_read_enter();
127bb387e19Sozaki-r IFNET_READER_FOREACH(ifp) {
128bb387e19Sozaki-r struct psref psref;
129*49c4be2fSozaki-r if_acquire(ifp, &psref);
130bb387e19Sozaki-r pserialize_read_exit(s);
131bb387e19Sozaki-r
132fff57c55Syamt pfi_init_groups(ifp);
133fff57c55Syamt pfi_attach_ifnet(ifp);
134bb387e19Sozaki-r
135bb387e19Sozaki-r s = pserialize_read_enter();
136*49c4be2fSozaki-r if_release(ifp, &psref);
137fff57c55Syamt }
138bb387e19Sozaki-r pserialize_read_exit(s);
13941c2e7d1Sozaki-r curlwp_bindx(bound);
140fff57c55Syamt
14198fd646fSchristos pfil_add_ihook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, if_pfil);
14298fd646fSchristos pfil_add_ihook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, if_pfil);
143fff57c55Syamt #endif /* __NetBSD__ */
1446adffbf9Sitojun }
1456adffbf9Sitojun
146f6a8ba3dSahoka #ifdef _MODULE
147f6a8ba3dSahoka void
pfi_destroy(void)148f6a8ba3dSahoka pfi_destroy(void)
149f6a8ba3dSahoka {
150f6a8ba3dSahoka struct pfi_kif *p;
151f951f97cSrmind ifnet_t *ifp;
152bb387e19Sozaki-r int s;
15341c2e7d1Sozaki-r int bound;
154f6a8ba3dSahoka
15598fd646fSchristos pfil_remove_ihook(pfil_ifaddr_wrapper, NULL, PFIL_IFADDR, if_pfil);
15698fd646fSchristos pfil_remove_ihook(pfil_ifnet_wrapper, NULL, PFIL_IFNET, if_pfil);
157f6a8ba3dSahoka
15841c2e7d1Sozaki-r bound = curlwp_bind();
159bb387e19Sozaki-r s = pserialize_read_enter();
160bb387e19Sozaki-r IFNET_READER_FOREACH(ifp) {
161bb387e19Sozaki-r struct psref psref;
162*49c4be2fSozaki-r if_acquire(ifp, &psref);
163bb387e19Sozaki-r pserialize_read_exit(s);
164bb387e19Sozaki-r
165f6a8ba3dSahoka pfi_detach_ifnet(ifp);
166f6a8ba3dSahoka pfi_destroy_groups(ifp);
167bb387e19Sozaki-r
168bb387e19Sozaki-r s = pserialize_read_enter();
169*49c4be2fSozaki-r if_release(ifp, &psref);
170f6a8ba3dSahoka }
171bb387e19Sozaki-r pserialize_read_exit(s);
17241c2e7d1Sozaki-r curlwp_bindx(bound);
173f6a8ba3dSahoka
174f6a8ba3dSahoka while ((p = RB_MIN(pfi_ifhead, &pfi_ifs))) {
175f6a8ba3dSahoka RB_REMOVE(pfi_ifhead, &pfi_ifs, p);
176f6a8ba3dSahoka free(p, PFI_MTYPE);
177f6a8ba3dSahoka }
178f6a8ba3dSahoka
179f6a8ba3dSahoka pool_destroy(&pfi_addr_pl);
180f6a8ba3dSahoka
181f6a8ba3dSahoka free(pfi_buffer, PFI_MTYPE);
182f6a8ba3dSahoka }
183f6a8ba3dSahoka #endif /* _MODULE */
184f6a8ba3dSahoka
185fff57c55Syamt struct pfi_kif *
pfi_kif_get(const char * kif_name)186fff57c55Syamt pfi_kif_get(const char *kif_name)
187fff57c55Syamt {
188fff57c55Syamt struct pfi_kif *kif;
189fff57c55Syamt struct pfi_kif_cmp s;
190fff57c55Syamt
191fff57c55Syamt bzero(&s, sizeof(s));
192fff57c55Syamt strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name));
193fff57c55Syamt if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&s)) != NULL)
194fff57c55Syamt return (kif);
195fff57c55Syamt
196fff57c55Syamt /* create new one */
197dcf70589Scegger if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_NOWAIT|M_ZERO)) == NULL)
198fff57c55Syamt return (NULL);
199fff57c55Syamt
200fff57c55Syamt strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name));
201fff57c55Syamt #ifdef __NetBSD__
202fff57c55Syamt /* time_second is not valid yet */
203fff57c55Syamt kif->pfik_tzero = (time_second > 7200) ? time_second : 0;
204fff57c55Syamt #else
205fff57c55Syamt kif->pfik_tzero = time_second;
206fff57c55Syamt #endif /* !__NetBSD__ */
207fff57c55Syamt TAILQ_INIT(&kif->pfik_dynaddrs);
208fff57c55Syamt
209fff57c55Syamt RB_INSERT(pfi_ifhead, &pfi_ifs, kif);
210fff57c55Syamt return (kif);
211fff57c55Syamt }
2120407dd42Sitojun
2136adffbf9Sitojun void
pfi_kif_ref(struct pfi_kif * kif,enum pfi_kif_refs what)214fff57c55Syamt pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what)
2156adffbf9Sitojun {
216fff57c55Syamt switch (what) {
217fff57c55Syamt case PFI_KIF_REF_RULE:
218fff57c55Syamt kif->pfik_rules++;
219fff57c55Syamt break;
220fff57c55Syamt case PFI_KIF_REF_STATE:
221fff57c55Syamt kif->pfik_states++;
222fff57c55Syamt break;
223fff57c55Syamt default:
224fff57c55Syamt panic("pfi_kif_ref with unknown type");
225fff57c55Syamt }
226fff57c55Syamt }
227fff57c55Syamt
228fff57c55Syamt void
pfi_kif_unref(struct pfi_kif * kif,enum pfi_kif_refs what)229fff57c55Syamt pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
230fff57c55Syamt {
231fff57c55Syamt if (kif == NULL)
232fff57c55Syamt return;
233fff57c55Syamt
234fff57c55Syamt switch (what) {
235fff57c55Syamt case PFI_KIF_REF_NONE:
236fff57c55Syamt break;
237fff57c55Syamt case PFI_KIF_REF_RULE:
238fff57c55Syamt if (kif->pfik_rules <= 0) {
239fff57c55Syamt printf("pfi_kif_unref: rules refcount <= 0\n");
240fff57c55Syamt return;
241fff57c55Syamt }
242fff57c55Syamt kif->pfik_rules--;
243fff57c55Syamt break;
244fff57c55Syamt case PFI_KIF_REF_STATE:
245fff57c55Syamt if (kif->pfik_states <= 0) {
246fff57c55Syamt printf("pfi_kif_unref: state refcount <= 0\n");
247fff57c55Syamt return;
248fff57c55Syamt }
249fff57c55Syamt kif->pfik_states--;
250fff57c55Syamt break;
251fff57c55Syamt default:
252fff57c55Syamt panic("pfi_kif_unref with unknown type");
253fff57c55Syamt }
254fff57c55Syamt
255fff57c55Syamt if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == pfi_all)
256fff57c55Syamt return;
257fff57c55Syamt
258fff57c55Syamt if (kif->pfik_rules || kif->pfik_states)
259fff57c55Syamt return;
260fff57c55Syamt
261fff57c55Syamt RB_REMOVE(pfi_ifhead, &pfi_ifs, kif);
262fff57c55Syamt free(kif, PFI_MTYPE);
263fff57c55Syamt }
264fff57c55Syamt
265fff57c55Syamt int
pfi_kif_match(struct pfi_kif * rule_kif,struct pfi_kif * packet_kif)266fff57c55Syamt pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
267fff57c55Syamt {
268fff57c55Syamt struct ifg_list *p;
269fff57c55Syamt
270fff57c55Syamt if (rule_kif == NULL || rule_kif == packet_kif)
271fff57c55Syamt return (1);
272fff57c55Syamt
273fff57c55Syamt if (rule_kif->pfik_group != NULL) {
274fff57c55Syamt struct ifg_list_head *ifgh =
275fff57c55Syamt if_get_groups(packet_kif->pfik_ifp);
276fff57c55Syamt
277fff57c55Syamt TAILQ_FOREACH(p, ifgh, ifgl_next)
278fff57c55Syamt if (p->ifgl_group == rule_kif->pfik_group)
279fff57c55Syamt return (1);
280fff57c55Syamt }
281fff57c55Syamt
282fff57c55Syamt return (0);
2836adffbf9Sitojun }
2846adffbf9Sitojun
2856adffbf9Sitojun void
pfi_attach_ifnet(struct ifnet * ifp)2866adffbf9Sitojun pfi_attach_ifnet(struct ifnet *ifp)
2876adffbf9Sitojun {
288fff57c55Syamt struct pfi_kif *kif;
2896adffbf9Sitojun int s;
2906adffbf9Sitojun
2916adffbf9Sitojun pfi_initialize();
2926adffbf9Sitojun s = splsoftnet();
2936adffbf9Sitojun pfi_update++;
294fff57c55Syamt if ((kif = pfi_kif_get(ifp->if_xname)) == NULL)
295fff57c55Syamt panic("pfi_kif_get failed");
2966adffbf9Sitojun
297fff57c55Syamt kif->pfik_ifp = ifp;
298fff57c55Syamt ifp->if_pf_kif = kif;
2996adffbf9Sitojun
300fff57c55Syamt #ifndef __NetBSD__
301fff57c55Syamt if ((kif->pfik_ah_cookie = hook_establish(ifp->if_addrhooks, 1,
302fff57c55Syamt pfi_kifaddr_update, kif)) == NULL)
303fff57c55Syamt panic("pfi_attach_ifnet: cannot allocate '%s' address hook",
304fff57c55Syamt ifp->if_xname);
305fff57c55Syamt #endif /* !__NetBSD__ */
3066adffbf9Sitojun
307fff57c55Syamt pfi_kif_update(kif);
3086adffbf9Sitojun
3096adffbf9Sitojun splx(s);
3106adffbf9Sitojun }
3116adffbf9Sitojun
3126adffbf9Sitojun void
pfi_detach_ifnet(struct ifnet * ifp)3136adffbf9Sitojun pfi_detach_ifnet(struct ifnet *ifp)
3146adffbf9Sitojun {
3156adffbf9Sitojun int s;
316fff57c55Syamt struct pfi_kif *kif;
3176adffbf9Sitojun
318fff57c55Syamt if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL)
319fff57c55Syamt return;
3206adffbf9Sitojun
3216adffbf9Sitojun s = splsoftnet();
3226adffbf9Sitojun pfi_update++;
323fff57c55Syamt #ifndef __NetBSD__
324fff57c55Syamt hook_disestablish(ifp->if_addrhooks, kif->pfik_ah_cookie);
325fff57c55Syamt #endif /* !__NetBSD__ */
326fff57c55Syamt pfi_kif_update(kif);
327fff57c55Syamt
328fff57c55Syamt kif->pfik_ifp = NULL;
329fff57c55Syamt ifp->if_pf_kif = NULL;
330fff57c55Syamt pfi_kif_unref(kif, PFI_KIF_REF_NONE);
3316adffbf9Sitojun splx(s);
3326adffbf9Sitojun }
3336adffbf9Sitojun
334fff57c55Syamt void
pfi_attach_ifgroup(struct ifg_group * ifg)335fff57c55Syamt pfi_attach_ifgroup(struct ifg_group *ifg)
3366adffbf9Sitojun {
337fff57c55Syamt struct pfi_kif *kif;
338fff57c55Syamt int s;
339fff57c55Syamt
340fff57c55Syamt pfi_initialize();
341fff57c55Syamt s = splsoftnet();
342fff57c55Syamt pfi_update++;
343fff57c55Syamt if ((kif = pfi_kif_get(ifg->ifg_group)) == NULL)
344fff57c55Syamt panic("pfi_kif_get failed");
345fff57c55Syamt
346fff57c55Syamt kif->pfik_group = ifg;
347fff57c55Syamt ifg->ifg_pf_kif = kif;
348fff57c55Syamt
349fff57c55Syamt splx(s);
350fff57c55Syamt }
351fff57c55Syamt
352fff57c55Syamt void
pfi_detach_ifgroup(struct ifg_group * ifg)353fff57c55Syamt pfi_detach_ifgroup(struct ifg_group *ifg)
354fff57c55Syamt {
355fff57c55Syamt int s;
356fff57c55Syamt struct pfi_kif *kif;
357fff57c55Syamt
358fff57c55Syamt if ((kif = (struct pfi_kif *)ifg->ifg_pf_kif) == NULL)
359fff57c55Syamt return;
360fff57c55Syamt
361fff57c55Syamt s = splsoftnet();
362fff57c55Syamt pfi_update++;
363fff57c55Syamt
364fff57c55Syamt kif->pfik_group = NULL;
365fff57c55Syamt ifg->ifg_pf_kif = NULL;
366fff57c55Syamt pfi_kif_unref(kif, PFI_KIF_REF_NONE);
367fff57c55Syamt splx(s);
368fff57c55Syamt }
369fff57c55Syamt
370fff57c55Syamt void
pfi_group_change(const char * group)371fff57c55Syamt pfi_group_change(const char *group)
372fff57c55Syamt {
373fff57c55Syamt struct pfi_kif *kif;
3746adffbf9Sitojun int s;
3756adffbf9Sitojun
3766adffbf9Sitojun s = splsoftnet();
377fff57c55Syamt pfi_update++;
378fff57c55Syamt if ((kif = pfi_kif_get(group)) == NULL)
379fff57c55Syamt panic("pfi_kif_get failed");
380fff57c55Syamt
381fff57c55Syamt pfi_kif_update(kif);
382fff57c55Syamt
3836adffbf9Sitojun splx(s);
3846adffbf9Sitojun }
3856adffbf9Sitojun
386fff57c55Syamt int
pfi_match_addr(struct pfi_dynaddr * dyn,struct pf_addr * a,sa_family_t af)387fff57c55Syamt pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
3886adffbf9Sitojun {
389fff57c55Syamt switch (af) {
390fff57c55Syamt #ifdef INET
391fff57c55Syamt case AF_INET:
392fff57c55Syamt switch (dyn->pfid_acnt4) {
393fff57c55Syamt case 0:
394fff57c55Syamt return (0);
395fff57c55Syamt case 1:
396fff57c55Syamt return (PF_MATCHA(0, &dyn->pfid_addr4,
397fff57c55Syamt &dyn->pfid_mask4, a, AF_INET));
398fff57c55Syamt default:
399fff57c55Syamt return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
4006adffbf9Sitojun }
401fff57c55Syamt break;
402fff57c55Syamt #endif /* INET */
403fff57c55Syamt #ifdef INET6
404fff57c55Syamt case AF_INET6:
405fff57c55Syamt switch (dyn->pfid_acnt6) {
406fff57c55Syamt case 0:
407fff57c55Syamt return (0);
408fff57c55Syamt case 1:
409fff57c55Syamt return (PF_MATCHA(0, &dyn->pfid_addr6,
410fff57c55Syamt &dyn->pfid_mask6, a, AF_INET6));
411fff57c55Syamt default:
412fff57c55Syamt return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
4136adffbf9Sitojun }
414fff57c55Syamt break;
415fff57c55Syamt #endif /* INET6 */
416fff57c55Syamt default:
417fff57c55Syamt return (0);
4186adffbf9Sitojun }
4196adffbf9Sitojun }
4206adffbf9Sitojun
4216adffbf9Sitojun int
pfi_dynaddr_setup(struct pf_addr_wrap * aw,sa_family_t af)4226adffbf9Sitojun pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
4236adffbf9Sitojun {
4246adffbf9Sitojun struct pfi_dynaddr *dyn;
4256adffbf9Sitojun char tblname[PF_TABLE_NAME_SIZE];
4266adffbf9Sitojun struct pf_ruleset *ruleset = NULL;
4276adffbf9Sitojun int s, rv = 0;
4286adffbf9Sitojun
4296adffbf9Sitojun if (aw->type != PF_ADDR_DYNIFTL)
4306adffbf9Sitojun return (0);
431fff57c55Syamt if ((dyn = pool_get(&pfi_addr_pl, PR_NOWAIT)) == NULL)
4326adffbf9Sitojun return (1);
4336adffbf9Sitojun bzero(dyn, sizeof(*dyn));
4346adffbf9Sitojun
4356adffbf9Sitojun s = splsoftnet();
436fff57c55Syamt if (!strcmp(aw->v.ifname, "self"))
437fff57c55Syamt dyn->pfid_kif = pfi_kif_get(IFG_ALL);
438fff57c55Syamt else
439fff57c55Syamt dyn->pfid_kif = pfi_kif_get(aw->v.ifname);
440fff57c55Syamt if (dyn->pfid_kif == NULL) {
441fff57c55Syamt rv = 1;
442fff57c55Syamt goto _bad;
443fff57c55Syamt }
444fff57c55Syamt pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE);
4456adffbf9Sitojun
4466adffbf9Sitojun dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
4476adffbf9Sitojun if (af == AF_INET && dyn->pfid_net == 32)
4486adffbf9Sitojun dyn->pfid_net = 128;
4496adffbf9Sitojun strlcpy(tblname, aw->v.ifname, sizeof(tblname));
4506adffbf9Sitojun if (aw->iflags & PFI_AFLAG_NETWORK)
4516adffbf9Sitojun strlcat(tblname, ":network", sizeof(tblname));
4526adffbf9Sitojun if (aw->iflags & PFI_AFLAG_BROADCAST)
4536adffbf9Sitojun strlcat(tblname, ":broadcast", sizeof(tblname));
4546adffbf9Sitojun if (aw->iflags & PFI_AFLAG_PEER)
4556adffbf9Sitojun strlcat(tblname, ":peer", sizeof(tblname));
4566adffbf9Sitojun if (aw->iflags & PFI_AFLAG_NOALIAS)
4576adffbf9Sitojun strlcat(tblname, ":0", sizeof(tblname));
4586adffbf9Sitojun if (dyn->pfid_net != 128)
4596adffbf9Sitojun snprintf(tblname + strlen(tblname),
4606adffbf9Sitojun sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
461fff57c55Syamt if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
462fff57c55Syamt rv = 1;
463fff57c55Syamt goto _bad;
464fff57c55Syamt }
4656adffbf9Sitojun
466fff57c55Syamt if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) {
467fff57c55Syamt rv = 1;
468fff57c55Syamt goto _bad;
469fff57c55Syamt }
4706adffbf9Sitojun
4716adffbf9Sitojun dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE;
4726adffbf9Sitojun dyn->pfid_iflags = aw->iflags;
4736adffbf9Sitojun dyn->pfid_af = af;
4746adffbf9Sitojun
475fff57c55Syamt TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
4766adffbf9Sitojun aw->p.dyn = dyn;
477fff57c55Syamt pfi_kif_update(dyn->pfid_kif);
4786adffbf9Sitojun splx(s);
4796adffbf9Sitojun return (0);
4806adffbf9Sitojun
4816adffbf9Sitojun _bad:
4826adffbf9Sitojun if (dyn->pfid_kt != NULL)
4836adffbf9Sitojun pfr_detach_table(dyn->pfid_kt);
4846adffbf9Sitojun if (ruleset != NULL)
4856adffbf9Sitojun pf_remove_if_empty_ruleset(ruleset);
4866adffbf9Sitojun if (dyn->pfid_kif != NULL)
487fff57c55Syamt pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE);
4886adffbf9Sitojun pool_put(&pfi_addr_pl, dyn);
4896adffbf9Sitojun splx(s);
4906adffbf9Sitojun return (rv);
4916adffbf9Sitojun }
4926adffbf9Sitojun
4936adffbf9Sitojun void
pfi_kif_update(struct pfi_kif * kif)494fff57c55Syamt pfi_kif_update(struct pfi_kif *kif)
4956adffbf9Sitojun {
496fff57c55Syamt struct ifg_list *ifgl;
497fff57c55Syamt struct pfi_dynaddr *p;
498fff57c55Syamt
499fff57c55Syamt /* update all dynaddr */
500fff57c55Syamt TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
501fff57c55Syamt pfi_dynaddr_update(p);
502fff57c55Syamt
503fff57c55Syamt /* again for all groups kif is member of */
504fff57c55Syamt if (kif->pfik_ifp != NULL) {
505fff57c55Syamt struct ifg_list_head *ifgh = if_get_groups(kif->pfik_ifp);
506fff57c55Syamt
507fff57c55Syamt TAILQ_FOREACH(ifgl, ifgh, ifgl_next)
508fff57c55Syamt pfi_kif_update((struct pfi_kif *)
509fff57c55Syamt ifgl->ifgl_group->ifg_pf_kif);
510fff57c55Syamt }
511fff57c55Syamt }
512fff57c55Syamt
513fff57c55Syamt void
pfi_dynaddr_update(struct pfi_dynaddr * dyn)514fff57c55Syamt pfi_dynaddr_update(struct pfi_dynaddr *dyn)
515fff57c55Syamt {
51697107414Speter struct pfi_kif *kif;
51797107414Speter struct pfr_ktable *kt;
5186adffbf9Sitojun
51997107414Speter if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL)
5206adffbf9Sitojun panic("pfi_dynaddr_update");
52197107414Speter
52297107414Speter kif = dyn->pfid_kif;
52397107414Speter kt = dyn->pfid_kt;
524fff57c55Syamt
5256adffbf9Sitojun if (kt->pfrkt_larg != pfi_update) {
5266adffbf9Sitojun /* this table needs to be brought up-to-date */
5276adffbf9Sitojun pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags);
5286adffbf9Sitojun kt->pfrkt_larg = pfi_update;
5296adffbf9Sitojun }
5306adffbf9Sitojun pfr_dynaddr_update(kt, dyn);
5316adffbf9Sitojun }
5326adffbf9Sitojun
5336adffbf9Sitojun void
pfi_table_update(struct pfr_ktable * kt,struct pfi_kif * kif,int net,int flags)5346adffbf9Sitojun pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
5356adffbf9Sitojun {
5366adffbf9Sitojun int e, size2 = 0;
537fff57c55Syamt struct ifg_member *ifgm;
5386adffbf9Sitojun
5396adffbf9Sitojun pfi_buffer_cnt = 0;
540fff57c55Syamt
541fff57c55Syamt if (kif->pfik_ifp != NULL)
5426adffbf9Sitojun pfi_instance_add(kif->pfik_ifp, net, flags);
543fff57c55Syamt else if (kif->pfik_group != NULL)
544fff57c55Syamt TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next)
545fff57c55Syamt pfi_instance_add(ifgm->ifgm_ifp, net, flags);
546fff57c55Syamt
547fff57c55Syamt if ((e = pfr_set_addrs(&kt->pfrkt_t, pfi_buffer, pfi_buffer_cnt, &size2,
548fff57c55Syamt NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
5496adffbf9Sitojun printf("pfi_table_update: cannot set %d new addresses "
5506adffbf9Sitojun "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);
5516adffbf9Sitojun }
5526adffbf9Sitojun
5536adffbf9Sitojun void
pfi_instance_add(struct ifnet * ifp,int net,int flags)5546adffbf9Sitojun pfi_instance_add(struct ifnet *ifp, int net, int flags)
5556adffbf9Sitojun {
5566adffbf9Sitojun struct ifaddr *ia;
5576adffbf9Sitojun int got4 = 0, got6 = 0;
5586adffbf9Sitojun int net2, af;
55985aa1e74Sozaki-r int s;
5606adffbf9Sitojun
5616adffbf9Sitojun if (ifp == NULL)
5626adffbf9Sitojun return;
56385aa1e74Sozaki-r
56485aa1e74Sozaki-r /* Depends on pfi_address_add doesn't sleep */
56585aa1e74Sozaki-r s = pserialize_read_enter();
5663d4d635bSozaki-r IFADDR_READER_FOREACH(ia, ifp) {
5676adffbf9Sitojun af = ia->ifa_addr->sa_family;
5686adffbf9Sitojun if (af != AF_INET && af != AF_INET6)
5696adffbf9Sitojun continue;
5706adffbf9Sitojun if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6)
5716adffbf9Sitojun continue;
5726adffbf9Sitojun if ((flags & PFI_AFLAG_BROADCAST) &&
5736adffbf9Sitojun !(ifp->if_flags & IFF_BROADCAST))
5746adffbf9Sitojun continue;
5756adffbf9Sitojun if ((flags & PFI_AFLAG_PEER) &&
5766adffbf9Sitojun !(ifp->if_flags & IFF_POINTOPOINT))
5776adffbf9Sitojun continue;
5786adffbf9Sitojun if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
5796adffbf9Sitojun IN6_IS_ADDR_LINKLOCAL(
5806adffbf9Sitojun &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
5816adffbf9Sitojun continue;
5826adffbf9Sitojun if (flags & PFI_AFLAG_NOALIAS) {
5836adffbf9Sitojun if (af == AF_INET && got4)
5846adffbf9Sitojun continue;
5856adffbf9Sitojun if (af == AF_INET6 && got6)
5866adffbf9Sitojun continue;
5876adffbf9Sitojun }
5886adffbf9Sitojun if (af == AF_INET)
5896adffbf9Sitojun got4 = 1;
590da186141Syamt else if (af == AF_INET6)
5916adffbf9Sitojun got6 = 1;
5926adffbf9Sitojun net2 = net;
5936adffbf9Sitojun if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
594fff57c55Syamt if (af == AF_INET)
5956adffbf9Sitojun net2 = pfi_unmask(&((struct sockaddr_in *)
5966adffbf9Sitojun ia->ifa_netmask)->sin_addr);
597fff57c55Syamt else if (af == AF_INET6)
5986adffbf9Sitojun net2 = pfi_unmask(&((struct sockaddr_in6 *)
5996adffbf9Sitojun ia->ifa_netmask)->sin6_addr);
6006adffbf9Sitojun }
6016adffbf9Sitojun if (af == AF_INET && net2 > 32)
6026adffbf9Sitojun net2 = 32;
6036adffbf9Sitojun if (flags & PFI_AFLAG_BROADCAST)
6046adffbf9Sitojun pfi_address_add(ia->ifa_broadaddr, af, net2);
6056adffbf9Sitojun else if (flags & PFI_AFLAG_PEER)
6066adffbf9Sitojun pfi_address_add(ia->ifa_dstaddr, af, net2);
6076adffbf9Sitojun else
6086adffbf9Sitojun pfi_address_add(ia->ifa_addr, af, net2);
6096adffbf9Sitojun }
61085aa1e74Sozaki-r pserialize_read_exit(s);
6116adffbf9Sitojun }
6126adffbf9Sitojun
6136adffbf9Sitojun void
pfi_address_add(struct sockaddr * sa,int af,int net)6146adffbf9Sitojun pfi_address_add(struct sockaddr *sa, int af, int net)
6156adffbf9Sitojun {
6166adffbf9Sitojun struct pfr_addr *p;
6176adffbf9Sitojun int i;
6186adffbf9Sitojun
6196adffbf9Sitojun if (pfi_buffer_cnt >= pfi_buffer_max) {
6206adffbf9Sitojun int new_max = pfi_buffer_max * 2;
6216adffbf9Sitojun
6226adffbf9Sitojun if (new_max > PFI_BUFFER_MAX) {
6236adffbf9Sitojun printf("pfi_address_add: address buffer full (%d/%d)\n",
6246adffbf9Sitojun pfi_buffer_cnt, PFI_BUFFER_MAX);
6256adffbf9Sitojun return;
6266adffbf9Sitojun }
6279c1c1ad1Scegger p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE, M_NOWAIT);
6286adffbf9Sitojun if (p == NULL) {
6296adffbf9Sitojun printf("pfi_address_add: no memory to grow buffer "
6306adffbf9Sitojun "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
6316adffbf9Sitojun return;
6326adffbf9Sitojun }
63383510449Sdsl memcpy(p, pfi_buffer, pfi_buffer_cnt * sizeof(*pfi_buffer));
6346adffbf9Sitojun /* no need to zero buffer */
6356adffbf9Sitojun free(pfi_buffer, PFI_MTYPE);
6366adffbf9Sitojun pfi_buffer = p;
6376adffbf9Sitojun pfi_buffer_max = new_max;
6386adffbf9Sitojun }
6396adffbf9Sitojun if (af == AF_INET && net > 32)
6406adffbf9Sitojun net = 128;
6416adffbf9Sitojun p = pfi_buffer + pfi_buffer_cnt++;
6426adffbf9Sitojun bzero(p, sizeof(*p));
6436adffbf9Sitojun p->pfra_af = af;
6446adffbf9Sitojun p->pfra_net = net;
6456adffbf9Sitojun if (af == AF_INET)
6466adffbf9Sitojun p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr;
647fff57c55Syamt else if (af == AF_INET6) {
6486adffbf9Sitojun p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr;
649fff57c55Syamt if (IN6_IS_SCOPE_EMBEDDABLE(&p->pfra_ip6addr))
6506adffbf9Sitojun p->pfra_ip6addr.s6_addr16[1] = 0;
6516adffbf9Sitojun }
6526adffbf9Sitojun /* mask network address bits */
6536adffbf9Sitojun if (net < 128)
65453524e44Schristos ((char *)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
6556adffbf9Sitojun for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++)
65653524e44Schristos ((char *)p)[i] = 0;
6576adffbf9Sitojun }
6586adffbf9Sitojun
6596adffbf9Sitojun void
pfi_dynaddr_remove(struct pf_addr_wrap * aw)6606adffbf9Sitojun pfi_dynaddr_remove(struct pf_addr_wrap *aw)
6616adffbf9Sitojun {
6626adffbf9Sitojun int s;
6636adffbf9Sitojun
6646adffbf9Sitojun if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
6656adffbf9Sitojun aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL)
6666adffbf9Sitojun return;
6676adffbf9Sitojun
6686adffbf9Sitojun s = splsoftnet();
669fff57c55Syamt TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry);
670fff57c55Syamt pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE);
6716adffbf9Sitojun aw->p.dyn->pfid_kif = NULL;
6726adffbf9Sitojun pfr_detach_table(aw->p.dyn->pfid_kt);
6736adffbf9Sitojun aw->p.dyn->pfid_kt = NULL;
6746adffbf9Sitojun pool_put(&pfi_addr_pl, aw->p.dyn);
6756adffbf9Sitojun aw->p.dyn = NULL;
6766adffbf9Sitojun splx(s);
6776adffbf9Sitojun }
6786adffbf9Sitojun
6796adffbf9Sitojun void
pfi_dynaddr_copyout(struct pf_addr_wrap * aw)6806adffbf9Sitojun pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
6816adffbf9Sitojun {
6826adffbf9Sitojun if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
6836adffbf9Sitojun aw->p.dyn->pfid_kif == NULL)
6846adffbf9Sitojun return;
6856adffbf9Sitojun aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
6866adffbf9Sitojun }
6876adffbf9Sitojun
6886adffbf9Sitojun void
pfi_kifaddr_update(void * v)6896adffbf9Sitojun pfi_kifaddr_update(void *v)
6906adffbf9Sitojun {
6916adffbf9Sitojun int s;
692fff57c55Syamt struct pfi_kif *kif = (struct pfi_kif *)v;
6936adffbf9Sitojun
6946adffbf9Sitojun s = splsoftnet();
6956adffbf9Sitojun pfi_update++;
696fff57c55Syamt pfi_kif_update(kif);
6976adffbf9Sitojun splx(s);
6986adffbf9Sitojun }
6996adffbf9Sitojun
7006adffbf9Sitojun int
pfi_if_compare(struct pfi_kif * p,struct pfi_kif * q)7016adffbf9Sitojun pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
7026adffbf9Sitojun {
7036adffbf9Sitojun return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
7046adffbf9Sitojun }
7056adffbf9Sitojun
7066adffbf9Sitojun void
pfi_fill_oldstatus(struct pf_status * pfs)7076adffbf9Sitojun pfi_fill_oldstatus(struct pf_status *pfs)
7086adffbf9Sitojun {
709fff57c55Syamt struct pfi_kif *p;
710fff57c55Syamt struct pfi_kif_cmp key;
7116adffbf9Sitojun int i, j, k, s;
7126adffbf9Sitojun
7136adffbf9Sitojun strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name));
7146adffbf9Sitojun s = splsoftnet();
715fff57c55Syamt p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&key);
7166adffbf9Sitojun if (p == NULL) {
7176adffbf9Sitojun splx(s);
7186adffbf9Sitojun return;
7196adffbf9Sitojun }
7206adffbf9Sitojun bzero(pfs->pcounters, sizeof(pfs->pcounters));
7216adffbf9Sitojun bzero(pfs->bcounters, sizeof(pfs->bcounters));
7226adffbf9Sitojun for (i = 0; i < 2; i++)
7236adffbf9Sitojun for (j = 0; j < 2; j++)
7246adffbf9Sitojun for (k = 0; k < 2; k++) {
7256adffbf9Sitojun pfs->pcounters[i][j][k] =
7266adffbf9Sitojun p->pfik_packets[i][j][k];
7276adffbf9Sitojun pfs->bcounters[i][j] +=
7286adffbf9Sitojun p->pfik_bytes[i][j][k];
7296adffbf9Sitojun }
7306adffbf9Sitojun splx(s);
7316adffbf9Sitojun }
7326adffbf9Sitojun
7336adffbf9Sitojun int
pfi_clr_istats(const char * name)734fff57c55Syamt pfi_clr_istats(const char *name)
7356adffbf9Sitojun {
7366adffbf9Sitojun struct pfi_kif *p;
737fff57c55Syamt int s;
7386adffbf9Sitojun
73997107414Speter s = splsoftnet();
7406adffbf9Sitojun RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
741fff57c55Syamt if (pfi_skip_if(name, p))
7426adffbf9Sitojun continue;
7436adffbf9Sitojun bzero(p->pfik_packets, sizeof(p->pfik_packets));
7446adffbf9Sitojun bzero(p->pfik_bytes, sizeof(p->pfik_bytes));
745fff57c55Syamt p->pfik_tzero = time_second;
7466adffbf9Sitojun }
7476adffbf9Sitojun splx(s);
748fff57c55Syamt
7496adffbf9Sitojun return (0);
7506adffbf9Sitojun }
7516adffbf9Sitojun
7526adffbf9Sitojun int
pfi_get_ifaces(const char * name,struct pfi_kif * buf,int * size)753fff57c55Syamt pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size)
754fff57c55Syamt {
755fff57c55Syamt struct pfi_kif *p, *nextp;
756fff57c55Syamt int s, n = 0;
757fff57c55Syamt
758fff57c55Syamt s = splsoftnet();
759fff57c55Syamt for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) {
760fff57c55Syamt nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
761fff57c55Syamt if (pfi_skip_if(name, p))
762fff57c55Syamt continue;
763fff57c55Syamt if (*size > n++) {
764fff57c55Syamt if (!p->pfik_tzero)
765fff57c55Syamt p->pfik_tzero = time_second;
766fff57c55Syamt pfi_kif_ref(p, PFI_KIF_REF_RULE);
767fff57c55Syamt if (copyout(p, buf++, sizeof(*buf))) {
768fff57c55Syamt pfi_kif_unref(p, PFI_KIF_REF_RULE);
769fff57c55Syamt splx(s);
770fff57c55Syamt return (EFAULT);
771fff57c55Syamt }
772fff57c55Syamt nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
773fff57c55Syamt pfi_kif_unref(p, PFI_KIF_REF_RULE);
774fff57c55Syamt }
775fff57c55Syamt }
776fff57c55Syamt splx(s);
777fff57c55Syamt *size = n;
778fff57c55Syamt return (0);
779fff57c55Syamt }
780fff57c55Syamt
781fff57c55Syamt int
pfi_skip_if(const char * filter,struct pfi_kif * p)782fff57c55Syamt pfi_skip_if(const char *filter, struct pfi_kif *p)
783fff57c55Syamt {
784fff57c55Syamt int n;
785fff57c55Syamt
786fff57c55Syamt if (filter == NULL || !*filter)
787fff57c55Syamt return (0);
788fff57c55Syamt if (!strcmp(p->pfik_name, filter))
789fff57c55Syamt return (0); /* exact match */
790fff57c55Syamt n = strlen(filter);
791fff57c55Syamt if (n < 1 || n >= IFNAMSIZ)
792fff57c55Syamt return (1); /* sanity check */
793fff57c55Syamt if (filter[n-1] >= '0' && filter[n-1] <= '9')
794fff57c55Syamt return (1); /* only do exact match in that case */
795fff57c55Syamt if (strncmp(p->pfik_name, filter, n))
796fff57c55Syamt return (1); /* prefix doesn't match */
797fff57c55Syamt return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
798fff57c55Syamt }
799fff57c55Syamt
800fff57c55Syamt int
pfi_set_flags(const char * name,int flags)80197107414Speter pfi_set_flags(const char *name, int flags)
80297107414Speter {
80397107414Speter struct pfi_kif *p;
80497107414Speter int s;
80597107414Speter
80697107414Speter s = splsoftnet();
80797107414Speter RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
808fff57c55Syamt if (pfi_skip_if(name, p))
80997107414Speter continue;
81097107414Speter p->pfik_flags |= flags;
81197107414Speter }
81297107414Speter splx(s);
81397107414Speter return (0);
81497107414Speter }
81597107414Speter
81697107414Speter int
pfi_clear_flags(const char * name,int flags)81797107414Speter pfi_clear_flags(const char *name, int flags)
81897107414Speter {
81997107414Speter struct pfi_kif *p;
82097107414Speter int s;
82197107414Speter
82297107414Speter s = splsoftnet();
82397107414Speter RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
824fff57c55Syamt if (pfi_skip_if(name, p))
82597107414Speter continue;
82697107414Speter p->pfik_flags &= ~flags;
82797107414Speter }
82897107414Speter splx(s);
82997107414Speter return (0);
83097107414Speter }
83197107414Speter
8326adffbf9Sitojun /* from pf_print_state.c */
8336adffbf9Sitojun int
pfi_unmask(void * addr)8346adffbf9Sitojun pfi_unmask(void *addr)
8356adffbf9Sitojun {
8366adffbf9Sitojun struct pf_addr *m = addr;
8376adffbf9Sitojun int i = 31, j = 0, b = 0;
8386adffbf9Sitojun u_int32_t tmp;
8396adffbf9Sitojun
8406adffbf9Sitojun while (j < 4 && m->addr32[j] == 0xffffffff) {
8416adffbf9Sitojun b += 32;
8426adffbf9Sitojun j++;
8436adffbf9Sitojun }
8446adffbf9Sitojun if (j < 4) {
8456adffbf9Sitojun tmp = ntohl(m->addr32[j]);
8466adffbf9Sitojun for (i = 31; tmp & (1 << i); --i)
8476adffbf9Sitojun b++;
8486adffbf9Sitojun }
8496adffbf9Sitojun return (b);
8506adffbf9Sitojun }
8516adffbf9Sitojun
852fff57c55Syamt #ifdef __NetBSD__
853fff57c55Syamt static void
pfi_copy_group(char * dest,const char * src,ssize_t sz)854fff57c55Syamt pfi_copy_group(char *dest, const char *src, ssize_t sz)
8556adffbf9Sitojun {
856fff57c55Syamt while (sz > 1 && *src && !(*src >= '0' && *src <= '9')) {
857fff57c55Syamt *dest++ = *src++;
858fff57c55Syamt sz--;
859fff57c55Syamt }
860fff57c55Syamt if (sz > 0)
861fff57c55Syamt *dest++ = '\0';
862fff57c55Syamt }
863fff57c55Syamt
864fff57c55Syamt void
pfi_init_groups(struct ifnet * ifp)865fff57c55Syamt pfi_init_groups(struct ifnet *ifp)
866fff57c55Syamt {
867fff57c55Syamt char group[IFNAMSIZ];
868fff57c55Syamt
869fff57c55Syamt if_init_groups(ifp);
870fff57c55Syamt if_addgroup(ifp, IFG_ALL);
871fff57c55Syamt
872fff57c55Syamt pfi_copy_group(group, ifp->if_xname, sizeof(group));
873fff57c55Syamt if_addgroup(ifp, group);
874fff57c55Syamt }
875fff57c55Syamt
876fff57c55Syamt void
pfi_destroy_groups(struct ifnet * ifp)877fff57c55Syamt pfi_destroy_groups(struct ifnet *ifp)
878fff57c55Syamt {
879fff57c55Syamt char group[IFNAMSIZ];
880fff57c55Syamt
881fff57c55Syamt pfi_copy_group(group, ifp->if_xname, sizeof(group));
882fff57c55Syamt if_delgroup(ifp, group);
883fff57c55Syamt
884fff57c55Syamt if_delgroup(ifp, IFG_ALL);
885fff57c55Syamt if_destroy_groups(ifp);
8866adffbf9Sitojun }
8876adffbf9Sitojun
88898fd646fSchristos void
pfil_ifnet_wrapper(void * arg,u_long cmd,void * arg2)88998fd646fSchristos pfil_ifnet_wrapper(void *arg, u_long cmd, void *arg2)
8906adffbf9Sitojun {
89198fd646fSchristos ifnet_t *ifp = arg2;
892fff57c55Syamt
893fff57c55Syamt switch (cmd) {
894fff57c55Syamt case PFIL_IFNET_ATTACH:
895fff57c55Syamt pfi_init_groups(ifp);
896fff57c55Syamt
897fff57c55Syamt pfi_attach_ifnet(ifp);
898da186141Syamt break;
899fff57c55Syamt case PFIL_IFNET_DETACH:
900fff57c55Syamt pfi_detach_ifnet(ifp);
901fff57c55Syamt
902fff57c55Syamt pfi_destroy_groups(ifp);
903fff57c55Syamt break;
904fff57c55Syamt default:
905fff57c55Syamt panic("pfil_ifnet_wrapper: unexpected cmd %lu", cmd);
906fff57c55Syamt }
907fff57c55Syamt }
908fff57c55Syamt
90998fd646fSchristos void
pfil_ifaddr_wrapper(void * arg,u_long cmd,void * arg2)91098fd646fSchristos pfil_ifaddr_wrapper(void *arg, u_long cmd, void *arg2)
911fff57c55Syamt {
91298fd646fSchristos struct ifaddr *ifa = arg2;
913fff57c55Syamt
914fff57c55Syamt switch (cmd) {
915fff57c55Syamt case SIOCSIFADDR:
916fff57c55Syamt case SIOCAIFADDR:
917fff57c55Syamt case SIOCDIFADDR:
918da186141Syamt #ifdef INET6
919fff57c55Syamt case SIOCAIFADDR_IN6:
920fff57c55Syamt case SIOCDIFADDR_IN6:
921da186141Syamt #endif /* INET6 */
92298fd646fSchristos pfi_kifaddr_update(ifa->ifa_ifp->if_pf_kif);
923fff57c55Syamt break;
924da186141Syamt default:
925fff57c55Syamt panic("pfil_ifaddr_wrapper: unexpected ioctl %lu", cmd);
926fff57c55Syamt }
9276adffbf9Sitojun }
928fff57c55Syamt #endif /* __NetBSD__ */
929