1/* 2 * Copyright (c) 2007-2011 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29/* $apfw: pf_if.c,v 1.4 2008/08/27 00:01:32 jhw Exp $ */ 30/* $OpenBSD: pf_if.c,v 1.46 2006/12/13 09:01:59 itojun Exp $ */ 31 32/* 33 * Copyright 2005 Henning Brauer <henning@openbsd.org> 34 * Copyright 2005 Ryan McBride <mcbride@openbsd.org> 35 * Copyright (c) 2001 Daniel Hartmeier 36 * Copyright (c) 2003 Cedric Berger 37 * All rights reserved. 38 * 39 * Redistribution and use in source and binary forms, with or without 40 * modification, are permitted provided that the following conditions 41 * are met: 42 * 43 * - Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * - Redistributions in binary form must reproduce the above 46 * copyright notice, this list of conditions and the following 47 * disclaimer in the documentation and/or other materials provided 48 * with the distribution. 49 * 50 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 51 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 52 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 53 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 54 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 55 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 56 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 57 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 58 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 59 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 60 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 61 * POSSIBILITY OF SUCH DAMAGE. 62 */ 63 64#include <sys/param.h> 65#include <sys/systm.h> 66#include <sys/mbuf.h> 67#include <sys/filio.h> 68#include <sys/socket.h> 69#include <sys/socketvar.h> 70#include <sys/kernel.h> 71#include <sys/time.h> 72#include <sys/malloc.h> 73 74#include <net/if.h> 75#include <net/if_types.h> 76#include <net/if_var.h> 77 78#include <netinet/in.h> 79#include <netinet/in_var.h> 80#include <netinet/in_systm.h> 81#include <netinet/ip.h> 82#include <netinet/ip_var.h> 83 84#if INET6 85#include <netinet/ip6.h> 86#endif /* INET6 */ 87 88#include <net/pfvar.h> 89 90struct pfi_kif *pfi_all = NULL; 91 92static struct pool pfi_addr_pl; 93static struct pfi_ifhead pfi_ifs; 94static u_int32_t pfi_update = 1; 95static struct pfr_addr *pfi_buffer; 96static int pfi_buffer_cnt; 97static int pfi_buffer_max; 98 99__private_extern__ void pfi_kifaddr_update(void *); 100 101static void pfi_kif_update(struct pfi_kif *); 102static void pfi_dynaddr_update(struct pfi_dynaddr *dyn); 103static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, int, int); 104static void pfi_instance_add(struct ifnet *, int, int); 105static void pfi_address_add(struct sockaddr *, int, int); 106static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 107static int pfi_skip_if(const char *, struct pfi_kif *); 108static int pfi_unmask(void *); 109 110RB_PROTOTYPE_SC(static, pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 111RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 112 113#define PFI_BUFFER_MAX 0x10000 114#define PFI_MTYPE M_IFADDR 115 116#define IFG_ALL "ALL" 117 118void 119pfi_initialize(void) 120{ 121 if (pfi_all != NULL) /* already initialized */ 122 return; 123 124 pool_init(&pfi_addr_pl, sizeof (struct pfi_dynaddr), 0, 0, 0, 125 "pfiaddrpl", NULL); 126 pfi_buffer_max = 64; 127 pfi_buffer = _MALLOC(pfi_buffer_max * sizeof (*pfi_buffer), 128 PFI_MTYPE, M_WAITOK); 129 130 if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL) 131 panic("pfi_kif_get for pfi_all failed"); 132} 133 134#if 0 135void 136pfi_destroy(void) 137{ 138 pool_destroy(&pfi_addr_pl); 139 _FREE(pfi_buffer, PFI_MTYPE); 140} 141#endif 142 143struct pfi_kif * 144pfi_kif_get(const char *kif_name) 145{ 146 struct pfi_kif *kif; 147 struct pfi_kif_cmp s; 148 149 bzero(&s, sizeof (s)); 150 strlcpy(s.pfik_name, kif_name, sizeof (s.pfik_name)); 151 if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, 152 (struct pfi_kif *)(void *)&s)) != NULL) 153 return (kif); 154 155 /* create new one */ 156 if ((kif = _MALLOC(sizeof (*kif), PFI_MTYPE, M_WAITOK|M_ZERO)) == NULL) 157 return (NULL); 158 159 strlcpy(kif->pfik_name, kif_name, sizeof (kif->pfik_name)); 160 kif->pfik_tzero = pf_calendar_time_second(); 161 TAILQ_INIT(&kif->pfik_dynaddrs); 162 163 RB_INSERT(pfi_ifhead, &pfi_ifs, kif); 164 return (kif); 165} 166 167void 168pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what) 169{ 170 switch (what) { 171 case PFI_KIF_REF_RULE: 172 kif->pfik_rules++; 173 break; 174 case PFI_KIF_REF_STATE: 175 kif->pfik_states++; 176 break; 177 default: 178 panic("pfi_kif_ref with unknown type"); 179 } 180} 181 182void 183pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what) 184{ 185 if (kif == NULL) 186 return; 187 188 switch (what) { 189 case PFI_KIF_REF_NONE: 190 break; 191 case PFI_KIF_REF_RULE: 192 if (kif->pfik_rules <= 0) { 193 printf("pfi_kif_unref: rules refcount <= 0\n"); 194 return; 195 } 196 kif->pfik_rules--; 197 break; 198 case PFI_KIF_REF_STATE: 199 if (kif->pfik_states <= 0) { 200 printf("pfi_kif_unref: state refcount <= 0\n"); 201 return; 202 } 203 kif->pfik_states--; 204 break; 205 default: 206 panic("pfi_kif_unref with unknown type"); 207 } 208 209 if (kif->pfik_ifp != NULL || kif == pfi_all) 210 return; 211 212 if (kif->pfik_rules || kif->pfik_states) 213 return; 214 215 RB_REMOVE(pfi_ifhead, &pfi_ifs, kif); 216 _FREE(kif, PFI_MTYPE); 217} 218 219int 220pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif) 221{ 222 223 if (rule_kif == NULL || rule_kif == packet_kif) 224 return (1); 225 226 return (0); 227} 228 229void 230pfi_attach_ifnet(struct ifnet *ifp) 231{ 232 struct pfi_kif *kif; 233 char if_name[IFNAMSIZ]; 234 235 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 236 237 pfi_update++; 238 (void) snprintf(if_name, sizeof (if_name), "%s%d", 239 ifp->if_name, ifp->if_unit); 240 if ((kif = pfi_kif_get(if_name)) == NULL) 241 panic("pfi_kif_get failed"); 242 243 ifnet_lock_exclusive(ifp); 244 kif->pfik_ifp = ifp; 245 ifp->if_pf_kif = kif; 246 ifnet_lock_done(ifp); 247 248 pfi_kif_update(kif); 249} 250 251/* 252 * Caller holds ifnet lock as writer (exclusive); 253 */ 254void 255pfi_detach_ifnet(struct ifnet *ifp) 256{ 257 struct pfi_kif *kif; 258 259 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 260 261 if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL) 262 return; 263 264 pfi_update++; 265 pfi_kif_update(kif); 266 267 ifnet_lock_exclusive(ifp); 268 kif->pfik_ifp = NULL; 269 ifp->if_pf_kif = NULL; 270 ifnet_lock_done(ifp); 271 272 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 273} 274 275int 276pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 277{ 278 switch (af) { 279#if INET 280 case AF_INET: 281 switch (dyn->pfid_acnt4) { 282 case 0: 283 return (0); 284 case 1: 285 return (PF_MATCHA(0, &dyn->pfid_addr4, 286 &dyn->pfid_mask4, a, AF_INET)); 287 default: 288 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 289 } 290 break; 291#endif /* INET */ 292#if INET6 293 case AF_INET6: 294 switch (dyn->pfid_acnt6) { 295 case 0: 296 return (0); 297 case 1: 298 return (PF_MATCHA(0, &dyn->pfid_addr6, 299 &dyn->pfid_mask6, a, AF_INET6)); 300 default: 301 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 302 } 303 break; 304#endif /* INET6 */ 305 default: 306 return (0); 307 } 308} 309 310int 311pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 312{ 313 struct pfi_dynaddr *dyn; 314 char tblname[PF_TABLE_NAME_SIZE]; 315 struct pf_ruleset *ruleset = NULL; 316 int rv = 0; 317 318 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 319 320 if (aw->type != PF_ADDR_DYNIFTL) 321 return (0); 322 if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK)) == NULL) 323 return (1); 324 bzero(dyn, sizeof (*dyn)); 325 326 if (strcmp(aw->v.ifname, "self") == 0) 327 dyn->pfid_kif = pfi_kif_get(IFG_ALL); 328 else 329 dyn->pfid_kif = pfi_kif_get(aw->v.ifname); 330 if (dyn->pfid_kif == NULL) { 331 rv = 1; 332 goto _bad; 333 } 334 pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE); 335 336 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 337 if (af == AF_INET && dyn->pfid_net == 32) 338 dyn->pfid_net = 128; 339 strlcpy(tblname, aw->v.ifname, sizeof (tblname)); 340 if (aw->iflags & PFI_AFLAG_NETWORK) 341 strlcat(tblname, ":network", sizeof (tblname)); 342 if (aw->iflags & PFI_AFLAG_BROADCAST) 343 strlcat(tblname, ":broadcast", sizeof (tblname)); 344 if (aw->iflags & PFI_AFLAG_PEER) 345 strlcat(tblname, ":peer", sizeof (tblname)); 346 if (aw->iflags & PFI_AFLAG_NOALIAS) 347 strlcat(tblname, ":0", sizeof (tblname)); 348 if (dyn->pfid_net != 128) 349 snprintf(tblname + strlen(tblname), 350 sizeof (tblname) - strlen(tblname), "/%d", dyn->pfid_net); 351 if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) { 352 rv = 1; 353 goto _bad; 354 } 355 356 if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) { 357 rv = 1; 358 goto _bad; 359 } 360 361 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 362 dyn->pfid_iflags = aw->iflags; 363 dyn->pfid_af = af; 364 365 TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); 366 aw->p.dyn = dyn; 367 pfi_kif_update(dyn->pfid_kif); 368 return (0); 369 370_bad: 371 if (dyn->pfid_kt != NULL) 372 pfr_detach_table(dyn->pfid_kt); 373 if (ruleset != NULL) 374 pf_remove_if_empty_ruleset(ruleset); 375 if (dyn->pfid_kif != NULL) 376 pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE); 377 pool_put(&pfi_addr_pl, dyn); 378 return (rv); 379} 380 381void 382pfi_kif_update(struct pfi_kif *kif) 383{ 384 struct pfi_dynaddr *p; 385 386 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 387 388 /* update all dynaddr */ 389 TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) 390 pfi_dynaddr_update(p); 391} 392 393void 394pfi_dynaddr_update(struct pfi_dynaddr *dyn) 395{ 396 struct pfi_kif *kif; 397 struct pfr_ktable *kt; 398 399 if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL) 400 panic("pfi_dynaddr_update"); 401 402 kif = dyn->pfid_kif; 403 kt = dyn->pfid_kt; 404 405 if (kt->pfrkt_larg != pfi_update) { 406 /* this table needs to be brought up-to-date */ 407 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 408 kt->pfrkt_larg = pfi_update; 409 } 410 pfr_dynaddr_update(kt, dyn); 411} 412 413void 414pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 415{ 416 int e, size2 = 0; 417 418 pfi_buffer_cnt = 0; 419 420 if (kif->pfik_ifp != NULL) 421 pfi_instance_add(kif->pfik_ifp, net, flags); 422 423 if ((e = pfr_set_addrs(&kt->pfrkt_t, CAST_USER_ADDR_T(pfi_buffer), 424 pfi_buffer_cnt, &size2, NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) 425 printf("pfi_table_update: cannot set %d new addresses " 426 "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e); 427} 428 429void 430pfi_instance_add(struct ifnet *ifp, int net, int flags) 431{ 432 struct ifaddr *ia; 433 int got4 = 0, got6 = 0; 434 int net2, af; 435 436 if (ifp == NULL) 437 return; 438 ifnet_lock_shared(ifp); 439 TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) { 440 IFA_LOCK(ia); 441 if (ia->ifa_addr == NULL) { 442 IFA_UNLOCK(ia); 443 continue; 444 } 445 af = ia->ifa_addr->sa_family; 446 if (af != AF_INET && af != AF_INET6) { 447 IFA_UNLOCK(ia); 448 continue; 449 } 450 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) { 451 IFA_UNLOCK(ia); 452 continue; 453 } 454 if ((flags & PFI_AFLAG_BROADCAST) && 455 !(ifp->if_flags & IFF_BROADCAST)) { 456 IFA_UNLOCK(ia); 457 continue; 458 } 459 if ((flags & PFI_AFLAG_PEER) && 460 !(ifp->if_flags & IFF_POINTOPOINT)) { 461 IFA_UNLOCK(ia); 462 continue; 463 } 464 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 465 IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *) 466 (void *)ia->ifa_addr)->sin6_addr)) { 467 IFA_UNLOCK(ia); 468 continue; 469 } 470 if (flags & PFI_AFLAG_NOALIAS) { 471 if (af == AF_INET && got4) { 472 IFA_UNLOCK(ia); 473 continue; 474 } 475 if (af == AF_INET6 && got6) { 476 IFA_UNLOCK(ia); 477 continue; 478 } 479 } 480 if (af == AF_INET) 481 got4 = 1; 482 else if (af == AF_INET6) 483 got6 = 1; 484 net2 = net; 485 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 486 if (af == AF_INET) 487 net2 = pfi_unmask(&((struct sockaddr_in *) 488 (void *)ia->ifa_netmask)->sin_addr); 489 else if (af == AF_INET6) 490 net2 = pfi_unmask(&((struct sockaddr_in6 *) 491 (void *)ia->ifa_netmask)->sin6_addr); 492 } 493 if (af == AF_INET && net2 > 32) 494 net2 = 32; 495 if (flags & PFI_AFLAG_BROADCAST) 496 pfi_address_add(ia->ifa_broadaddr, af, net2); 497 else if (flags & PFI_AFLAG_PEER) 498 pfi_address_add(ia->ifa_dstaddr, af, net2); 499 else 500 pfi_address_add(ia->ifa_addr, af, net2); 501 IFA_UNLOCK(ia); 502 } 503 ifnet_lock_done(ifp); 504} 505 506void 507pfi_address_add(struct sockaddr *sa, int af, int net) 508{ 509 struct pfr_addr *p; 510 int i; 511 512 if (pfi_buffer_cnt >= pfi_buffer_max) { 513 int new_max = pfi_buffer_max * 2; 514 515 if (new_max > PFI_BUFFER_MAX) { 516 printf("pfi_address_add: address buffer full (%d/%d)\n", 517 pfi_buffer_cnt, PFI_BUFFER_MAX); 518 return; 519 } 520 p = _MALLOC(new_max * sizeof (*pfi_buffer), PFI_MTYPE, 521 M_WAITOK); 522 if (p == NULL) { 523 printf("pfi_address_add: no memory to grow buffer " 524 "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX); 525 return; 526 } 527 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof (*pfi_buffer)); 528 /* no need to zero buffer */ 529 _FREE(pfi_buffer, PFI_MTYPE); 530 pfi_buffer = p; 531 pfi_buffer_max = new_max; 532 } 533 if (af == AF_INET && net > 32) 534 net = 128; 535 p = pfi_buffer + pfi_buffer_cnt++; 536 bzero(p, sizeof (*p)); 537 p->pfra_af = af; 538 p->pfra_net = net; 539 if (af == AF_INET) 540 p->pfra_ip4addr = ((struct sockaddr_in *)(void *)sa)->sin_addr; 541 else if (af == AF_INET6) { 542 p->pfra_ip6addr = 543 ((struct sockaddr_in6 *)(void *)sa)->sin6_addr; 544 if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) 545 p->pfra_ip6addr.s6_addr16[1] = 0; 546 } 547 /* mask network address bits */ 548 if (net < 128) 549 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 550 for (i = (p->pfra_net+7)/8; i < (int)sizeof (p->pfra_u); i++) 551 ((caddr_t)p)[i] = 0; 552} 553 554void 555pfi_dynaddr_remove(struct pf_addr_wrap *aw) 556{ 557 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 558 aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL) 559 return; 560 561 TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry); 562 pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE); 563 aw->p.dyn->pfid_kif = NULL; 564 pfr_detach_table(aw->p.dyn->pfid_kt); 565 aw->p.dyn->pfid_kt = NULL; 566 pool_put(&pfi_addr_pl, aw->p.dyn); 567 aw->p.dyn = NULL; 568} 569 570void 571pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 572{ 573 if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL || 574 aw->p.dyn->pfid_kif == NULL) 575 return; 576 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 577} 578 579void 580pfi_kifaddr_update(void *v) 581{ 582 struct pfi_kif *kif = (struct pfi_kif *)v; 583 584 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 585 586 pfi_update++; 587 pfi_kif_update(kif); 588} 589 590int 591pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 592{ 593 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 594} 595 596void 597pfi_update_status(const char *name, struct pf_status *pfs) 598{ 599 struct pfi_kif *p; 600 struct pfi_kif_cmp key; 601 int i, j, k; 602 603 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 604 605 strlcpy(key.pfik_name, name, sizeof (key.pfik_name)); 606 p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)(void *)&key); 607 if (p == NULL) 608 return; 609 610 if (pfs) { 611 bzero(pfs->pcounters, sizeof (pfs->pcounters)); 612 bzero(pfs->bcounters, sizeof (pfs->bcounters)); 613 } 614 /* just clear statistics */ 615 if (pfs == NULL) { 616 bzero(p->pfik_packets, sizeof (p->pfik_packets)); 617 bzero(p->pfik_bytes, sizeof (p->pfik_bytes)); 618 p->pfik_tzero = pf_calendar_time_second(); 619 } 620 for (i = 0; i < 2; i++) 621 for (j = 0; j < 2; j++) 622 for (k = 0; k < 2; k++) { 623 pfs->pcounters[i][j][k] += 624 p->pfik_packets[i][j][k]; 625 pfs->bcounters[i][j] += 626 p->pfik_bytes[i][j][k]; 627 } 628} 629 630int 631pfi_get_ifaces(const char *name, user_addr_t buf, int *size) 632{ 633 struct pfi_kif *p, *nextp; 634 int n = 0; 635 636 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 637 638 for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) { 639 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); 640 if (pfi_skip_if(name, p)) 641 continue; 642 if (*size > n++) { 643 struct pfi_uif u; 644 645 if (!p->pfik_tzero) 646 p->pfik_tzero = pf_calendar_time_second(); 647 pfi_kif_ref(p, PFI_KIF_REF_RULE); 648 649 /* return the user space version of pfi_kif */ 650 bzero(&u, sizeof (u)); 651 bcopy(p->pfik_name, &u.pfik_name, sizeof (u.pfik_name)); 652 bcopy(p->pfik_packets, &u.pfik_packets, 653 sizeof (u.pfik_packets)); 654 bcopy(p->pfik_bytes, &u.pfik_bytes, 655 sizeof (u.pfik_bytes)); 656 u.pfik_tzero = p->pfik_tzero; 657 u.pfik_flags = p->pfik_flags; 658 u.pfik_states = p->pfik_states; 659 u.pfik_rules = p->pfik_rules; 660 661 if (copyout(&u, buf, sizeof (u))) { 662 pfi_kif_unref(p, PFI_KIF_REF_RULE); 663 return (EFAULT); 664 } 665 buf += sizeof (u); 666 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p); 667 pfi_kif_unref(p, PFI_KIF_REF_RULE); 668 } 669 } 670 *size = n; 671 return (0); 672} 673 674int 675pfi_skip_if(const char *filter, struct pfi_kif *p) 676{ 677 int n; 678 679 if (filter == NULL || !*filter) 680 return (0); 681 if (strcmp(p->pfik_name, filter) == 0) 682 return (0); /* exact match */ 683 n = strlen(filter); 684 if (n < 1 || n >= IFNAMSIZ) 685 return (1); /* sanity check */ 686 if (filter[n-1] >= '0' && filter[n-1] <= '9') 687 return (1); /* only do exact match in that case */ 688 if (strncmp(p->pfik_name, filter, n)) 689 return (1); /* prefix doesn't match */ 690 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 691} 692 693int 694pfi_set_flags(const char *name, int flags) 695{ 696 struct pfi_kif *p; 697 698 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 699 700 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 701 if (pfi_skip_if(name, p)) 702 continue; 703 p->pfik_flags |= flags; 704 } 705 return (0); 706} 707 708int 709pfi_clear_flags(const char *name, int flags) 710{ 711 struct pfi_kif *p; 712 713 lck_mtx_assert(pf_lock, LCK_MTX_ASSERT_OWNED); 714 715 RB_FOREACH(p, pfi_ifhead, &pfi_ifs) { 716 if (pfi_skip_if(name, p)) 717 continue; 718 p->pfik_flags &= ~flags; 719 } 720 return (0); 721} 722 723/* from pf_print_state.c */ 724int 725pfi_unmask(void *addr) 726{ 727 struct pf_addr *m = addr; 728 int i = 31, j = 0, b = 0; 729 u_int32_t tmp; 730 731 while (j < 4 && m->addr32[j] == 0xffffffff) { 732 b += 32; 733 j++; 734 } 735 if (j < 4) { 736 tmp = ntohl(m->addr32[j]); 737 for (i = 31; tmp & (1 << i); --i) 738 b++; 739 } 740 return (b); 741} 742