pf_if.c revision 287207
1/*- 2 * Copyright (c) 2001 Daniel Hartmeier 3 * Copyright (c) 2003 Cedric Berger 4 * Copyright (c) 2005 Henning Brauer <henning@openbsd.org> 5 * Copyright (c) 2005 Ryan McBride <mcbride@openbsd.org> 6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * - Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * - Redistributions in binary form must reproduce the above 16 * copyright notice, this list of conditions and the following 17 * disclaimer in the documentation and/or other materials provided 18 * with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 * 33 * $OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $ 34 */ 35 36#include <sys/cdefs.h> 37__FBSDID("$FreeBSD: stable/10/sys/netpfil/pf/pf_if.c 287207 2015-08-27 14:07:28Z loos $"); 38 39#include "opt_inet.h" 40#include "opt_inet6.h" 41 42#include <sys/param.h> 43#include <sys/kernel.h> 44#include <sys/socket.h> 45 46#include <net/if.h> 47#include <net/pfvar.h> 48#include <net/route.h> 49 50VNET_DEFINE(struct pfi_kif *, pfi_all); 51static VNET_DEFINE(long, pfi_update); 52#define V_pfi_update VNET(pfi_update) 53#define PFI_BUFFER_MAX 0x10000 54 55static VNET_DEFINE(struct pfr_addr *, pfi_buffer); 56static VNET_DEFINE(int, pfi_buffer_cnt); 57static VNET_DEFINE(int, pfi_buffer_max); 58#define V_pfi_buffer VNET(pfi_buffer) 59#define V_pfi_buffer_cnt VNET(pfi_buffer_cnt) 60#define V_pfi_buffer_max VNET(pfi_buffer_max) 61 62eventhandler_tag pfi_attach_cookie; 63eventhandler_tag pfi_detach_cookie; 64eventhandler_tag pfi_attach_group_cookie; 65eventhandler_tag pfi_change_group_cookie; 66eventhandler_tag pfi_detach_group_cookie; 67eventhandler_tag pfi_ifaddr_event_cookie; 68 69static void pfi_attach_ifnet(struct ifnet *); 70static void pfi_attach_ifgroup(struct ifg_group *); 71 72static void pfi_kif_update(struct pfi_kif *); 73static void pfi_dynaddr_update(struct pfi_dynaddr *dyn); 74static void pfi_table_update(struct pfr_ktable *, struct pfi_kif *, int, 75 int); 76static void pfi_instance_add(struct ifnet *, int, int); 77static void pfi_address_add(struct sockaddr *, int, int); 78static int pfi_if_compare(struct pfi_kif *, struct pfi_kif *); 79static int pfi_skip_if(const char *, struct pfi_kif *); 80static int pfi_unmask(void *); 81static void pfi_attach_ifnet_event(void * __unused, struct ifnet *); 82static void pfi_detach_ifnet_event(void * __unused, struct ifnet *); 83static void pfi_attach_group_event(void *, struct ifg_group *); 84static void pfi_change_group_event(void *, char *); 85static void pfi_detach_group_event(void *, struct ifg_group *); 86static void pfi_ifaddr_event(void * __unused, struct ifnet *); 87 88RB_HEAD(pfi_ifhead, pfi_kif); 89static RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 90static RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare); 91static VNET_DEFINE(struct pfi_ifhead, pfi_ifs); 92#define V_pfi_ifs VNET(pfi_ifs) 93 94#define PFI_BUFFER_MAX 0x10000 95MALLOC_DEFINE(PFI_MTYPE, "pf_ifnet", "pf(4) interface database"); 96 97LIST_HEAD(pfi_list, pfi_kif); 98static VNET_DEFINE(struct pfi_list, pfi_unlinked_kifs); 99#define V_pfi_unlinked_kifs VNET(pfi_unlinked_kifs) 100static struct mtx pfi_unlnkdkifs_mtx; 101 102void 103pfi_initialize(void) 104{ 105 struct ifg_group *ifg; 106 struct ifnet *ifp; 107 struct pfi_kif *kif; 108 109 V_pfi_buffer_max = 64; 110 V_pfi_buffer = malloc(V_pfi_buffer_max * sizeof(*V_pfi_buffer), 111 PFI_MTYPE, M_WAITOK); 112 113 mtx_init(&pfi_unlnkdkifs_mtx, "pf unlinked interfaces", NULL, MTX_DEF); 114 115 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 116 PF_RULES_WLOCK(); 117 V_pfi_all = pfi_kif_attach(kif, IFG_ALL); 118 PF_RULES_WUNLOCK(); 119 120 IFNET_RLOCK(); 121 TAILQ_FOREACH(ifg, &V_ifg_head, ifg_next) 122 pfi_attach_ifgroup(ifg); 123 TAILQ_FOREACH(ifp, &V_ifnet, if_link) 124 pfi_attach_ifnet(ifp); 125 IFNET_RUNLOCK(); 126 127 pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_arrival_event, 128 pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY); 129 pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_departure_event, 130 pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY); 131 pfi_attach_group_cookie = EVENTHANDLER_REGISTER(group_attach_event, 132 pfi_attach_group_event, curvnet, EVENTHANDLER_PRI_ANY); 133 pfi_change_group_cookie = EVENTHANDLER_REGISTER(group_change_event, 134 pfi_change_group_event, curvnet, EVENTHANDLER_PRI_ANY); 135 pfi_detach_group_cookie = EVENTHANDLER_REGISTER(group_detach_event, 136 pfi_detach_group_event, curvnet, EVENTHANDLER_PRI_ANY); 137 pfi_ifaddr_event_cookie = EVENTHANDLER_REGISTER(ifaddr_event, 138 pfi_ifaddr_event, NULL, EVENTHANDLER_PRI_ANY); 139} 140 141void 142pfi_cleanup(void) 143{ 144 struct pfi_kif *p; 145 146 EVENTHANDLER_DEREGISTER(ifnet_arrival_event, pfi_attach_cookie); 147 EVENTHANDLER_DEREGISTER(ifnet_departure_event, pfi_detach_cookie); 148 EVENTHANDLER_DEREGISTER(group_attach_event, pfi_attach_group_cookie); 149 EVENTHANDLER_DEREGISTER(group_change_event, pfi_change_group_cookie); 150 EVENTHANDLER_DEREGISTER(group_detach_event, pfi_detach_group_cookie); 151 EVENTHANDLER_DEREGISTER(ifaddr_event, pfi_ifaddr_event_cookie); 152 153 V_pfi_all = NULL; 154 while ((p = RB_MIN(pfi_ifhead, &V_pfi_ifs))) { 155 RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p); 156 free(p, PFI_MTYPE); 157 } 158 159 while ((p = LIST_FIRST(&V_pfi_unlinked_kifs))) { 160 LIST_REMOVE(p, pfik_list); 161 free(p, PFI_MTYPE); 162 } 163 164 mtx_destroy(&pfi_unlnkdkifs_mtx); 165 166 free(V_pfi_buffer, PFI_MTYPE); 167} 168 169struct pfi_kif * 170pfi_kif_find(const char *kif_name) 171{ 172 struct pfi_kif_cmp s; 173 174 PF_RULES_ASSERT(); 175 176 bzero(&s, sizeof(s)); 177 strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name)); 178 179 return (RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&s)); 180} 181 182struct pfi_kif * 183pfi_kif_attach(struct pfi_kif *kif, const char *kif_name) 184{ 185 struct pfi_kif *kif1; 186 187 PF_RULES_WASSERT(); 188 KASSERT(kif != NULL, ("%s: null kif", __func__)); 189 190 kif1 = pfi_kif_find(kif_name); 191 if (kif1 != NULL) { 192 free(kif, PFI_MTYPE); 193 return (kif1); 194 } 195 196 bzero(kif, sizeof(*kif)); 197 strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name)); 198 /* 199 * It seems that the value of time_second is in unintialzied state 200 * when pf sets interface statistics clear time in boot phase if pf 201 * was statically linked to kernel. Instead of setting the bogus 202 * time value have pfi_get_ifaces handle this case. In 203 * pfi_get_ifaces it uses time_second if it sees the time is 0. 204 */ 205 kif->pfik_tzero = time_second > 1 ? time_second : 0; 206 TAILQ_INIT(&kif->pfik_dynaddrs); 207 208 RB_INSERT(pfi_ifhead, &V_pfi_ifs, kif); 209 210 return (kif); 211} 212 213void 214pfi_kif_ref(struct pfi_kif *kif) 215{ 216 217 PF_RULES_WASSERT(); 218 kif->pfik_rulerefs++; 219} 220 221void 222pfi_kif_unref(struct pfi_kif *kif) 223{ 224 225 PF_RULES_WASSERT(); 226 KASSERT(kif->pfik_rulerefs > 0, ("%s: %p has zero refs", __func__, kif)); 227 228 kif->pfik_rulerefs--; 229 230 if (kif->pfik_rulerefs > 0) 231 return; 232 233 /* kif referencing an existing ifnet or group should exist. */ 234 if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all) 235 return; 236 237 RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif); 238 239 kif->pfik_flags |= PFI_IFLAG_REFS; 240 241 mtx_lock(&pfi_unlnkdkifs_mtx); 242 LIST_INSERT_HEAD(&V_pfi_unlinked_kifs, kif, pfik_list); 243 mtx_unlock(&pfi_unlnkdkifs_mtx); 244} 245 246void 247pfi_kif_purge(void) 248{ 249 struct pfi_kif *kif, *kif1; 250 251 /* 252 * Do naive mark-and-sweep garbage collecting of old kifs. 253 * Reference flag is raised by pf_purge_expired_states(). 254 */ 255 mtx_lock(&pfi_unlnkdkifs_mtx); 256 LIST_FOREACH_SAFE(kif, &V_pfi_unlinked_kifs, pfik_list, kif1) { 257 if (!(kif->pfik_flags & PFI_IFLAG_REFS)) { 258 LIST_REMOVE(kif, pfik_list); 259 free(kif, PFI_MTYPE); 260 } else 261 kif->pfik_flags &= ~PFI_IFLAG_REFS; 262 } 263 mtx_unlock(&pfi_unlnkdkifs_mtx); 264} 265 266int 267pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif) 268{ 269 struct ifg_list *p; 270 271 if (rule_kif == NULL || rule_kif == packet_kif) 272 return (1); 273 274 if (rule_kif->pfik_group != NULL) 275 /* XXXGL: locking? */ 276 TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next) 277 if (p->ifgl_group == rule_kif->pfik_group) 278 return (1); 279 280 return (0); 281} 282 283static void 284pfi_attach_ifnet(struct ifnet *ifp) 285{ 286 struct pfi_kif *kif; 287 288 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 289 290 PF_RULES_WLOCK(); 291 V_pfi_update++; 292 kif = pfi_kif_attach(kif, ifp->if_xname); 293 294 kif->pfik_ifp = ifp; 295 ifp->if_pf_kif = kif; 296 297 pfi_kif_update(kif); 298 PF_RULES_WUNLOCK(); 299} 300 301static void 302pfi_attach_ifgroup(struct ifg_group *ifg) 303{ 304 struct pfi_kif *kif; 305 306 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 307 308 PF_RULES_WLOCK(); 309 V_pfi_update++; 310 kif = pfi_kif_attach(kif, ifg->ifg_group); 311 312 kif->pfik_group = ifg; 313 ifg->ifg_pf_kif = kif; 314 PF_RULES_WUNLOCK(); 315} 316 317int 318pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af) 319{ 320 switch (af) { 321#ifdef INET 322 case AF_INET: 323 switch (dyn->pfid_acnt4) { 324 case 0: 325 return (0); 326 case 1: 327 return (PF_MATCHA(0, &dyn->pfid_addr4, 328 &dyn->pfid_mask4, a, AF_INET)); 329 default: 330 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET)); 331 } 332 break; 333#endif /* INET */ 334#ifdef INET6 335 case AF_INET6: 336 switch (dyn->pfid_acnt6) { 337 case 0: 338 return (0); 339 case 1: 340 return (PF_MATCHA(0, &dyn->pfid_addr6, 341 &dyn->pfid_mask6, a, AF_INET6)); 342 default: 343 return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6)); 344 } 345 break; 346#endif /* INET6 */ 347 default: 348 return (0); 349 } 350} 351 352int 353pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af) 354{ 355 struct pfi_dynaddr *dyn; 356 char tblname[PF_TABLE_NAME_SIZE]; 357 struct pf_ruleset *ruleset = NULL; 358 struct pfi_kif *kif; 359 int rv = 0; 360 361 PF_RULES_WASSERT(); 362 KASSERT(aw->type == PF_ADDR_DYNIFTL, ("%s: type %u", 363 __func__, aw->type)); 364 KASSERT(aw->p.dyn == NULL, ("%s: dyn is %p", __func__, aw->p.dyn)); 365 366 if ((dyn = malloc(sizeof(*dyn), PFI_MTYPE, M_NOWAIT | M_ZERO)) == NULL) 367 return (ENOMEM); 368 369 if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_NOWAIT)) == NULL) { 370 free(dyn, PFI_MTYPE); 371 return (ENOMEM); 372 } 373 374 if (!strcmp(aw->v.ifname, "self")) 375 dyn->pfid_kif = pfi_kif_attach(kif, IFG_ALL); 376 else 377 dyn->pfid_kif = pfi_kif_attach(kif, aw->v.ifname); 378 pfi_kif_ref(dyn->pfid_kif); 379 380 dyn->pfid_net = pfi_unmask(&aw->v.a.mask); 381 if (af == AF_INET && dyn->pfid_net == 32) 382 dyn->pfid_net = 128; 383 strlcpy(tblname, aw->v.ifname, sizeof(tblname)); 384 if (aw->iflags & PFI_AFLAG_NETWORK) 385 strlcat(tblname, ":network", sizeof(tblname)); 386 if (aw->iflags & PFI_AFLAG_BROADCAST) 387 strlcat(tblname, ":broadcast", sizeof(tblname)); 388 if (aw->iflags & PFI_AFLAG_PEER) 389 strlcat(tblname, ":peer", sizeof(tblname)); 390 if (aw->iflags & PFI_AFLAG_NOALIAS) 391 strlcat(tblname, ":0", sizeof(tblname)); 392 if (dyn->pfid_net != 128) 393 snprintf(tblname + strlen(tblname), 394 sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net); 395 if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) { 396 rv = ENOMEM; 397 goto _bad; 398 } 399 400 if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname)) == NULL) { 401 rv = ENOMEM; 402 goto _bad; 403 } 404 405 dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE; 406 dyn->pfid_iflags = aw->iflags; 407 dyn->pfid_af = af; 408 409 TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); 410 aw->p.dyn = dyn; 411 pfi_kif_update(dyn->pfid_kif); 412 413 return (0); 414 415_bad: 416 if (dyn->pfid_kt != NULL) 417 pfr_detach_table(dyn->pfid_kt); 418 if (ruleset != NULL) 419 pf_remove_if_empty_ruleset(ruleset); 420 if (dyn->pfid_kif != NULL) 421 pfi_kif_unref(dyn->pfid_kif); 422 free(dyn, PFI_MTYPE); 423 424 return (rv); 425} 426 427static void 428pfi_kif_update(struct pfi_kif *kif) 429{ 430 struct ifg_list *ifgl; 431 struct pfi_dynaddr *p; 432 433 PF_RULES_WASSERT(); 434 435 /* update all dynaddr */ 436 TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry) 437 pfi_dynaddr_update(p); 438 439 /* again for all groups kif is member of */ 440 if (kif->pfik_ifp != NULL) { 441 IF_ADDR_RLOCK(kif->pfik_ifp); 442 TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next) 443 pfi_kif_update((struct pfi_kif *) 444 ifgl->ifgl_group->ifg_pf_kif); 445 IF_ADDR_RUNLOCK(kif->pfik_ifp); 446 } 447} 448 449static void 450pfi_dynaddr_update(struct pfi_dynaddr *dyn) 451{ 452 struct pfi_kif *kif; 453 struct pfr_ktable *kt; 454 455 PF_RULES_WASSERT(); 456 KASSERT(dyn && dyn->pfid_kif && dyn->pfid_kt, 457 ("%s: bad argument", __func__)); 458 459 kif = dyn->pfid_kif; 460 kt = dyn->pfid_kt; 461 462 if (kt->pfrkt_larg != V_pfi_update) { 463 /* this table needs to be brought up-to-date */ 464 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags); 465 kt->pfrkt_larg = V_pfi_update; 466 } 467 pfr_dynaddr_update(kt, dyn); 468} 469 470static void 471pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags) 472{ 473 int e, size2 = 0; 474 struct ifg_member *ifgm; 475 476 V_pfi_buffer_cnt = 0; 477 478 if (kif->pfik_ifp != NULL) 479 pfi_instance_add(kif->pfik_ifp, net, flags); 480 else if (kif->pfik_group != NULL) { 481 IFNET_RLOCK_NOSLEEP(); 482 TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next) 483 pfi_instance_add(ifgm->ifgm_ifp, net, flags); 484 IFNET_RUNLOCK_NOSLEEP(); 485 } 486 487 if ((e = pfr_set_addrs(&kt->pfrkt_t, V_pfi_buffer, V_pfi_buffer_cnt, &size2, 488 NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK))) 489 printf("%s: cannot set %d new addresses into table %s: %d\n", 490 __func__, V_pfi_buffer_cnt, kt->pfrkt_name, e); 491} 492 493static void 494pfi_instance_add(struct ifnet *ifp, int net, int flags) 495{ 496 struct ifaddr *ia; 497 int got4 = 0, got6 = 0; 498 int net2, af; 499 500 IF_ADDR_RLOCK(ifp); 501 TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_list) { 502 if (ia->ifa_addr == NULL) 503 continue; 504 af = ia->ifa_addr->sa_family; 505 if (af != AF_INET && af != AF_INET6) 506 continue; 507 /* 508 * XXX: For point-to-point interfaces, (ifname:0) and IPv4, 509 * jump over addresses without a proper route to work 510 * around a problem with ppp not fully removing the 511 * address used during IPCP. 512 */ 513 if ((ifp->if_flags & IFF_POINTOPOINT) && 514 !(ia->ifa_flags & IFA_ROUTE) && 515 (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET)) 516 continue; 517 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6) 518 continue; 519 if ((flags & PFI_AFLAG_BROADCAST) && 520 !(ifp->if_flags & IFF_BROADCAST)) 521 continue; 522 if ((flags & PFI_AFLAG_PEER) && 523 !(ifp->if_flags & IFF_POINTOPOINT)) 524 continue; 525 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && 526 IN6_IS_ADDR_LINKLOCAL( 527 &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) 528 continue; 529 if (flags & PFI_AFLAG_NOALIAS) { 530 if (af == AF_INET && got4) 531 continue; 532 if (af == AF_INET6 && got6) 533 continue; 534 } 535 if (af == AF_INET) 536 got4 = 1; 537 else if (af == AF_INET6) 538 got6 = 1; 539 net2 = net; 540 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) { 541 if (af == AF_INET) 542 net2 = pfi_unmask(&((struct sockaddr_in *) 543 ia->ifa_netmask)->sin_addr); 544 else if (af == AF_INET6) 545 net2 = pfi_unmask(&((struct sockaddr_in6 *) 546 ia->ifa_netmask)->sin6_addr); 547 } 548 if (af == AF_INET && net2 > 32) 549 net2 = 32; 550 if (flags & PFI_AFLAG_BROADCAST) 551 pfi_address_add(ia->ifa_broadaddr, af, net2); 552 else if (flags & PFI_AFLAG_PEER) 553 pfi_address_add(ia->ifa_dstaddr, af, net2); 554 else 555 pfi_address_add(ia->ifa_addr, af, net2); 556 } 557 IF_ADDR_RUNLOCK(ifp); 558} 559 560static void 561pfi_address_add(struct sockaddr *sa, int af, int net) 562{ 563 struct pfr_addr *p; 564 int i; 565 566 if (V_pfi_buffer_cnt >= V_pfi_buffer_max) { 567 int new_max = V_pfi_buffer_max * 2; 568 569 if (new_max > PFI_BUFFER_MAX) { 570 printf("%s: address buffer full (%d/%d)\n", __func__, 571 V_pfi_buffer_cnt, PFI_BUFFER_MAX); 572 return; 573 } 574 p = malloc(new_max * sizeof(*V_pfi_buffer), PFI_MTYPE, 575 M_NOWAIT); 576 if (p == NULL) { 577 printf("%s: no memory to grow buffer (%d/%d)\n", 578 __func__, V_pfi_buffer_cnt, PFI_BUFFER_MAX); 579 return; 580 } 581 memcpy(p, V_pfi_buffer, V_pfi_buffer_max * sizeof(*V_pfi_buffer)); 582 /* no need to zero buffer */ 583 free(V_pfi_buffer, PFI_MTYPE); 584 V_pfi_buffer = p; 585 V_pfi_buffer_max = new_max; 586 } 587 if (af == AF_INET && net > 32) 588 net = 128; 589 p = V_pfi_buffer + V_pfi_buffer_cnt++; 590 bzero(p, sizeof(*p)); 591 p->pfra_af = af; 592 p->pfra_net = net; 593 if (af == AF_INET) 594 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr; 595 else if (af == AF_INET6) { 596 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr; 597 if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr)) 598 p->pfra_ip6addr.s6_addr16[1] = 0; 599 } 600 /* mask network address bits */ 601 if (net < 128) 602 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8)); 603 for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++) 604 ((caddr_t)p)[i] = 0; 605} 606 607void 608pfi_dynaddr_remove(struct pfi_dynaddr *dyn) 609{ 610 611 KASSERT(dyn->pfid_kif != NULL, ("%s: null pfid_kif", __func__)); 612 KASSERT(dyn->pfid_kt != NULL, ("%s: null pfid_kt", __func__)); 613 614 TAILQ_REMOVE(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry); 615 pfi_kif_unref(dyn->pfid_kif); 616 pfr_detach_table(dyn->pfid_kt); 617 free(dyn, PFI_MTYPE); 618} 619 620void 621pfi_dynaddr_copyout(struct pf_addr_wrap *aw) 622{ 623 624 KASSERT(aw->type == PF_ADDR_DYNIFTL, 625 ("%s: type %u", __func__, aw->type)); 626 627 if (aw->p.dyn == NULL || aw->p.dyn->pfid_kif == NULL) 628 return; 629 aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6; 630} 631 632static int 633pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q) 634{ 635 return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ)); 636} 637 638void 639pfi_update_status(const char *name, struct pf_status *pfs) 640{ 641 struct pfi_kif *p; 642 struct pfi_kif_cmp key; 643 struct ifg_member p_member, *ifgm; 644 TAILQ_HEAD(, ifg_member) ifg_members; 645 int i, j, k; 646 647 strlcpy(key.pfik_name, name, sizeof(key.pfik_name)); 648 p = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&key); 649 if (p == NULL) 650 return; 651 652 if (p->pfik_group != NULL) { 653 bcopy(&p->pfik_group->ifg_members, &ifg_members, 654 sizeof(ifg_members)); 655 } else { 656 /* build a temporary list for p only */ 657 bzero(&p_member, sizeof(p_member)); 658 p_member.ifgm_ifp = p->pfik_ifp; 659 TAILQ_INIT(&ifg_members); 660 TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next); 661 } 662 if (pfs) { 663 bzero(pfs->pcounters, sizeof(pfs->pcounters)); 664 bzero(pfs->bcounters, sizeof(pfs->bcounters)); 665 } 666 TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) { 667 if (ifgm->ifgm_ifp == NULL) 668 continue; 669 p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif; 670 671 /* just clear statistics */ 672 if (pfs == NULL) { 673 bzero(p->pfik_packets, sizeof(p->pfik_packets)); 674 bzero(p->pfik_bytes, sizeof(p->pfik_bytes)); 675 p->pfik_tzero = time_second; 676 continue; 677 } 678 for (i = 0; i < 2; i++) 679 for (j = 0; j < 2; j++) 680 for (k = 0; k < 2; k++) { 681 pfs->pcounters[i][j][k] += 682 p->pfik_packets[i][j][k]; 683 pfs->bcounters[i][j] += 684 p->pfik_bytes[i][j][k]; 685 } 686 } 687} 688 689void 690pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size) 691{ 692 struct pfi_kif *p, *nextp; 693 int n = 0; 694 695 for (p = RB_MIN(pfi_ifhead, &V_pfi_ifs); p; p = nextp) { 696 nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p); 697 if (pfi_skip_if(name, p)) 698 continue; 699 if (*size <= n++) 700 break; 701 if (!p->pfik_tzero) 702 p->pfik_tzero = time_second; 703 bcopy(p, buf++, sizeof(*buf)); 704 nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p); 705 } 706 *size = n; 707} 708 709static int 710pfi_skip_if(const char *filter, struct pfi_kif *p) 711{ 712 int n; 713 714 if (filter == NULL || !*filter) 715 return (0); 716 if (!strcmp(p->pfik_name, filter)) 717 return (0); /* exact match */ 718 n = strlen(filter); 719 if (n < 1 || n >= IFNAMSIZ) 720 return (1); /* sanity check */ 721 if (filter[n-1] >= '0' && filter[n-1] <= '9') 722 return (1); /* only do exact match in that case */ 723 if (strncmp(p->pfik_name, filter, n)) 724 return (1); /* prefix doesn't match */ 725 return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9'); 726} 727 728int 729pfi_set_flags(const char *name, int flags) 730{ 731 struct pfi_kif *p; 732 733 RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) { 734 if (pfi_skip_if(name, p)) 735 continue; 736 p->pfik_flags |= flags; 737 } 738 return (0); 739} 740 741int 742pfi_clear_flags(const char *name, int flags) 743{ 744 struct pfi_kif *p; 745 746 RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) { 747 if (pfi_skip_if(name, p)) 748 continue; 749 p->pfik_flags &= ~flags; 750 } 751 return (0); 752} 753 754/* from pf_print_state.c */ 755static int 756pfi_unmask(void *addr) 757{ 758 struct pf_addr *m = addr; 759 int i = 31, j = 0, b = 0; 760 u_int32_t tmp; 761 762 while (j < 4 && m->addr32[j] == 0xffffffff) { 763 b += 32; 764 j++; 765 } 766 if (j < 4) { 767 tmp = ntohl(m->addr32[j]); 768 for (i = 31; tmp & (1 << i); --i) 769 b++; 770 } 771 return (b); 772} 773 774static void 775pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp) 776{ 777 778 CURVNET_SET(ifp->if_vnet); 779 pfi_attach_ifnet(ifp); 780#ifdef ALTQ 781 PF_RULES_WLOCK(); 782 pf_altq_ifnet_event(ifp, 0); 783 PF_RULES_WUNLOCK(); 784#endif 785 CURVNET_RESTORE(); 786} 787 788static void 789pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp) 790{ 791 struct pfi_kif *kif = (struct pfi_kif *)ifp->if_pf_kif; 792 793 CURVNET_SET(ifp->if_vnet); 794 PF_RULES_WLOCK(); 795 V_pfi_update++; 796 pfi_kif_update(kif); 797 798 kif->pfik_ifp = NULL; 799 ifp->if_pf_kif = NULL; 800#ifdef ALTQ 801 pf_altq_ifnet_event(ifp, 1); 802#endif 803 PF_RULES_WUNLOCK(); 804 CURVNET_RESTORE(); 805} 806 807static void 808pfi_attach_group_event(void *arg , struct ifg_group *ifg) 809{ 810 811 CURVNET_SET((struct vnet *)arg); 812 pfi_attach_ifgroup(ifg); 813 CURVNET_RESTORE(); 814} 815 816static void 817pfi_change_group_event(void *arg, char *gname) 818{ 819 struct pfi_kif *kif; 820 821 kif = malloc(sizeof(*kif), PFI_MTYPE, M_WAITOK); 822 823 CURVNET_SET((struct vnet *)arg); 824 PF_RULES_WLOCK(); 825 V_pfi_update++; 826 kif = pfi_kif_attach(kif, gname); 827 pfi_kif_update(kif); 828 PF_RULES_WUNLOCK(); 829 CURVNET_RESTORE(); 830} 831 832static void 833pfi_detach_group_event(void *arg, struct ifg_group *ifg) 834{ 835 struct pfi_kif *kif = (struct pfi_kif *)ifg->ifg_pf_kif; 836 837 CURVNET_SET((struct vnet *)arg); 838 PF_RULES_WLOCK(); 839 V_pfi_update++; 840 841 kif->pfik_group = NULL; 842 ifg->ifg_pf_kif = NULL; 843 PF_RULES_WUNLOCK(); 844 CURVNET_RESTORE(); 845} 846 847static void 848pfi_ifaddr_event(void *arg __unused, struct ifnet *ifp) 849{ 850 851 CURVNET_SET(ifp->if_vnet); 852 PF_RULES_WLOCK(); 853 if (ifp && ifp->if_pf_kif) { 854 V_pfi_update++; 855 pfi_kif_update(ifp->if_pf_kif); 856 } 857 PF_RULES_WUNLOCK(); 858 CURVNET_RESTORE(); 859} 860