1 /*-
2 * Copyright (c) 2002 Cedric Berger
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * - Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * - Redistributions in binary form must reproduce the above
12 * copyright notice, this list of conditions and the following
13 * disclaimer in the documentation and/or other materials provided
14 * with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
17 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
18 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
19 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
20 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
22 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
24 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
26 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27 * POSSIBILITY OF SUCH DAMAGE.
28 *
29 * $OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $
30 */
31
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37
38 #include <sys/param.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/mutex.h>
44 #include <sys/refcount.h>
45 #include <sys/rwlock.h>
46 #include <sys/socket.h>
47 #include <vm/uma.h>
48
49 #include <net/if.h>
50 #include <net/vnet.h>
51 #include <net/pfvar.h>
52
53 #define ACCEPT_FLAGS(flags, oklist) \
54 do { \
55 if ((flags & ~(oklist)) & \
56 PFR_FLAG_ALLMASK) \
57 return (EINVAL); \
58 } while (0)
59
60 #define FILLIN_SIN(sin, addr) \
61 do { \
62 (sin).sin_len = sizeof(sin); \
63 (sin).sin_family = AF_INET; \
64 (sin).sin_addr = (addr); \
65 } while (0)
66
67 #define FILLIN_SIN6(sin6, addr) \
68 do { \
69 (sin6).sin6_len = sizeof(sin6); \
70 (sin6).sin6_family = AF_INET6; \
71 (sin6).sin6_addr = (addr); \
72 } while (0)
73
74 #define SWAP(type, a1, a2) \
75 do { \
76 type tmp = a1; \
77 a1 = a2; \
78 a2 = tmp; \
79 } while (0)
80
81 #define SUNION2PF(su, af) (((af)==AF_INET) ? \
82 (struct pf_addr *)&(su)->sin.sin_addr : \
83 (struct pf_addr *)&(su)->sin6.sin6_addr)
84
85 #define AF_BITS(af) (((af)==AF_INET)?32:128)
86 #define ADDR_NETWORK(ad) ((ad)->pfra_net < AF_BITS((ad)->pfra_af))
87 #define KENTRY_NETWORK(ke) ((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
88 #define KENTRY_RNF_ROOT(ke) \
89 ((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
90
91 #define NO_ADDRESSES (-1)
92 #define ENQUEUE_UNMARKED_ONLY (1)
93 #define INVERT_NEG_FLAG (1)
94
95 struct pfr_walktree {
96 enum pfrw_op {
97 PFRW_MARK,
98 PFRW_SWEEP,
99 PFRW_ENQUEUE,
100 PFRW_GET_ADDRS,
101 PFRW_GET_ASTATS,
102 PFRW_POOL_GET,
103 PFRW_DYNADDR_UPDATE
104 } pfrw_op;
105 union {
106 struct pfr_addr *pfrw1_addr;
107 struct pfr_astats *pfrw1_astats;
108 struct pfr_kentryworkq *pfrw1_workq;
109 struct pfr_kentry *pfrw1_kentry;
110 struct pfi_dynaddr *pfrw1_dyn;
111 } pfrw_1;
112 int pfrw_free;
113 };
114 #define pfrw_addr pfrw_1.pfrw1_addr
115 #define pfrw_astats pfrw_1.pfrw1_astats
116 #define pfrw_workq pfrw_1.pfrw1_workq
117 #define pfrw_kentry pfrw_1.pfrw1_kentry
118 #define pfrw_dyn pfrw_1.pfrw1_dyn
119 #define pfrw_cnt pfrw_free
120
121 #define senderr(e) do { rv = (e); goto _bad; } while (0)
122
123 static MALLOC_DEFINE(M_PFTABLE, "pf_table", "pf(4) tables structures");
124 static VNET_DEFINE(uma_zone_t, pfr_kentry_z);
125 #define V_pfr_kentry_z VNET(pfr_kentry_z)
126 static VNET_DEFINE(uma_zone_t, pfr_kcounters_z);
127 #define V_pfr_kcounters_z VNET(pfr_kcounters_z)
128
129 static struct pf_addr pfr_ffaddr = {
130 .addr32 = { 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff }
131 };
132
133 static void pfr_copyout_addr(struct pfr_addr *,
134 struct pfr_kentry *ke);
135 static int pfr_validate_addr(struct pfr_addr *);
136 static void pfr_enqueue_addrs(struct pfr_ktable *,
137 struct pfr_kentryworkq *, int *, int);
138 static void pfr_mark_addrs(struct pfr_ktable *);
139 static struct pfr_kentry
140 *pfr_lookup_addr(struct pfr_ktable *,
141 struct pfr_addr *, int);
142 static struct pfr_kentry *pfr_create_kentry(struct pfr_addr *);
143 static void pfr_destroy_kentries(struct pfr_kentryworkq *);
144 static void pfr_destroy_kentry(struct pfr_kentry *);
145 static void pfr_insert_kentries(struct pfr_ktable *,
146 struct pfr_kentryworkq *, long);
147 static void pfr_remove_kentries(struct pfr_ktable *,
148 struct pfr_kentryworkq *);
149 static void pfr_clstats_kentries(struct pfr_kentryworkq *, long,
150 int);
151 static void pfr_reset_feedback(struct pfr_addr *, int);
152 static void pfr_prepare_network(union sockaddr_union *, int, int);
153 static int pfr_route_kentry(struct pfr_ktable *,
154 struct pfr_kentry *);
155 static int pfr_unroute_kentry(struct pfr_ktable *,
156 struct pfr_kentry *);
157 static int pfr_walktree(struct radix_node *, void *);
158 static int pfr_validate_table(struct pfr_table *, int, int);
159 static int pfr_fix_anchor(char *);
160 static void pfr_commit_ktable(struct pfr_ktable *, long);
161 static void pfr_insert_ktables(struct pfr_ktableworkq *);
162 static void pfr_insert_ktable(struct pfr_ktable *);
163 static void pfr_setflags_ktables(struct pfr_ktableworkq *);
164 static void pfr_setflags_ktable(struct pfr_ktable *, int);
165 static void pfr_clstats_ktables(struct pfr_ktableworkq *, long,
166 int);
167 static void pfr_clstats_ktable(struct pfr_ktable *, long, int);
168 static struct pfr_ktable
169 *pfr_create_ktable(struct pfr_table *, long, int);
170 static void pfr_destroy_ktables(struct pfr_ktableworkq *, int);
171 static void pfr_destroy_ktable(struct pfr_ktable *, int);
172 static int pfr_ktable_compare(struct pfr_ktable *,
173 struct pfr_ktable *);
174 static struct pfr_ktable
175 *pfr_lookup_table(struct pfr_table *);
176 static void pfr_clean_node_mask(struct pfr_ktable *,
177 struct pfr_kentryworkq *);
178 static int pfr_table_count(struct pfr_table *, int);
179 static int pfr_skip_table(struct pfr_table *,
180 struct pfr_ktable *, int);
181 static struct pfr_kentry
182 *pfr_kentry_byidx(struct pfr_ktable *, int, int);
183
184 static RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
185 static RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
186
187 struct pfr_ktablehead pfr_ktables;
188 struct pfr_table pfr_nulltable;
189 int pfr_ktable_cnt;
190
191 void
pfr_initialize(void)192 pfr_initialize(void)
193 {
194
195 V_pfr_kentry_z = uma_zcreate("pf table entries",
196 sizeof(struct pfr_kentry), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR,
197 0);
198 V_pfr_kcounters_z = uma_zcreate("pf table counters",
199 sizeof(struct pfr_kcounters), NULL, NULL, NULL, NULL,
200 UMA_ALIGN_PTR, 0);
201 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].zone = V_pfr_kentry_z;
202 V_pf_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT;
203 }
204
205 void
pfr_cleanup(void)206 pfr_cleanup(void)
207 {
208
209 uma_zdestroy(V_pfr_kentry_z);
210 uma_zdestroy(V_pfr_kcounters_z);
211 }
212
213 int
pfr_clr_addrs(struct pfr_table * tbl,int * ndel,int flags)214 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
215 {
216 struct pfr_ktable *kt;
217 struct pfr_kentryworkq workq;
218
219 PF_RULES_WASSERT();
220
221 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
222 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
223 return (EINVAL);
224 kt = pfr_lookup_table(tbl);
225 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
226 return (ESRCH);
227 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
228 return (EPERM);
229 pfr_enqueue_addrs(kt, &workq, ndel, 0);
230
231 if (!(flags & PFR_FLAG_DUMMY)) {
232 pfr_remove_kentries(kt, &workq);
233 KASSERT(kt->pfrkt_cnt == 0, ("%s: non-null pfrkt_cnt", __func__));
234 }
235 return (0);
236 }
237
238 int
pfr_add_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int flags)239 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
240 int *nadd, int flags)
241 {
242 struct pfr_ktable *kt, *tmpkt;
243 struct pfr_kentryworkq workq;
244 struct pfr_kentry *p, *q;
245 struct pfr_addr *ad;
246 int i, rv, xadd = 0;
247 long tzero = time_second;
248
249 PF_RULES_WASSERT();
250
251 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
252 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
253 return (EINVAL);
254 kt = pfr_lookup_table(tbl);
255 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
256 return (ESRCH);
257 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
258 return (EPERM);
259 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
260 if (tmpkt == NULL)
261 return (ENOMEM);
262 SLIST_INIT(&workq);
263 for (i = 0, ad = addr; i < size; i++, ad++) {
264 if (pfr_validate_addr(ad))
265 senderr(EINVAL);
266 p = pfr_lookup_addr(kt, ad, 1);
267 q = pfr_lookup_addr(tmpkt, ad, 1);
268 if (flags & PFR_FLAG_FEEDBACK) {
269 if (q != NULL)
270 ad->pfra_fback = PFR_FB_DUPLICATE;
271 else if (p == NULL)
272 ad->pfra_fback = PFR_FB_ADDED;
273 else if (p->pfrke_not != ad->pfra_not)
274 ad->pfra_fback = PFR_FB_CONFLICT;
275 else
276 ad->pfra_fback = PFR_FB_NONE;
277 }
278 if (p == NULL && q == NULL) {
279 p = pfr_create_kentry(ad);
280 if (p == NULL)
281 senderr(ENOMEM);
282 if (pfr_route_kentry(tmpkt, p)) {
283 pfr_destroy_kentry(p);
284 ad->pfra_fback = PFR_FB_NONE;
285 } else {
286 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
287 xadd++;
288 }
289 }
290 }
291 pfr_clean_node_mask(tmpkt, &workq);
292 if (!(flags & PFR_FLAG_DUMMY))
293 pfr_insert_kentries(kt, &workq, tzero);
294 else
295 pfr_destroy_kentries(&workq);
296 if (nadd != NULL)
297 *nadd = xadd;
298 pfr_destroy_ktable(tmpkt, 0);
299 return (0);
300 _bad:
301 pfr_clean_node_mask(tmpkt, &workq);
302 pfr_destroy_kentries(&workq);
303 if (flags & PFR_FLAG_FEEDBACK)
304 pfr_reset_feedback(addr, size);
305 pfr_destroy_ktable(tmpkt, 0);
306 return (rv);
307 }
308
309 int
pfr_del_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * ndel,int flags)310 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
311 int *ndel, int flags)
312 {
313 struct pfr_ktable *kt;
314 struct pfr_kentryworkq workq;
315 struct pfr_kentry *p;
316 struct pfr_addr *ad;
317 int i, rv, xdel = 0, log = 1;
318
319 PF_RULES_WASSERT();
320
321 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
322 if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
323 return (EINVAL);
324 kt = pfr_lookup_table(tbl);
325 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
326 return (ESRCH);
327 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
328 return (EPERM);
329 /*
330 * there are two algorithms to choose from here.
331 * with:
332 * n: number of addresses to delete
333 * N: number of addresses in the table
334 *
335 * one is O(N) and is better for large 'n'
336 * one is O(n*LOG(N)) and is better for small 'n'
337 *
338 * following code try to decide which one is best.
339 */
340 for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
341 log++;
342 if (size > kt->pfrkt_cnt/log) {
343 /* full table scan */
344 pfr_mark_addrs(kt);
345 } else {
346 /* iterate over addresses to delete */
347 for (i = 0, ad = addr; i < size; i++, ad++) {
348 if (pfr_validate_addr(ad))
349 return (EINVAL);
350 p = pfr_lookup_addr(kt, ad, 1);
351 if (p != NULL)
352 p->pfrke_mark = 0;
353 }
354 }
355 SLIST_INIT(&workq);
356 for (i = 0, ad = addr; i < size; i++, ad++) {
357 if (pfr_validate_addr(ad))
358 senderr(EINVAL);
359 p = pfr_lookup_addr(kt, ad, 1);
360 if (flags & PFR_FLAG_FEEDBACK) {
361 if (p == NULL)
362 ad->pfra_fback = PFR_FB_NONE;
363 else if (p->pfrke_not != ad->pfra_not)
364 ad->pfra_fback = PFR_FB_CONFLICT;
365 else if (p->pfrke_mark)
366 ad->pfra_fback = PFR_FB_DUPLICATE;
367 else
368 ad->pfra_fback = PFR_FB_DELETED;
369 }
370 if (p != NULL && p->pfrke_not == ad->pfra_not &&
371 !p->pfrke_mark) {
372 p->pfrke_mark = 1;
373 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
374 xdel++;
375 }
376 }
377 if (!(flags & PFR_FLAG_DUMMY))
378 pfr_remove_kentries(kt, &workq);
379 if (ndel != NULL)
380 *ndel = xdel;
381 return (0);
382 _bad:
383 if (flags & PFR_FLAG_FEEDBACK)
384 pfr_reset_feedback(addr, size);
385 return (rv);
386 }
387
388 int
pfr_set_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * size2,int * nadd,int * ndel,int * nchange,int flags,u_int32_t ignore_pfrt_flags)389 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
390 int *size2, int *nadd, int *ndel, int *nchange, int flags,
391 u_int32_t ignore_pfrt_flags)
392 {
393 struct pfr_ktable *kt, *tmpkt;
394 struct pfr_kentryworkq addq, delq, changeq;
395 struct pfr_kentry *p, *q;
396 struct pfr_addr ad;
397 int i, rv, xadd = 0, xdel = 0, xchange = 0;
398 long tzero = time_second;
399
400 PF_RULES_WASSERT();
401
402 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
403 if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
404 PFR_FLAG_USERIOCTL))
405 return (EINVAL);
406 kt = pfr_lookup_table(tbl);
407 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
408 return (ESRCH);
409 if (kt->pfrkt_flags & PFR_TFLAG_CONST)
410 return (EPERM);
411 tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0);
412 if (tmpkt == NULL)
413 return (ENOMEM);
414 pfr_mark_addrs(kt);
415 SLIST_INIT(&addq);
416 SLIST_INIT(&delq);
417 SLIST_INIT(&changeq);
418 for (i = 0; i < size; i++) {
419 /*
420 * XXXGL: undertand pf_if usage of this function
421 * and make ad a moving pointer
422 */
423 bcopy(addr + i, &ad, sizeof(ad));
424 if (pfr_validate_addr(&ad))
425 senderr(EINVAL);
426 ad.pfra_fback = PFR_FB_NONE;
427 p = pfr_lookup_addr(kt, &ad, 1);
428 if (p != NULL) {
429 if (p->pfrke_mark) {
430 ad.pfra_fback = PFR_FB_DUPLICATE;
431 goto _skip;
432 }
433 p->pfrke_mark = 1;
434 if (p->pfrke_not != ad.pfra_not) {
435 SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
436 ad.pfra_fback = PFR_FB_CHANGED;
437 xchange++;
438 }
439 } else {
440 q = pfr_lookup_addr(tmpkt, &ad, 1);
441 if (q != NULL) {
442 ad.pfra_fback = PFR_FB_DUPLICATE;
443 goto _skip;
444 }
445 p = pfr_create_kentry(&ad);
446 if (p == NULL)
447 senderr(ENOMEM);
448 if (pfr_route_kentry(tmpkt, p)) {
449 pfr_destroy_kentry(p);
450 ad.pfra_fback = PFR_FB_NONE;
451 } else {
452 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
453 ad.pfra_fback = PFR_FB_ADDED;
454 xadd++;
455 }
456 }
457 _skip:
458 if (flags & PFR_FLAG_FEEDBACK)
459 bcopy(&ad, addr + i, sizeof(ad));
460 }
461 pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
462 if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
463 if (*size2 < size+xdel) {
464 *size2 = size+xdel;
465 senderr(0);
466 }
467 i = 0;
468 SLIST_FOREACH(p, &delq, pfrke_workq) {
469 pfr_copyout_addr(&ad, p);
470 ad.pfra_fback = PFR_FB_DELETED;
471 bcopy(&ad, addr + size + i, sizeof(ad));
472 i++;
473 }
474 }
475 pfr_clean_node_mask(tmpkt, &addq);
476 if (!(flags & PFR_FLAG_DUMMY)) {
477 pfr_insert_kentries(kt, &addq, tzero);
478 pfr_remove_kentries(kt, &delq);
479 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
480 } else
481 pfr_destroy_kentries(&addq);
482 if (nadd != NULL)
483 *nadd = xadd;
484 if (ndel != NULL)
485 *ndel = xdel;
486 if (nchange != NULL)
487 *nchange = xchange;
488 if ((flags & PFR_FLAG_FEEDBACK) && size2)
489 *size2 = size+xdel;
490 pfr_destroy_ktable(tmpkt, 0);
491 return (0);
492 _bad:
493 pfr_clean_node_mask(tmpkt, &addq);
494 pfr_destroy_kentries(&addq);
495 if (flags & PFR_FLAG_FEEDBACK)
496 pfr_reset_feedback(addr, size);
497 pfr_destroy_ktable(tmpkt, 0);
498 return (rv);
499 }
500
501 int
pfr_tst_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nmatch,int flags)502 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
503 int *nmatch, int flags)
504 {
505 struct pfr_ktable *kt;
506 struct pfr_kentry *p;
507 struct pfr_addr *ad;
508 int i, xmatch = 0;
509
510 PF_RULES_RASSERT();
511
512 ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
513 if (pfr_validate_table(tbl, 0, 0))
514 return (EINVAL);
515 kt = pfr_lookup_table(tbl);
516 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
517 return (ESRCH);
518
519 for (i = 0, ad = addr; i < size; i++, ad++) {
520 if (pfr_validate_addr(ad))
521 return (EINVAL);
522 if (ADDR_NETWORK(ad))
523 return (EINVAL);
524 p = pfr_lookup_addr(kt, ad, 0);
525 if (flags & PFR_FLAG_REPLACE)
526 pfr_copyout_addr(ad, p);
527 ad->pfra_fback = (p == NULL) ? PFR_FB_NONE :
528 (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
529 if (p != NULL && !p->pfrke_not)
530 xmatch++;
531 }
532 if (nmatch != NULL)
533 *nmatch = xmatch;
534 return (0);
535 }
536
537 int
pfr_get_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int * size,int flags)538 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
539 int flags)
540 {
541 struct pfr_ktable *kt;
542 struct pfr_walktree w;
543 int rv;
544
545 PF_RULES_RASSERT();
546
547 ACCEPT_FLAGS(flags, 0);
548 if (pfr_validate_table(tbl, 0, 0))
549 return (EINVAL);
550 kt = pfr_lookup_table(tbl);
551 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
552 return (ESRCH);
553 if (kt->pfrkt_cnt > *size) {
554 *size = kt->pfrkt_cnt;
555 return (0);
556 }
557
558 bzero(&w, sizeof(w));
559 w.pfrw_op = PFRW_GET_ADDRS;
560 w.pfrw_addr = addr;
561 w.pfrw_free = kt->pfrkt_cnt;
562 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
563 if (!rv)
564 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
565 &w);
566 if (rv)
567 return (rv);
568
569 KASSERT(w.pfrw_free == 0, ("%s: corruption detected (%d)", __func__,
570 w.pfrw_free));
571
572 *size = kt->pfrkt_cnt;
573 return (0);
574 }
575
576 int
pfr_get_astats(struct pfr_table * tbl,struct pfr_astats * addr,int * size,int flags)577 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
578 int flags)
579 {
580 struct pfr_ktable *kt;
581 struct pfr_walktree w;
582 struct pfr_kentryworkq workq;
583 int rv;
584 long tzero = time_second;
585
586 PF_RULES_RASSERT();
587
588 /* XXX PFR_FLAG_CLSTATS disabled */
589 ACCEPT_FLAGS(flags, 0);
590 if (pfr_validate_table(tbl, 0, 0))
591 return (EINVAL);
592 kt = pfr_lookup_table(tbl);
593 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
594 return (ESRCH);
595 if (kt->pfrkt_cnt > *size) {
596 *size = kt->pfrkt_cnt;
597 return (0);
598 }
599
600 bzero(&w, sizeof(w));
601 w.pfrw_op = PFRW_GET_ASTATS;
602 w.pfrw_astats = addr;
603 w.pfrw_free = kt->pfrkt_cnt;
604 rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
605 if (!rv)
606 rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
607 &w);
608 if (!rv && (flags & PFR_FLAG_CLSTATS)) {
609 pfr_enqueue_addrs(kt, &workq, NULL, 0);
610 pfr_clstats_kentries(&workq, tzero, 0);
611 }
612 if (rv)
613 return (rv);
614
615 if (w.pfrw_free) {
616 printf("pfr_get_astats: corruption detected (%d).\n",
617 w.pfrw_free);
618 return (ENOTTY);
619 }
620 *size = kt->pfrkt_cnt;
621 return (0);
622 }
623
624 int
pfr_clr_astats(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nzero,int flags)625 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
626 int *nzero, int flags)
627 {
628 struct pfr_ktable *kt;
629 struct pfr_kentryworkq workq;
630 struct pfr_kentry *p;
631 struct pfr_addr *ad;
632 int i, rv, xzero = 0;
633
634 PF_RULES_WASSERT();
635
636 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_FEEDBACK);
637 if (pfr_validate_table(tbl, 0, 0))
638 return (EINVAL);
639 kt = pfr_lookup_table(tbl);
640 if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
641 return (ESRCH);
642 SLIST_INIT(&workq);
643 for (i = 0, ad = addr; i < size; i++, ad++) {
644 if (pfr_validate_addr(ad))
645 senderr(EINVAL);
646 p = pfr_lookup_addr(kt, ad, 1);
647 if (flags & PFR_FLAG_FEEDBACK) {
648 ad->pfra_fback = (p != NULL) ?
649 PFR_FB_CLEARED : PFR_FB_NONE;
650 }
651 if (p != NULL) {
652 SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
653 xzero++;
654 }
655 }
656
657 if (!(flags & PFR_FLAG_DUMMY))
658 pfr_clstats_kentries(&workq, 0, 0);
659 if (nzero != NULL)
660 *nzero = xzero;
661 return (0);
662 _bad:
663 if (flags & PFR_FLAG_FEEDBACK)
664 pfr_reset_feedback(addr, size);
665 return (rv);
666 }
667
668 static int
pfr_validate_addr(struct pfr_addr * ad)669 pfr_validate_addr(struct pfr_addr *ad)
670 {
671 int i;
672
673 switch (ad->pfra_af) {
674 #ifdef INET
675 case AF_INET:
676 if (ad->pfra_net > 32)
677 return (-1);
678 break;
679 #endif /* INET */
680 #ifdef INET6
681 case AF_INET6:
682 if (ad->pfra_net > 128)
683 return (-1);
684 break;
685 #endif /* INET6 */
686 default:
687 return (-1);
688 }
689 if (ad->pfra_net < 128 &&
690 (((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
691 return (-1);
692 for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
693 if (((caddr_t)ad)[i])
694 return (-1);
695 if (ad->pfra_not && ad->pfra_not != 1)
696 return (-1);
697 if (ad->pfra_fback)
698 return (-1);
699 return (0);
700 }
701
702 static void
pfr_enqueue_addrs(struct pfr_ktable * kt,struct pfr_kentryworkq * workq,int * naddr,int sweep)703 pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
704 int *naddr, int sweep)
705 {
706 struct pfr_walktree w;
707
708 SLIST_INIT(workq);
709 bzero(&w, sizeof(w));
710 w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
711 w.pfrw_workq = workq;
712 if (kt->pfrkt_ip4 != NULL)
713 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree,
714 &w))
715 printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
716 if (kt->pfrkt_ip6 != NULL)
717 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
718 &w))
719 printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
720 if (naddr != NULL)
721 *naddr = w.pfrw_cnt;
722 }
723
724 static void
pfr_mark_addrs(struct pfr_ktable * kt)725 pfr_mark_addrs(struct pfr_ktable *kt)
726 {
727 struct pfr_walktree w;
728
729 bzero(&w, sizeof(w));
730 w.pfrw_op = PFRW_MARK;
731 if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
732 printf("pfr_mark_addrs: IPv4 walktree failed.\n");
733 if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
734 printf("pfr_mark_addrs: IPv6 walktree failed.\n");
735 }
736
737
738 static struct pfr_kentry *
pfr_lookup_addr(struct pfr_ktable * kt,struct pfr_addr * ad,int exact)739 pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
740 {
741 union sockaddr_union sa, mask;
742 struct radix_node_head *head = NULL;
743 struct pfr_kentry *ke;
744
745 PF_RULES_ASSERT();
746
747 bzero(&sa, sizeof(sa));
748 if (ad->pfra_af == AF_INET) {
749 FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
750 head = kt->pfrkt_ip4;
751 } else if ( ad->pfra_af == AF_INET6 ) {
752 FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
753 head = kt->pfrkt_ip6;
754 }
755 if (ADDR_NETWORK(ad)) {
756 pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
757 ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
758 if (ke && KENTRY_RNF_ROOT(ke))
759 ke = NULL;
760 } else {
761 ke = (struct pfr_kentry *)rn_match(&sa, head);
762 if (ke && KENTRY_RNF_ROOT(ke))
763 ke = NULL;
764 if (exact && ke && KENTRY_NETWORK(ke))
765 ke = NULL;
766 }
767 return (ke);
768 }
769
770 static struct pfr_kentry *
pfr_create_kentry(struct pfr_addr * ad)771 pfr_create_kentry(struct pfr_addr *ad)
772 {
773 struct pfr_kentry *ke;
774
775 ke = uma_zalloc(V_pfr_kentry_z, M_NOWAIT | M_ZERO);
776 if (ke == NULL)
777 return (NULL);
778
779 if (ad->pfra_af == AF_INET)
780 FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
781 else if (ad->pfra_af == AF_INET6)
782 FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
783 ke->pfrke_af = ad->pfra_af;
784 ke->pfrke_net = ad->pfra_net;
785 ke->pfrke_not = ad->pfra_not;
786 return (ke);
787 }
788
789 static void
pfr_destroy_kentries(struct pfr_kentryworkq * workq)790 pfr_destroy_kentries(struct pfr_kentryworkq *workq)
791 {
792 struct pfr_kentry *p, *q;
793
794 for (p = SLIST_FIRST(workq); p != NULL; p = q) {
795 q = SLIST_NEXT(p, pfrke_workq);
796 pfr_destroy_kentry(p);
797 }
798 }
799
800 static void
pfr_destroy_kentry(struct pfr_kentry * ke)801 pfr_destroy_kentry(struct pfr_kentry *ke)
802 {
803 if (ke->pfrke_counters)
804 uma_zfree(V_pfr_kcounters_z, ke->pfrke_counters);
805 uma_zfree(V_pfr_kentry_z, ke);
806 }
807
808 static void
pfr_insert_kentries(struct pfr_ktable * kt,struct pfr_kentryworkq * workq,long tzero)809 pfr_insert_kentries(struct pfr_ktable *kt,
810 struct pfr_kentryworkq *workq, long tzero)
811 {
812 struct pfr_kentry *p;
813 int rv, n = 0;
814
815 SLIST_FOREACH(p, workq, pfrke_workq) {
816 rv = pfr_route_kentry(kt, p);
817 if (rv) {
818 printf("pfr_insert_kentries: cannot route entry "
819 "(code=%d).\n", rv);
820 break;
821 }
822 p->pfrke_tzero = tzero;
823 n++;
824 }
825 kt->pfrkt_cnt += n;
826 }
827
828 int
pfr_insert_kentry(struct pfr_ktable * kt,struct pfr_addr * ad,long tzero)829 pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
830 {
831 struct pfr_kentry *p;
832 int rv;
833
834 p = pfr_lookup_addr(kt, ad, 1);
835 if (p != NULL)
836 return (0);
837 p = pfr_create_kentry(ad);
838 if (p == NULL)
839 return (ENOMEM);
840
841 rv = pfr_route_kentry(kt, p);
842 if (rv)
843 return (rv);
844
845 p->pfrke_tzero = tzero;
846 kt->pfrkt_cnt++;
847
848 return (0);
849 }
850
851 static void
pfr_remove_kentries(struct pfr_ktable * kt,struct pfr_kentryworkq * workq)852 pfr_remove_kentries(struct pfr_ktable *kt,
853 struct pfr_kentryworkq *workq)
854 {
855 struct pfr_kentry *p;
856 int n = 0;
857
858 SLIST_FOREACH(p, workq, pfrke_workq) {
859 pfr_unroute_kentry(kt, p);
860 n++;
861 }
862 kt->pfrkt_cnt -= n;
863 pfr_destroy_kentries(workq);
864 }
865
866 static void
pfr_clean_node_mask(struct pfr_ktable * kt,struct pfr_kentryworkq * workq)867 pfr_clean_node_mask(struct pfr_ktable *kt,
868 struct pfr_kentryworkq *workq)
869 {
870 struct pfr_kentry *p;
871
872 SLIST_FOREACH(p, workq, pfrke_workq)
873 pfr_unroute_kentry(kt, p);
874 }
875
876 static void
pfr_clstats_kentries(struct pfr_kentryworkq * workq,long tzero,int negchange)877 pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
878 {
879 struct pfr_kentry *p;
880
881 SLIST_FOREACH(p, workq, pfrke_workq) {
882 if (negchange)
883 p->pfrke_not = !p->pfrke_not;
884 if (p->pfrke_counters) {
885 uma_zfree(V_pfr_kcounters_z, p->pfrke_counters);
886 p->pfrke_counters = NULL;
887 }
888 p->pfrke_tzero = tzero;
889 }
890 }
891
892 static void
pfr_reset_feedback(struct pfr_addr * addr,int size)893 pfr_reset_feedback(struct pfr_addr *addr, int size)
894 {
895 struct pfr_addr *ad;
896 int i;
897
898 for (i = 0, ad = addr; i < size; i++, ad++)
899 ad->pfra_fback = PFR_FB_NONE;
900 }
901
902 static void
pfr_prepare_network(union sockaddr_union * sa,int af,int net)903 pfr_prepare_network(union sockaddr_union *sa, int af, int net)
904 {
905 int i;
906
907 bzero(sa, sizeof(*sa));
908 if (af == AF_INET) {
909 sa->sin.sin_len = sizeof(sa->sin);
910 sa->sin.sin_family = AF_INET;
911 sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
912 } else if (af == AF_INET6) {
913 sa->sin6.sin6_len = sizeof(sa->sin6);
914 sa->sin6.sin6_family = AF_INET6;
915 for (i = 0; i < 4; i++) {
916 if (net <= 32) {
917 sa->sin6.sin6_addr.s6_addr32[i] =
918 net ? htonl(-1 << (32-net)) : 0;
919 break;
920 }
921 sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
922 net -= 32;
923 }
924 }
925 }
926
927 static int
pfr_route_kentry(struct pfr_ktable * kt,struct pfr_kentry * ke)928 pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
929 {
930 union sockaddr_union mask;
931 struct radix_node *rn;
932 struct radix_node_head *head = NULL;
933
934 PF_RULES_WASSERT();
935
936 bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
937 if (ke->pfrke_af == AF_INET)
938 head = kt->pfrkt_ip4;
939 else if (ke->pfrke_af == AF_INET6)
940 head = kt->pfrkt_ip6;
941
942 if (KENTRY_NETWORK(ke)) {
943 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
944 rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
945 } else
946 rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
947
948 return (rn == NULL ? -1 : 0);
949 }
950
951 static int
pfr_unroute_kentry(struct pfr_ktable * kt,struct pfr_kentry * ke)952 pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
953 {
954 union sockaddr_union mask;
955 struct radix_node *rn;
956 struct radix_node_head *head = NULL;
957
958 if (ke->pfrke_af == AF_INET)
959 head = kt->pfrkt_ip4;
960 else if (ke->pfrke_af == AF_INET6)
961 head = kt->pfrkt_ip6;
962
963 if (KENTRY_NETWORK(ke)) {
964 pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
965 rn = rn_delete(&ke->pfrke_sa, &mask, head);
966 } else
967 rn = rn_delete(&ke->pfrke_sa, NULL, head);
968
969 if (rn == NULL) {
970 printf("pfr_unroute_kentry: delete failed.\n");
971 return (-1);
972 }
973 return (0);
974 }
975
976 static void
pfr_copyout_addr(struct pfr_addr * ad,struct pfr_kentry * ke)977 pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
978 {
979 bzero(ad, sizeof(*ad));
980 if (ke == NULL)
981 return;
982 ad->pfra_af = ke->pfrke_af;
983 ad->pfra_net = ke->pfrke_net;
984 ad->pfra_not = ke->pfrke_not;
985 if (ad->pfra_af == AF_INET)
986 ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
987 else if (ad->pfra_af == AF_INET6)
988 ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
989 }
990
991 static int
pfr_walktree(struct radix_node * rn,void * arg)992 pfr_walktree(struct radix_node *rn, void *arg)
993 {
994 struct pfr_kentry *ke = (struct pfr_kentry *)rn;
995 struct pfr_walktree *w = arg;
996
997 switch (w->pfrw_op) {
998 case PFRW_MARK:
999 ke->pfrke_mark = 0;
1000 break;
1001 case PFRW_SWEEP:
1002 if (ke->pfrke_mark)
1003 break;
1004 /* FALLTHROUGH */
1005 case PFRW_ENQUEUE:
1006 SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
1007 w->pfrw_cnt++;
1008 break;
1009 case PFRW_GET_ADDRS:
1010 if (w->pfrw_free-- > 0) {
1011 pfr_copyout_addr(w->pfrw_addr, ke);
1012 w->pfrw_addr++;
1013 }
1014 break;
1015 case PFRW_GET_ASTATS:
1016 if (w->pfrw_free-- > 0) {
1017 struct pfr_astats as;
1018
1019 pfr_copyout_addr(&as.pfras_a, ke);
1020
1021 if (ke->pfrke_counters) {
1022 bcopy(ke->pfrke_counters->pfrkc_packets,
1023 as.pfras_packets, sizeof(as.pfras_packets));
1024 bcopy(ke->pfrke_counters->pfrkc_bytes,
1025 as.pfras_bytes, sizeof(as.pfras_bytes));
1026 } else {
1027 bzero(as.pfras_packets, sizeof(as.pfras_packets));
1028 bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
1029 as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
1030 }
1031 as.pfras_tzero = ke->pfrke_tzero;
1032
1033 bcopy(&as, w->pfrw_astats, sizeof(as));
1034 w->pfrw_astats++;
1035 }
1036 break;
1037 case PFRW_POOL_GET:
1038 if (ke->pfrke_not)
1039 break; /* negative entries are ignored */
1040 if (!w->pfrw_cnt--) {
1041 w->pfrw_kentry = ke;
1042 return (1); /* finish search */
1043 }
1044 break;
1045 case PFRW_DYNADDR_UPDATE:
1046 {
1047 union sockaddr_union pfr_mask;
1048
1049 if (ke->pfrke_af == AF_INET) {
1050 if (w->pfrw_dyn->pfid_acnt4++ > 0)
1051 break;
1052 pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
1053 w->pfrw_dyn->pfid_addr4 = *SUNION2PF(&ke->pfrke_sa,
1054 AF_INET);
1055 w->pfrw_dyn->pfid_mask4 = *SUNION2PF(&pfr_mask,
1056 AF_INET);
1057 } else if (ke->pfrke_af == AF_INET6){
1058 if (w->pfrw_dyn->pfid_acnt6++ > 0)
1059 break;
1060 pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
1061 w->pfrw_dyn->pfid_addr6 = *SUNION2PF(&ke->pfrke_sa,
1062 AF_INET6);
1063 w->pfrw_dyn->pfid_mask6 = *SUNION2PF(&pfr_mask,
1064 AF_INET6);
1065 }
1066 break;
1067 }
1068 }
1069 return (0);
1070 }
1071
1072 int
pfr_clr_tables(struct pfr_table * filter,int * ndel,int flags)1073 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
1074 {
1075 struct pfr_ktableworkq workq;
1076 struct pfr_ktable *p;
1077 int xdel = 0;
1078
1079 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ALLRSETS);
1080 if (pfr_fix_anchor(filter->pfrt_anchor))
1081 return (EINVAL);
1082 if (pfr_table_count(filter, flags) < 0)
1083 return (ENOENT);
1084
1085 SLIST_INIT(&workq);
1086 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1087 if (pfr_skip_table(filter, p, flags))
1088 continue;
1089 if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
1090 continue;
1091 if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
1092 continue;
1093 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1094 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1095 xdel++;
1096 }
1097 if (!(flags & PFR_FLAG_DUMMY))
1098 pfr_setflags_ktables(&workq);
1099 if (ndel != NULL)
1100 *ndel = xdel;
1101 return (0);
1102 }
1103
1104 int
pfr_add_tables(struct pfr_table * tbl,int size,int * nadd,int flags)1105 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
1106 {
1107 struct pfr_ktableworkq addq, changeq;
1108 struct pfr_ktable *p, *q, *r, key;
1109 int i, rv, xadd = 0;
1110 long tzero = time_second;
1111
1112 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1113 SLIST_INIT(&addq);
1114 SLIST_INIT(&changeq);
1115 for (i = 0; i < size; i++) {
1116 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1117 if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
1118 flags & PFR_FLAG_USERIOCTL))
1119 senderr(EINVAL);
1120 key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
1121 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1122 if (p == NULL) {
1123 p = pfr_create_ktable(&key.pfrkt_t, tzero, 1);
1124 if (p == NULL)
1125 senderr(ENOMEM);
1126 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1127 if (!pfr_ktable_compare(p, q))
1128 goto _skip;
1129 }
1130 SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
1131 xadd++;
1132 if (!key.pfrkt_anchor[0])
1133 goto _skip;
1134
1135 /* find or create root table */
1136 bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
1137 r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1138 if (r != NULL) {
1139 p->pfrkt_root = r;
1140 goto _skip;
1141 }
1142 SLIST_FOREACH(q, &addq, pfrkt_workq) {
1143 if (!pfr_ktable_compare(&key, q)) {
1144 p->pfrkt_root = q;
1145 goto _skip;
1146 }
1147 }
1148 key.pfrkt_flags = 0;
1149 r = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1150 if (r == NULL)
1151 senderr(ENOMEM);
1152 SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
1153 p->pfrkt_root = r;
1154 } else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1155 SLIST_FOREACH(q, &changeq, pfrkt_workq)
1156 if (!pfr_ktable_compare(&key, q))
1157 goto _skip;
1158 p->pfrkt_nflags = (p->pfrkt_flags &
1159 ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
1160 SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
1161 xadd++;
1162 }
1163 _skip:
1164 ;
1165 }
1166 if (!(flags & PFR_FLAG_DUMMY)) {
1167 pfr_insert_ktables(&addq);
1168 pfr_setflags_ktables(&changeq);
1169 } else
1170 pfr_destroy_ktables(&addq, 0);
1171 if (nadd != NULL)
1172 *nadd = xadd;
1173 return (0);
1174 _bad:
1175 pfr_destroy_ktables(&addq, 0);
1176 return (rv);
1177 }
1178
1179 int
pfr_del_tables(struct pfr_table * tbl,int size,int * ndel,int flags)1180 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
1181 {
1182 struct pfr_ktableworkq workq;
1183 struct pfr_ktable *p, *q, key;
1184 int i, xdel = 0;
1185
1186 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1187 SLIST_INIT(&workq);
1188 for (i = 0; i < size; i++) {
1189 bcopy(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1190 if (pfr_validate_table(&key.pfrkt_t, 0,
1191 flags & PFR_FLAG_USERIOCTL))
1192 return (EINVAL);
1193 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1194 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1195 SLIST_FOREACH(q, &workq, pfrkt_workq)
1196 if (!pfr_ktable_compare(p, q))
1197 goto _skip;
1198 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
1199 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1200 xdel++;
1201 }
1202 _skip:
1203 ;
1204 }
1205
1206 if (!(flags & PFR_FLAG_DUMMY))
1207 pfr_setflags_ktables(&workq);
1208 if (ndel != NULL)
1209 *ndel = xdel;
1210 return (0);
1211 }
1212
1213 int
pfr_get_tables(struct pfr_table * filter,struct pfr_table * tbl,int * size,int flags)1214 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
1215 int flags)
1216 {
1217 struct pfr_ktable *p;
1218 int n, nn;
1219
1220 PF_RULES_RASSERT();
1221
1222 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1223 if (pfr_fix_anchor(filter->pfrt_anchor))
1224 return (EINVAL);
1225 n = nn = pfr_table_count(filter, flags);
1226 if (n < 0)
1227 return (ENOENT);
1228 if (n > *size) {
1229 *size = n;
1230 return (0);
1231 }
1232 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1233 if (pfr_skip_table(filter, p, flags))
1234 continue;
1235 if (n-- <= 0)
1236 continue;
1237 bcopy(&p->pfrkt_t, tbl++, sizeof(*tbl));
1238 }
1239
1240 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1241
1242 *size = nn;
1243 return (0);
1244 }
1245
1246 int
pfr_get_tstats(struct pfr_table * filter,struct pfr_tstats * tbl,int * size,int flags)1247 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
1248 int flags)
1249 {
1250 struct pfr_ktable *p;
1251 struct pfr_ktableworkq workq;
1252 int n, nn;
1253 long tzero = time_second;
1254
1255 /* XXX PFR_FLAG_CLSTATS disabled */
1256 ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
1257 if (pfr_fix_anchor(filter->pfrt_anchor))
1258 return (EINVAL);
1259 n = nn = pfr_table_count(filter, flags);
1260 if (n < 0)
1261 return (ENOENT);
1262 if (n > *size) {
1263 *size = n;
1264 return (0);
1265 }
1266 SLIST_INIT(&workq);
1267 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1268 if (pfr_skip_table(filter, p, flags))
1269 continue;
1270 if (n-- <= 0)
1271 continue;
1272 bcopy(&p->pfrkt_ts, tbl++, sizeof(*tbl));
1273 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1274 }
1275 if (flags & PFR_FLAG_CLSTATS)
1276 pfr_clstats_ktables(&workq, tzero,
1277 flags & PFR_FLAG_ADDRSTOO);
1278
1279 KASSERT(n == 0, ("%s: corruption detected (%d)", __func__, n));
1280
1281 *size = nn;
1282 return (0);
1283 }
1284
1285 int
pfr_clr_tstats(struct pfr_table * tbl,int size,int * nzero,int flags)1286 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
1287 {
1288 struct pfr_ktableworkq workq;
1289 struct pfr_ktable *p, key;
1290 int i, xzero = 0;
1291 long tzero = time_second;
1292
1293 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1294 SLIST_INIT(&workq);
1295 for (i = 0; i < size; i++) {
1296 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1297 if (pfr_validate_table(&key.pfrkt_t, 0, 0))
1298 return (EINVAL);
1299 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1300 if (p != NULL) {
1301 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1302 xzero++;
1303 }
1304 }
1305 if (!(flags & PFR_FLAG_DUMMY))
1306 pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
1307 if (nzero != NULL)
1308 *nzero = xzero;
1309 return (0);
1310 }
1311
1312 int
pfr_set_tflags(struct pfr_table * tbl,int size,int setflag,int clrflag,int * nchange,int * ndel,int flags)1313 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
1314 int *nchange, int *ndel, int flags)
1315 {
1316 struct pfr_ktableworkq workq;
1317 struct pfr_ktable *p, *q, key;
1318 int i, xchange = 0, xdel = 0;
1319
1320 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1321 if ((setflag & ~PFR_TFLAG_USRMASK) ||
1322 (clrflag & ~PFR_TFLAG_USRMASK) ||
1323 (setflag & clrflag))
1324 return (EINVAL);
1325 SLIST_INIT(&workq);
1326 for (i = 0; i < size; i++) {
1327 bcopy(tbl + i, &key.pfrkt_t, sizeof(key.pfrkt_t));
1328 if (pfr_validate_table(&key.pfrkt_t, 0,
1329 flags & PFR_FLAG_USERIOCTL))
1330 return (EINVAL);
1331 p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1332 if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
1333 p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
1334 ~clrflag;
1335 if (p->pfrkt_nflags == p->pfrkt_flags)
1336 goto _skip;
1337 SLIST_FOREACH(q, &workq, pfrkt_workq)
1338 if (!pfr_ktable_compare(p, q))
1339 goto _skip;
1340 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1341 if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
1342 (clrflag & PFR_TFLAG_PERSIST) &&
1343 !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
1344 xdel++;
1345 else
1346 xchange++;
1347 }
1348 _skip:
1349 ;
1350 }
1351 if (!(flags & PFR_FLAG_DUMMY))
1352 pfr_setflags_ktables(&workq);
1353 if (nchange != NULL)
1354 *nchange = xchange;
1355 if (ndel != NULL)
1356 *ndel = xdel;
1357 return (0);
1358 }
1359
1360 int
pfr_ina_begin(struct pfr_table * trs,u_int32_t * ticket,int * ndel,int flags)1361 pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
1362 {
1363 struct pfr_ktableworkq workq;
1364 struct pfr_ktable *p;
1365 struct pf_ruleset *rs;
1366 int xdel = 0;
1367
1368 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1369 rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
1370 if (rs == NULL)
1371 return (ENOMEM);
1372 SLIST_INIT(&workq);
1373 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1374 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1375 pfr_skip_table(trs, p, 0))
1376 continue;
1377 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1378 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1379 xdel++;
1380 }
1381 if (!(flags & PFR_FLAG_DUMMY)) {
1382 pfr_setflags_ktables(&workq);
1383 if (ticket != NULL)
1384 *ticket = ++rs->tticket;
1385 rs->topen = 1;
1386 } else
1387 pf_remove_if_empty_ruleset(rs);
1388 if (ndel != NULL)
1389 *ndel = xdel;
1390 return (0);
1391 }
1392
1393 int
pfr_ina_define(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int * naddr,u_int32_t ticket,int flags)1394 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
1395 int *nadd, int *naddr, u_int32_t ticket, int flags)
1396 {
1397 struct pfr_ktableworkq tableq;
1398 struct pfr_kentryworkq addrq;
1399 struct pfr_ktable *kt, *rt, *shadow, key;
1400 struct pfr_kentry *p;
1401 struct pfr_addr *ad;
1402 struct pf_ruleset *rs;
1403 int i, rv, xadd = 0, xaddr = 0;
1404
1405 PF_RULES_WASSERT();
1406
1407 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
1408 if (size && !(flags & PFR_FLAG_ADDRSTOO))
1409 return (EINVAL);
1410 if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
1411 flags & PFR_FLAG_USERIOCTL))
1412 return (EINVAL);
1413 rs = pf_find_ruleset(tbl->pfrt_anchor);
1414 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1415 return (EBUSY);
1416 tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
1417 SLIST_INIT(&tableq);
1418 kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
1419 if (kt == NULL) {
1420 kt = pfr_create_ktable(tbl, 0, 1);
1421 if (kt == NULL)
1422 return (ENOMEM);
1423 SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
1424 xadd++;
1425 if (!tbl->pfrt_anchor[0])
1426 goto _skip;
1427
1428 /* find or create root table */
1429 bzero(&key, sizeof(key));
1430 strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
1431 rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
1432 if (rt != NULL) {
1433 kt->pfrkt_root = rt;
1434 goto _skip;
1435 }
1436 rt = pfr_create_ktable(&key.pfrkt_t, 0, 1);
1437 if (rt == NULL) {
1438 pfr_destroy_ktables(&tableq, 0);
1439 return (ENOMEM);
1440 }
1441 SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
1442 kt->pfrkt_root = rt;
1443 } else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
1444 xadd++;
1445 _skip:
1446 shadow = pfr_create_ktable(tbl, 0, 0);
1447 if (shadow == NULL) {
1448 pfr_destroy_ktables(&tableq, 0);
1449 return (ENOMEM);
1450 }
1451 SLIST_INIT(&addrq);
1452 for (i = 0, ad = addr; i < size; i++, ad++) {
1453 if (pfr_validate_addr(ad))
1454 senderr(EINVAL);
1455 if (pfr_lookup_addr(shadow, ad, 1) != NULL)
1456 continue;
1457 p = pfr_create_kentry(ad);
1458 if (p == NULL)
1459 senderr(ENOMEM);
1460 if (pfr_route_kentry(shadow, p)) {
1461 pfr_destroy_kentry(p);
1462 continue;
1463 }
1464 SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
1465 xaddr++;
1466 }
1467 if (!(flags & PFR_FLAG_DUMMY)) {
1468 if (kt->pfrkt_shadow != NULL)
1469 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1470 kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
1471 pfr_insert_ktables(&tableq);
1472 shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
1473 xaddr : NO_ADDRESSES;
1474 kt->pfrkt_shadow = shadow;
1475 } else {
1476 pfr_clean_node_mask(shadow, &addrq);
1477 pfr_destroy_ktable(shadow, 0);
1478 pfr_destroy_ktables(&tableq, 0);
1479 pfr_destroy_kentries(&addrq);
1480 }
1481 if (nadd != NULL)
1482 *nadd = xadd;
1483 if (naddr != NULL)
1484 *naddr = xaddr;
1485 return (0);
1486 _bad:
1487 pfr_destroy_ktable(shadow, 0);
1488 pfr_destroy_ktables(&tableq, 0);
1489 pfr_destroy_kentries(&addrq);
1490 return (rv);
1491 }
1492
1493 int
pfr_ina_rollback(struct pfr_table * trs,u_int32_t ticket,int * ndel,int flags)1494 pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
1495 {
1496 struct pfr_ktableworkq workq;
1497 struct pfr_ktable *p;
1498 struct pf_ruleset *rs;
1499 int xdel = 0;
1500
1501 PF_RULES_WASSERT();
1502
1503 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1504 rs = pf_find_ruleset(trs->pfrt_anchor);
1505 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1506 return (0);
1507 SLIST_INIT(&workq);
1508 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1509 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1510 pfr_skip_table(trs, p, 0))
1511 continue;
1512 p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
1513 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1514 xdel++;
1515 }
1516 if (!(flags & PFR_FLAG_DUMMY)) {
1517 pfr_setflags_ktables(&workq);
1518 rs->topen = 0;
1519 pf_remove_if_empty_ruleset(rs);
1520 }
1521 if (ndel != NULL)
1522 *ndel = xdel;
1523 return (0);
1524 }
1525
1526 int
pfr_ina_commit(struct pfr_table * trs,u_int32_t ticket,int * nadd,int * nchange,int flags)1527 pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
1528 int *nchange, int flags)
1529 {
1530 struct pfr_ktable *p, *q;
1531 struct pfr_ktableworkq workq;
1532 struct pf_ruleset *rs;
1533 int xadd = 0, xchange = 0;
1534 long tzero = time_second;
1535
1536 PF_RULES_WASSERT();
1537
1538 ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
1539 rs = pf_find_ruleset(trs->pfrt_anchor);
1540 if (rs == NULL || !rs->topen || ticket != rs->tticket)
1541 return (EBUSY);
1542
1543 SLIST_INIT(&workq);
1544 RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
1545 if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
1546 pfr_skip_table(trs, p, 0))
1547 continue;
1548 SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
1549 if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
1550 xchange++;
1551 else
1552 xadd++;
1553 }
1554
1555 if (!(flags & PFR_FLAG_DUMMY)) {
1556 for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
1557 q = SLIST_NEXT(p, pfrkt_workq);
1558 pfr_commit_ktable(p, tzero);
1559 }
1560 rs->topen = 0;
1561 pf_remove_if_empty_ruleset(rs);
1562 }
1563 if (nadd != NULL)
1564 *nadd = xadd;
1565 if (nchange != NULL)
1566 *nchange = xchange;
1567
1568 return (0);
1569 }
1570
1571 static void
pfr_commit_ktable(struct pfr_ktable * kt,long tzero)1572 pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
1573 {
1574 struct pfr_ktable *shadow = kt->pfrkt_shadow;
1575 int nflags;
1576
1577 PF_RULES_WASSERT();
1578
1579 if (shadow->pfrkt_cnt == NO_ADDRESSES) {
1580 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1581 pfr_clstats_ktable(kt, tzero, 1);
1582 } else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
1583 /* kt might contain addresses */
1584 struct pfr_kentryworkq addrq, addq, changeq, delq, garbageq;
1585 struct pfr_kentry *p, *q, *next;
1586 struct pfr_addr ad;
1587
1588 pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
1589 pfr_mark_addrs(kt);
1590 SLIST_INIT(&addq);
1591 SLIST_INIT(&changeq);
1592 SLIST_INIT(&delq);
1593 SLIST_INIT(&garbageq);
1594 pfr_clean_node_mask(shadow, &addrq);
1595 for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
1596 next = SLIST_NEXT(p, pfrke_workq); /* XXX */
1597 pfr_copyout_addr(&ad, p);
1598 q = pfr_lookup_addr(kt, &ad, 1);
1599 if (q != NULL) {
1600 if (q->pfrke_not != p->pfrke_not)
1601 SLIST_INSERT_HEAD(&changeq, q,
1602 pfrke_workq);
1603 q->pfrke_mark = 1;
1604 SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
1605 } else {
1606 p->pfrke_tzero = tzero;
1607 SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
1608 }
1609 }
1610 pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
1611 pfr_insert_kentries(kt, &addq, tzero);
1612 pfr_remove_kentries(kt, &delq);
1613 pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
1614 pfr_destroy_kentries(&garbageq);
1615 } else {
1616 /* kt cannot contain addresses */
1617 SWAP(struct radix_node_head *, kt->pfrkt_ip4,
1618 shadow->pfrkt_ip4);
1619 SWAP(struct radix_node_head *, kt->pfrkt_ip6,
1620 shadow->pfrkt_ip6);
1621 SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
1622 pfr_clstats_ktable(kt, tzero, 1);
1623 }
1624 nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
1625 (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
1626 & ~PFR_TFLAG_INACTIVE;
1627 pfr_destroy_ktable(shadow, 0);
1628 kt->pfrkt_shadow = NULL;
1629 pfr_setflags_ktable(kt, nflags);
1630 }
1631
1632 static int
pfr_validate_table(struct pfr_table * tbl,int allowedflags,int no_reserved)1633 pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
1634 {
1635 int i;
1636
1637 if (!tbl->pfrt_name[0])
1638 return (-1);
1639 if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
1640 return (-1);
1641 if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
1642 return (-1);
1643 for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
1644 if (tbl->pfrt_name[i])
1645 return (-1);
1646 if (pfr_fix_anchor(tbl->pfrt_anchor))
1647 return (-1);
1648 if (tbl->pfrt_flags & ~allowedflags)
1649 return (-1);
1650 return (0);
1651 }
1652
1653 /*
1654 * Rewrite anchors referenced by tables to remove slashes
1655 * and check for validity.
1656 */
1657 static int
pfr_fix_anchor(char * anchor)1658 pfr_fix_anchor(char *anchor)
1659 {
1660 size_t siz = MAXPATHLEN;
1661 int i;
1662
1663 if (anchor[0] == '/') {
1664 char *path;
1665 int off;
1666
1667 path = anchor;
1668 off = 1;
1669 while (*++path == '/')
1670 off++;
1671 bcopy(path, anchor, siz - off);
1672 memset(anchor + siz - off, 0, off);
1673 }
1674 if (anchor[siz - 1])
1675 return (-1);
1676 for (i = strlen(anchor); i < siz; i++)
1677 if (anchor[i])
1678 return (-1);
1679 return (0);
1680 }
1681
1682 static int
pfr_table_count(struct pfr_table * filter,int flags)1683 pfr_table_count(struct pfr_table *filter, int flags)
1684 {
1685 struct pf_ruleset *rs;
1686
1687 PF_RULES_ASSERT();
1688
1689 if (flags & PFR_FLAG_ALLRSETS)
1690 return (pfr_ktable_cnt);
1691 if (filter->pfrt_anchor[0]) {
1692 rs = pf_find_ruleset(filter->pfrt_anchor);
1693 return ((rs != NULL) ? rs->tables : -1);
1694 }
1695 return (pf_main_ruleset.tables);
1696 }
1697
1698 static int
pfr_skip_table(struct pfr_table * filter,struct pfr_ktable * kt,int flags)1699 pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
1700 {
1701 if (flags & PFR_FLAG_ALLRSETS)
1702 return (0);
1703 if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
1704 return (1);
1705 return (0);
1706 }
1707
1708 static void
pfr_insert_ktables(struct pfr_ktableworkq * workq)1709 pfr_insert_ktables(struct pfr_ktableworkq *workq)
1710 {
1711 struct pfr_ktable *p;
1712
1713 SLIST_FOREACH(p, workq, pfrkt_workq)
1714 pfr_insert_ktable(p);
1715 }
1716
1717 static void
pfr_insert_ktable(struct pfr_ktable * kt)1718 pfr_insert_ktable(struct pfr_ktable *kt)
1719 {
1720
1721 PF_RULES_WASSERT();
1722
1723 RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
1724 pfr_ktable_cnt++;
1725 if (kt->pfrkt_root != NULL)
1726 if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
1727 pfr_setflags_ktable(kt->pfrkt_root,
1728 kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
1729 }
1730
1731 static void
pfr_setflags_ktables(struct pfr_ktableworkq * workq)1732 pfr_setflags_ktables(struct pfr_ktableworkq *workq)
1733 {
1734 struct pfr_ktable *p, *q;
1735
1736 for (p = SLIST_FIRST(workq); p; p = q) {
1737 q = SLIST_NEXT(p, pfrkt_workq);
1738 pfr_setflags_ktable(p, p->pfrkt_nflags);
1739 }
1740 }
1741
1742 static void
pfr_setflags_ktable(struct pfr_ktable * kt,int newf)1743 pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
1744 {
1745 struct pfr_kentryworkq addrq;
1746
1747 PF_RULES_WASSERT();
1748
1749 if (!(newf & PFR_TFLAG_REFERENCED) &&
1750 !(newf & PFR_TFLAG_PERSIST))
1751 newf &= ~PFR_TFLAG_ACTIVE;
1752 if (!(newf & PFR_TFLAG_ACTIVE))
1753 newf &= ~PFR_TFLAG_USRMASK;
1754 if (!(newf & PFR_TFLAG_SETMASK)) {
1755 RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
1756 if (kt->pfrkt_root != NULL)
1757 if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
1758 pfr_setflags_ktable(kt->pfrkt_root,
1759 kt->pfrkt_root->pfrkt_flags &
1760 ~PFR_TFLAG_REFDANCHOR);
1761 pfr_destroy_ktable(kt, 1);
1762 pfr_ktable_cnt--;
1763 return;
1764 }
1765 if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
1766 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1767 pfr_remove_kentries(kt, &addrq);
1768 }
1769 if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
1770 pfr_destroy_ktable(kt->pfrkt_shadow, 1);
1771 kt->pfrkt_shadow = NULL;
1772 }
1773 kt->pfrkt_flags = newf;
1774 }
1775
1776 static void
pfr_clstats_ktables(struct pfr_ktableworkq * workq,long tzero,int recurse)1777 pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
1778 {
1779 struct pfr_ktable *p;
1780
1781 SLIST_FOREACH(p, workq, pfrkt_workq)
1782 pfr_clstats_ktable(p, tzero, recurse);
1783 }
1784
1785 static void
pfr_clstats_ktable(struct pfr_ktable * kt,long tzero,int recurse)1786 pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
1787 {
1788 struct pfr_kentryworkq addrq;
1789
1790 if (recurse) {
1791 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1792 pfr_clstats_kentries(&addrq, tzero, 0);
1793 }
1794 bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
1795 bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
1796 kt->pfrkt_match = kt->pfrkt_nomatch = 0;
1797 kt->pfrkt_tzero = tzero;
1798 }
1799
1800 static struct pfr_ktable *
pfr_create_ktable(struct pfr_table * tbl,long tzero,int attachruleset)1801 pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset)
1802 {
1803 struct pfr_ktable *kt;
1804 struct pf_ruleset *rs;
1805
1806 PF_RULES_WASSERT();
1807
1808 kt = malloc(sizeof(*kt), M_PFTABLE, M_NOWAIT|M_ZERO);
1809 if (kt == NULL)
1810 return (NULL);
1811 kt->pfrkt_t = *tbl;
1812
1813 if (attachruleset) {
1814 rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
1815 if (!rs) {
1816 pfr_destroy_ktable(kt, 0);
1817 return (NULL);
1818 }
1819 kt->pfrkt_rs = rs;
1820 rs->tables++;
1821 }
1822
1823 if (!rn_inithead((void **)&kt->pfrkt_ip4,
1824 offsetof(struct sockaddr_in, sin_addr) * 8) ||
1825 !rn_inithead((void **)&kt->pfrkt_ip6,
1826 offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
1827 pfr_destroy_ktable(kt, 0);
1828 return (NULL);
1829 }
1830 kt->pfrkt_tzero = tzero;
1831
1832 return (kt);
1833 }
1834
1835 static void
pfr_destroy_ktables(struct pfr_ktableworkq * workq,int flushaddr)1836 pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
1837 {
1838 struct pfr_ktable *p, *q;
1839
1840 for (p = SLIST_FIRST(workq); p; p = q) {
1841 q = SLIST_NEXT(p, pfrkt_workq);
1842 pfr_destroy_ktable(p, flushaddr);
1843 }
1844 }
1845
1846 static void
pfr_destroy_ktable(struct pfr_ktable * kt,int flushaddr)1847 pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
1848 {
1849 struct pfr_kentryworkq addrq;
1850
1851 if (flushaddr) {
1852 pfr_enqueue_addrs(kt, &addrq, NULL, 0);
1853 pfr_clean_node_mask(kt, &addrq);
1854 pfr_destroy_kentries(&addrq);
1855 }
1856 if (kt->pfrkt_ip4 != NULL)
1857 rn_detachhead((void **)&kt->pfrkt_ip4);
1858 if (kt->pfrkt_ip6 != NULL)
1859 rn_detachhead((void **)&kt->pfrkt_ip6);
1860 if (kt->pfrkt_shadow != NULL)
1861 pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
1862 if (kt->pfrkt_rs != NULL) {
1863 kt->pfrkt_rs->tables--;
1864 pf_remove_if_empty_ruleset(kt->pfrkt_rs);
1865 }
1866 free(kt, M_PFTABLE);
1867 }
1868
1869 static int
pfr_ktable_compare(struct pfr_ktable * p,struct pfr_ktable * q)1870 pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
1871 {
1872 int d;
1873
1874 if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
1875 return (d);
1876 return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
1877 }
1878
1879 static struct pfr_ktable *
pfr_lookup_table(struct pfr_table * tbl)1880 pfr_lookup_table(struct pfr_table *tbl)
1881 {
1882 /* struct pfr_ktable start like a struct pfr_table */
1883 return (RB_FIND(pfr_ktablehead, &pfr_ktables,
1884 (struct pfr_ktable *)tbl));
1885 }
1886
1887 int
pfr_match_addr(struct pfr_ktable * kt,struct pf_addr * a,sa_family_t af)1888 pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
1889 {
1890 struct pfr_kentry *ke = NULL;
1891 int match;
1892
1893 PF_RULES_RASSERT();
1894
1895 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1896 kt = kt->pfrkt_root;
1897 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1898 return (0);
1899
1900 switch (af) {
1901 #ifdef INET
1902 case AF_INET:
1903 {
1904 struct sockaddr_in sin;
1905
1906 bzero(&sin, sizeof(sin));
1907 sin.sin_len = sizeof(sin);
1908 sin.sin_family = AF_INET;
1909 sin.sin_addr.s_addr = a->addr32[0];
1910 ke = (struct pfr_kentry *)rn_match(&sin, kt->pfrkt_ip4);
1911 if (ke && KENTRY_RNF_ROOT(ke))
1912 ke = NULL;
1913 break;
1914 }
1915 #endif /* INET */
1916 #ifdef INET6
1917 case AF_INET6:
1918 {
1919 struct sockaddr_in6 sin6;
1920
1921 bzero(&sin6, sizeof(sin6));
1922 sin6.sin6_len = sizeof(sin6);
1923 sin6.sin6_family = AF_INET6;
1924 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1925 ke = (struct pfr_kentry *)rn_match(&sin6, kt->pfrkt_ip6);
1926 if (ke && KENTRY_RNF_ROOT(ke))
1927 ke = NULL;
1928 break;
1929 }
1930 #endif /* INET6 */
1931 }
1932 match = (ke && !ke->pfrke_not);
1933 if (match)
1934 kt->pfrkt_match++;
1935 else
1936 kt->pfrkt_nomatch++;
1937 return (match);
1938 }
1939
1940 void
pfr_update_stats(struct pfr_ktable * kt,struct pf_addr * a,sa_family_t af,u_int64_t len,int dir_out,int op_pass,int notrule)1941 pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
1942 u_int64_t len, int dir_out, int op_pass, int notrule)
1943 {
1944 struct pfr_kentry *ke = NULL;
1945
1946 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
1947 kt = kt->pfrkt_root;
1948 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
1949 return;
1950
1951 switch (af) {
1952 #ifdef INET
1953 case AF_INET:
1954 {
1955 struct sockaddr_in sin;
1956
1957 bzero(&sin, sizeof(sin));
1958 sin.sin_len = sizeof(sin);
1959 sin.sin_family = AF_INET;
1960 sin.sin_addr.s_addr = a->addr32[0];
1961 ke = (struct pfr_kentry *)rn_match(&sin, kt->pfrkt_ip4);
1962 if (ke && KENTRY_RNF_ROOT(ke))
1963 ke = NULL;
1964 break;
1965 }
1966 #endif /* INET */
1967 #ifdef INET6
1968 case AF_INET6:
1969 {
1970 struct sockaddr_in6 sin6;
1971
1972 bzero(&sin6, sizeof(sin6));
1973 sin6.sin6_len = sizeof(sin6);
1974 sin6.sin6_family = AF_INET6;
1975 bcopy(a, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
1976 ke = (struct pfr_kentry *)rn_match(&sin6, kt->pfrkt_ip6);
1977 if (ke && KENTRY_RNF_ROOT(ke))
1978 ke = NULL;
1979 break;
1980 }
1981 #endif /* INET6 */
1982 default:
1983 panic("%s: unknown address family %u", __func__, af);
1984 }
1985 if ((ke == NULL || ke->pfrke_not) != notrule) {
1986 if (op_pass != PFR_OP_PASS)
1987 printf("pfr_update_stats: assertion failed.\n");
1988 op_pass = PFR_OP_XPASS;
1989 }
1990 kt->pfrkt_packets[dir_out][op_pass]++;
1991 kt->pfrkt_bytes[dir_out][op_pass] += len;
1992 if (ke != NULL && op_pass != PFR_OP_XPASS &&
1993 (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
1994 if (ke->pfrke_counters == NULL)
1995 ke->pfrke_counters = uma_zalloc(V_pfr_kcounters_z,
1996 M_NOWAIT | M_ZERO);
1997 if (ke->pfrke_counters != NULL) {
1998 ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
1999 ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
2000 }
2001 }
2002 }
2003
2004 struct pfr_ktable *
pfr_attach_table(struct pf_ruleset * rs,char * name)2005 pfr_attach_table(struct pf_ruleset *rs, char *name)
2006 {
2007 struct pfr_ktable *kt, *rt;
2008 struct pfr_table tbl;
2009 struct pf_anchor *ac = rs->anchor;
2010
2011 PF_RULES_WASSERT();
2012
2013 bzero(&tbl, sizeof(tbl));
2014 strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
2015 if (ac != NULL)
2016 strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
2017 kt = pfr_lookup_table(&tbl);
2018 if (kt == NULL) {
2019 kt = pfr_create_ktable(&tbl, time_second, 1);
2020 if (kt == NULL)
2021 return (NULL);
2022 if (ac != NULL) {
2023 bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
2024 rt = pfr_lookup_table(&tbl);
2025 if (rt == NULL) {
2026 rt = pfr_create_ktable(&tbl, 0, 1);
2027 if (rt == NULL) {
2028 pfr_destroy_ktable(kt, 0);
2029 return (NULL);
2030 }
2031 pfr_insert_ktable(rt);
2032 }
2033 kt->pfrkt_root = rt;
2034 }
2035 pfr_insert_ktable(kt);
2036 }
2037 if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
2038 pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
2039 return (kt);
2040 }
2041
2042 void
pfr_detach_table(struct pfr_ktable * kt)2043 pfr_detach_table(struct pfr_ktable *kt)
2044 {
2045
2046 PF_RULES_WASSERT();
2047 KASSERT(kt->pfrkt_refcnt[PFR_REFCNT_RULE] > 0, ("%s: refcount %d\n",
2048 __func__, kt->pfrkt_refcnt[PFR_REFCNT_RULE]));
2049
2050 if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
2051 pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
2052 }
2053
2054 int
pfr_pool_get(struct pfr_ktable * kt,int * pidx,struct pf_addr * counter,sa_family_t af)2055 pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
2056 sa_family_t af)
2057 {
2058 struct pf_addr *addr, *cur, *mask;
2059 union sockaddr_union uaddr, umask;
2060 struct pfr_kentry *ke, *ke2 = NULL;
2061 int idx = -1, use_counter = 0;
2062
2063 switch (af) {
2064 case AF_INET:
2065 uaddr.sin.sin_len = sizeof(struct sockaddr_in);
2066 uaddr.sin.sin_family = AF_INET;
2067 break;
2068 case AF_INET6:
2069 uaddr.sin6.sin6_len = sizeof(struct sockaddr_in6);
2070 uaddr.sin6.sin6_family = AF_INET6;
2071 break;
2072 }
2073 addr = SUNION2PF(&uaddr, af);
2074
2075 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
2076 kt = kt->pfrkt_root;
2077 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
2078 return (-1);
2079
2080 if (pidx != NULL)
2081 idx = *pidx;
2082 if (counter != NULL && idx >= 0)
2083 use_counter = 1;
2084 if (idx < 0)
2085 idx = 0;
2086
2087 _next_block:
2088 ke = pfr_kentry_byidx(kt, idx, af);
2089 if (ke == NULL) {
2090 kt->pfrkt_nomatch++;
2091 return (1);
2092 }
2093 pfr_prepare_network(&umask, af, ke->pfrke_net);
2094 cur = SUNION2PF(&ke->pfrke_sa, af);
2095 mask = SUNION2PF(&umask, af);
2096
2097 if (use_counter) {
2098 /* is supplied address within block? */
2099 if (!PF_MATCHA(0, cur, mask, counter, af)) {
2100 /* no, go to next block in table */
2101 idx++;
2102 use_counter = 0;
2103 goto _next_block;
2104 }
2105 PF_ACPY(addr, counter, af);
2106 } else {
2107 /* use first address of block */
2108 PF_ACPY(addr, cur, af);
2109 }
2110
2111 if (!KENTRY_NETWORK(ke)) {
2112 /* this is a single IP address - no possible nested block */
2113 PF_ACPY(counter, addr, af);
2114 *pidx = idx;
2115 kt->pfrkt_match++;
2116 return (0);
2117 }
2118 for (;;) {
2119 /* we don't want to use a nested block */
2120 switch (af) {
2121 case AF_INET:
2122 ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2123 kt->pfrkt_ip4);
2124 break;
2125 case AF_INET6:
2126 ke2 = (struct pfr_kentry *)rn_match(&uaddr,
2127 kt->pfrkt_ip6);
2128 break;
2129 }
2130 /* no need to check KENTRY_RNF_ROOT() here */
2131 if (ke2 == ke) {
2132 /* lookup return the same block - perfect */
2133 PF_ACPY(counter, addr, af);
2134 *pidx = idx;
2135 kt->pfrkt_match++;
2136 return (0);
2137 }
2138
2139 /* we need to increase the counter past the nested block */
2140 pfr_prepare_network(&umask, AF_INET, ke2->pfrke_net);
2141 PF_POOLMASK(addr, addr, SUNION2PF(&umask, af), &pfr_ffaddr, af);
2142 PF_AINC(addr, af);
2143 if (!PF_MATCHA(0, cur, mask, addr, af)) {
2144 /* ok, we reached the end of our main block */
2145 /* go to next block in table */
2146 idx++;
2147 use_counter = 0;
2148 goto _next_block;
2149 }
2150 }
2151 }
2152
2153 static struct pfr_kentry *
pfr_kentry_byidx(struct pfr_ktable * kt,int idx,int af)2154 pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
2155 {
2156 struct pfr_walktree w;
2157
2158 bzero(&w, sizeof(w));
2159 w.pfrw_op = PFRW_POOL_GET;
2160 w.pfrw_cnt = idx;
2161
2162 switch (af) {
2163 #ifdef INET
2164 case AF_INET:
2165 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2166 return (w.pfrw_kentry);
2167 #endif /* INET */
2168 #ifdef INET6
2169 case AF_INET6:
2170 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2171 return (w.pfrw_kentry);
2172 #endif /* INET6 */
2173 default:
2174 return (NULL);
2175 }
2176 }
2177
2178 void
pfr_dynaddr_update(struct pfr_ktable * kt,struct pfi_dynaddr * dyn)2179 pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
2180 {
2181 struct pfr_walktree w;
2182
2183 bzero(&w, sizeof(w));
2184 w.pfrw_op = PFRW_DYNADDR_UPDATE;
2185 w.pfrw_dyn = dyn;
2186
2187 dyn->pfid_acnt4 = 0;
2188 dyn->pfid_acnt6 = 0;
2189 if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
2190 kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
2191 if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
2192 kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
2193 }
2194