1 /* $OpenBSD: pfctl_radix.c,v 1.27 2005/05/21 21:03:58 henning Exp $ */
2
3 /*-
4 * SPDX-License-Identifier: BSD-2-Clause
5 *
6 * Copyright (c) 2002 Cedric Berger
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD: stable/12/sbin/pfctl/pfctl_radix.c 371968 2022-04-11 14:54:45Z git2svn $");
37
38 #include <sys/types.h>
39 #include <sys/ioctl.h>
40 #include <sys/socket.h>
41
42 #include <net/if.h>
43 #include <net/pfvar.h>
44
45 #include <errno.h>
46 #include <string.h>
47 #include <ctype.h>
48 #include <stdio.h>
49 #include <stdlib.h>
50 #include <limits.h>
51 #include <err.h>
52
53 #include "pfctl.h"
54
55 #define BUF_SIZE 256
56
57 extern int dev;
58
59 static int pfr_next_token(char buf[], FILE *);
60
61
62 int
pfr_clr_tables(struct pfr_table * filter,int * ndel,int flags)63 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
64 {
65 struct pfioc_table io;
66
67 bzero(&io, sizeof io);
68 io.pfrio_flags = flags;
69 if (filter != NULL)
70 io.pfrio_table = *filter;
71 if (ioctl(dev, DIOCRCLRTABLES, &io))
72 return (-1);
73 if (ndel != NULL)
74 *ndel = io.pfrio_ndel;
75 return (0);
76 }
77
78 int
pfr_add_tables(struct pfr_table * tbl,int size,int * nadd,int flags)79 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
80 {
81 struct pfioc_table io;
82
83 if (size < 0 || (size && tbl == NULL)) {
84 errno = EINVAL;
85 return (-1);
86 }
87 bzero(&io, sizeof io);
88 io.pfrio_flags = flags;
89 io.pfrio_buffer = tbl;
90 io.pfrio_esize = sizeof(*tbl);
91 io.pfrio_size = size;
92 if (ioctl(dev, DIOCRADDTABLES, &io))
93 return (-1);
94 if (nadd != NULL)
95 *nadd = io.pfrio_nadd;
96 return (0);
97 }
98
99 int
pfr_del_tables(struct pfr_table * tbl,int size,int * ndel,int flags)100 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
101 {
102 struct pfioc_table io;
103
104 if (size < 0 || (size && tbl == NULL)) {
105 errno = EINVAL;
106 return (-1);
107 }
108 bzero(&io, sizeof io);
109 io.pfrio_flags = flags;
110 io.pfrio_buffer = tbl;
111 io.pfrio_esize = sizeof(*tbl);
112 io.pfrio_size = size;
113 if (ioctl(dev, DIOCRDELTABLES, &io))
114 return (-1);
115 if (ndel != NULL)
116 *ndel = io.pfrio_ndel;
117 return (0);
118 }
119
120 int
pfr_get_tables(struct pfr_table * filter,struct pfr_table * tbl,int * size,int flags)121 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
122 int flags)
123 {
124 struct pfioc_table io;
125
126 if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
127 errno = EINVAL;
128 return (-1);
129 }
130 bzero(&io, sizeof io);
131 io.pfrio_flags = flags;
132 if (filter != NULL)
133 io.pfrio_table = *filter;
134 io.pfrio_buffer = tbl;
135 io.pfrio_esize = sizeof(*tbl);
136 io.pfrio_size = *size;
137 if (ioctl(dev, DIOCRGETTABLES, &io))
138 return (-1);
139 *size = io.pfrio_size;
140 return (0);
141 }
142
143 int
pfr_get_tstats(struct pfr_table * filter,struct pfr_tstats * tbl,int * size,int flags)144 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
145 int flags)
146 {
147 struct pfioc_table io;
148
149 if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
150 errno = EINVAL;
151 return (-1);
152 }
153 bzero(&io, sizeof io);
154 io.pfrio_flags = flags;
155 if (filter != NULL)
156 io.pfrio_table = *filter;
157 io.pfrio_buffer = tbl;
158 io.pfrio_esize = sizeof(*tbl);
159 io.pfrio_size = *size;
160 if (ioctl(dev, DIOCRGETTSTATS, &io))
161 return (-1);
162 *size = io.pfrio_size;
163 return (0);
164 }
165
166 int
pfr_clr_addrs(struct pfr_table * tbl,int * ndel,int flags)167 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
168 {
169 struct pfioc_table io;
170
171 if (tbl == NULL) {
172 errno = EINVAL;
173 return (-1);
174 }
175 bzero(&io, sizeof io);
176 io.pfrio_flags = flags;
177 io.pfrio_table = *tbl;
178 if (ioctl(dev, DIOCRCLRADDRS, &io))
179 return (-1);
180 if (ndel != NULL)
181 *ndel = io.pfrio_ndel;
182 return (0);
183 }
184
185 int
pfr_add_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int flags)186 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
187 int *nadd, int flags)
188 {
189 int ret;
190
191 ret = pfctl_table_add_addrs(dev, tbl, addr, size, nadd, flags);
192 if (ret) {
193 errno = ret;
194 return (-1);
195 }
196 return (0);
197 }
198
199 int
pfr_del_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * ndel,int flags)200 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
201 int *ndel, int flags)
202 {
203 int ret;
204
205 ret = pfctl_table_del_addrs(dev, tbl, addr, size, ndel, flags);
206 if (ret) {
207 errno = ret;
208 return (-1);
209 }
210 return (0);
211 }
212
213 int
pfr_set_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * size2,int * nadd,int * ndel,int * nchange,int flags)214 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
215 int *size2, int *nadd, int *ndel, int *nchange, int flags)
216 {
217 int ret;
218
219 ret = pfctl_table_set_addrs(dev, tbl, addr, size, size2, nadd, ndel,
220 nchange, flags);
221 if (ret) {
222 errno = ret;
223 return (-1);
224 }
225 return (0);
226 }
227
228 int
pfr_get_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int * size,int flags)229 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
230 int flags)
231 {
232 int ret;
233
234 ret = pfctl_table_get_addrs(dev, tbl, addr, size, flags);
235 if (ret) {
236 errno = ret;
237 return (-1);
238 }
239 return (0);
240 }
241
242 int
pfr_get_astats(struct pfr_table * tbl,struct pfr_astats * addr,int * size,int flags)243 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
244 int flags)
245 {
246 struct pfioc_table io;
247
248 if (tbl == NULL || size == NULL || *size < 0 ||
249 (*size && addr == NULL)) {
250 errno = EINVAL;
251 return (-1);
252 }
253 bzero(&io, sizeof io);
254 io.pfrio_flags = flags;
255 io.pfrio_table = *tbl;
256 io.pfrio_buffer = addr;
257 io.pfrio_esize = sizeof(*addr);
258 io.pfrio_size = *size;
259 if (ioctl(dev, DIOCRGETASTATS, &io))
260 return (-1);
261 *size = io.pfrio_size;
262 return (0);
263 }
264
265 int
pfr_clr_tstats(struct pfr_table * tbl,int size,int * nzero,int flags)266 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
267 {
268 struct pfioc_table io;
269
270 if (size < 0 || (size && !tbl)) {
271 errno = EINVAL;
272 return (-1);
273 }
274 bzero(&io, sizeof io);
275 io.pfrio_flags = flags;
276 io.pfrio_buffer = tbl;
277 io.pfrio_esize = sizeof(*tbl);
278 io.pfrio_size = size;
279 if (ioctl(dev, DIOCRCLRTSTATS, &io))
280 return (-1);
281 if (nzero)
282 *nzero = io.pfrio_nzero;
283 return (0);
284 }
285
286 int
pfr_tst_addrs(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nmatch,int flags)287 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
288 int *nmatch, int flags)
289 {
290 struct pfioc_table io;
291
292 if (tbl == NULL || size < 0 || (size && addr == NULL)) {
293 errno = EINVAL;
294 return (-1);
295 }
296 bzero(&io, sizeof io);
297 io.pfrio_flags = flags;
298 io.pfrio_table = *tbl;
299 io.pfrio_buffer = addr;
300 io.pfrio_esize = sizeof(*addr);
301 io.pfrio_size = size;
302 if (ioctl(dev, DIOCRTSTADDRS, &io))
303 return (-1);
304 if (nmatch)
305 *nmatch = io.pfrio_nmatch;
306 return (0);
307 }
308
309 int
pfr_ina_define(struct pfr_table * tbl,struct pfr_addr * addr,int size,int * nadd,int * naddr,int ticket,int flags)310 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
311 int *nadd, int *naddr, int ticket, int flags)
312 {
313 struct pfioc_table io;
314
315 if (tbl == NULL || size < 0 || (size && addr == NULL)) {
316 errno = EINVAL;
317 return (-1);
318 }
319 bzero(&io, sizeof io);
320 io.pfrio_flags = flags;
321 io.pfrio_table = *tbl;
322 io.pfrio_buffer = addr;
323 io.pfrio_esize = sizeof(*addr);
324 io.pfrio_size = size;
325 io.pfrio_ticket = ticket;
326 if (ioctl(dev, DIOCRINADEFINE, &io))
327 return (-1);
328 if (nadd != NULL)
329 *nadd = io.pfrio_nadd;
330 if (naddr != NULL)
331 *naddr = io.pfrio_naddr;
332 return (0);
333 }
334
335 /* interface management code */
336
337 int
pfi_get_ifaces(const char * filter,struct pfi_kif * buf,int * size)338 pfi_get_ifaces(const char *filter, struct pfi_kif *buf, int *size)
339 {
340 struct pfioc_iface io;
341
342 if (size == NULL || *size < 0 || (*size && buf == NULL)) {
343 errno = EINVAL;
344 return (-1);
345 }
346 bzero(&io, sizeof io);
347 if (filter != NULL)
348 if (strlcpy(io.pfiio_name, filter, sizeof(io.pfiio_name)) >=
349 sizeof(io.pfiio_name)) {
350 errno = EINVAL;
351 return (-1);
352 }
353 io.pfiio_buffer = buf;
354 io.pfiio_esize = sizeof(*buf);
355 io.pfiio_size = *size;
356 if (ioctl(dev, DIOCIGETIFACES, &io))
357 return (-1);
358 *size = io.pfiio_size;
359 return (0);
360 }
361
362 /* buffer management code */
363
364 const size_t buf_esize[PFRB_MAX] = { 0,
365 sizeof(struct pfr_table), sizeof(struct pfr_tstats),
366 sizeof(struct pfr_addr), sizeof(struct pfr_astats),
367 sizeof(struct pfi_kif), sizeof(struct pfioc_trans_e)
368 };
369
370 /*
371 * add one element to the buffer
372 */
373 int
pfr_buf_add(struct pfr_buffer * b,const void * e)374 pfr_buf_add(struct pfr_buffer *b, const void *e)
375 {
376 size_t bs;
377
378 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX ||
379 e == NULL) {
380 errno = EINVAL;
381 return (-1);
382 }
383 bs = buf_esize[b->pfrb_type];
384 if (b->pfrb_size == b->pfrb_msize)
385 if (pfr_buf_grow(b, 0))
386 return (-1);
387 memcpy(((caddr_t)b->pfrb_caddr) + bs * b->pfrb_size, e, bs);
388 b->pfrb_size++;
389 return (0);
390 }
391
392 /*
393 * return next element of the buffer (or first one if prev is NULL)
394 * see PFRB_FOREACH macro
395 */
396 void *
pfr_buf_next(struct pfr_buffer * b,const void * prev)397 pfr_buf_next(struct pfr_buffer *b, const void *prev)
398 {
399 size_t bs;
400
401 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX)
402 return (NULL);
403 if (b->pfrb_size == 0)
404 return (NULL);
405 if (prev == NULL)
406 return (b->pfrb_caddr);
407 bs = buf_esize[b->pfrb_type];
408 if ((((caddr_t)prev)-((caddr_t)b->pfrb_caddr)) / bs >= b->pfrb_size-1)
409 return (NULL);
410 return (((caddr_t)prev) + bs);
411 }
412
413 /*
414 * minsize:
415 * 0: make the buffer somewhat bigger
416 * n: make room for "n" entries in the buffer
417 */
418 int
pfr_buf_grow(struct pfr_buffer * b,int minsize)419 pfr_buf_grow(struct pfr_buffer *b, int minsize)
420 {
421 caddr_t p;
422 size_t bs;
423
424 if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX) {
425 errno = EINVAL;
426 return (-1);
427 }
428 if (minsize != 0 && minsize <= b->pfrb_msize)
429 return (0);
430 bs = buf_esize[b->pfrb_type];
431 if (!b->pfrb_msize) {
432 if (minsize < 64)
433 minsize = 64;
434 b->pfrb_caddr = calloc(bs, minsize);
435 if (b->pfrb_caddr == NULL)
436 return (-1);
437 b->pfrb_msize = minsize;
438 } else {
439 if (minsize == 0)
440 minsize = b->pfrb_msize * 2;
441 if (minsize < 0 || minsize >= SIZE_T_MAX / bs) {
442 /* msize overflow */
443 errno = ENOMEM;
444 return (-1);
445 }
446 p = realloc(b->pfrb_caddr, minsize * bs);
447 if (p == NULL)
448 return (-1);
449 bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs);
450 b->pfrb_caddr = p;
451 b->pfrb_msize = minsize;
452 }
453 return (0);
454 }
455
456 /*
457 * reset buffer and free memory.
458 */
459 void
pfr_buf_clear(struct pfr_buffer * b)460 pfr_buf_clear(struct pfr_buffer *b)
461 {
462 if (b == NULL)
463 return;
464 if (b->pfrb_caddr != NULL)
465 free(b->pfrb_caddr);
466 b->pfrb_caddr = NULL;
467 b->pfrb_size = b->pfrb_msize = 0;
468 }
469
470 int
pfr_buf_load(struct pfr_buffer * b,char * file,int nonetwork,int (* append_addr)(struct pfr_buffer *,char *,int))471 pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
472 int (*append_addr)(struct pfr_buffer *, char *, int))
473 {
474 FILE *fp;
475 char buf[BUF_SIZE];
476 int rv;
477
478 if (file == NULL)
479 return (0);
480 if (!strcmp(file, "-"))
481 fp = stdin;
482 else {
483 fp = pfctl_fopen(file, "r");
484 if (fp == NULL)
485 return (-1);
486 }
487 while ((rv = pfr_next_token(buf, fp)) == 1)
488 if (append_addr(b, buf, nonetwork)) {
489 rv = -1;
490 break;
491 }
492 if (fp != stdin)
493 fclose(fp);
494 return (rv);
495 }
496
497 int
pfr_next_token(char buf[BUF_SIZE],FILE * fp)498 pfr_next_token(char buf[BUF_SIZE], FILE *fp)
499 {
500 static char next_ch = ' ';
501 int i = 0;
502
503 for (;;) {
504 /* skip spaces */
505 while (isspace(next_ch) && !feof(fp))
506 next_ch = fgetc(fp);
507 /* remove from '#' until end of line */
508 if (next_ch == '#')
509 while (!feof(fp)) {
510 next_ch = fgetc(fp);
511 if (next_ch == '\n')
512 break;
513 }
514 else
515 break;
516 }
517 if (feof(fp)) {
518 next_ch = ' ';
519 return (0);
520 }
521 do {
522 if (i < BUF_SIZE)
523 buf[i++] = next_ch;
524 next_ch = fgetc(fp);
525 } while (!feof(fp) && !isspace(next_ch));
526 if (i >= BUF_SIZE) {
527 errno = EINVAL;
528 return (-1);
529 }
530 buf[i] = '\0';
531 return (1);
532 }
533
534 char *
pfr_strerror(int errnum)535 pfr_strerror(int errnum)
536 {
537 switch (errnum) {
538 case ESRCH:
539 return "Table does not exist";
540 case ENOENT:
541 return "Anchor or Ruleset does not exist";
542 default:
543 return strerror(errnum);
544 }
545 }
546