1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002,2003 Henning Brauer
6 * Copyright (c) 2012 Gleb Smirnoff <glebius@FreeBSD.org>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * - Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * - Redistributions in binary form must reproduce the above
16 * copyright notice, this list of conditions and the following
17 * disclaimer in the documentation and/or other materials provided
18 * with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
24 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
28 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
30 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31 * POSSIBILITY OF SUCH DAMAGE.
32 *
33 * Effort sponsored in part by the Defense Advanced Research Projects
34 * Agency (DARPA) and Air Force Research Laboratory, Air Force
35 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
36 *
37 * $OpenBSD: pf_ioctl.c,v 1.213 2009/02/15 21:46:12 mbalmer Exp $
38 */
39
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD: stable/12/sys/netpfil/pf/pf_ioctl.c 372669 2022-10-28 09:01:16Z gbe $");
42
43 #include "opt_inet.h"
44 #include "opt_inet6.h"
45 #include "opt_bpf.h"
46 #include "opt_pf.h"
47
48 #include <sys/param.h>
49 #include <sys/_bitset.h>
50 #include <sys/bitset.h>
51 #include <sys/bus.h>
52 #include <sys/conf.h>
53 #include <sys/endian.h>
54 #include <sys/fcntl.h>
55 #include <sys/filio.h>
56 #include <sys/hash.h>
57 #include <sys/interrupt.h>
58 #include <sys/jail.h>
59 #include <sys/kernel.h>
60 #include <sys/kthread.h>
61 #include <sys/lock.h>
62 #include <sys/mbuf.h>
63 #include <sys/module.h>
64 #include <sys/nv.h>
65 #include <sys/proc.h>
66 #include <sys/sdt.h>
67 #include <sys/smp.h>
68 #include <sys/socket.h>
69 #include <sys/sysctl.h>
70 #include <sys/md5.h>
71 #include <sys/ucred.h>
72
73 #include <net/if.h>
74 #include <net/if_var.h>
75 #include <net/vnet.h>
76 #include <net/route.h>
77 #include <net/pfil.h>
78 #include <net/pfvar.h>
79 #include <net/if_pfsync.h>
80 #include <net/if_pflog.h>
81
82 #include <netinet/in.h>
83 #include <netinet/ip.h>
84 #include <netinet/ip_var.h>
85 #include <netinet6/ip6_var.h>
86 #include <netinet/ip_icmp.h>
87 #include <netpfil/pf/pf_nv.h>
88
89 #ifdef INET6
90 #include <netinet/ip6.h>
91 #endif /* INET6 */
92
93 #ifdef ALTQ
94 #include <net/altq/altq.h>
95 #endif
96
97 SDT_PROVIDER_DECLARE(pf);
98 SDT_PROBE_DEFINE3(pf, ioctl, ioctl, error, "int", "int", "int");
99 SDT_PROBE_DEFINE3(pf, ioctl, function, error, "char *", "int", "int");
100 SDT_PROBE_DEFINE2(pf, ioctl, addrule, error, "int", "int");
101 SDT_PROBE_DEFINE2(pf, ioctl, nvchk, error, "int", "int");
102
103 static struct pf_kpool *pf_get_kpool(char *, u_int32_t, u_int8_t, u_int32_t,
104 u_int8_t, u_int8_t, u_int8_t);
105
106 static void pf_mv_kpool(struct pf_kpalist *, struct pf_kpalist *);
107 static void pf_empty_kpool(struct pf_kpalist *);
108 static int pfioctl(struct cdev *, u_long, caddr_t, int,
109 struct thread *);
110 #ifdef ALTQ
111 static int pf_begin_altq(u_int32_t *);
112 static int pf_rollback_altq(u_int32_t);
113 static int pf_commit_altq(u_int32_t);
114 static int pf_enable_altq(struct pf_altq *);
115 static int pf_disable_altq(struct pf_altq *);
116 static uint16_t pf_qname2qid(char *);
117 static void pf_qid_unref(uint16_t);
118 #endif /* ALTQ */
119 static int pf_begin_rules(u_int32_t *, int, const char *);
120 static int pf_rollback_rules(u_int32_t, int, char *);
121 static int pf_setup_pfsync_matching(struct pf_kruleset *);
122 static void pf_hash_rule(MD5_CTX *, struct pf_krule *);
123 static void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
124 static int pf_commit_rules(u_int32_t, int, char *);
125 static int pf_addr_setup(struct pf_kruleset *,
126 struct pf_addr_wrap *, sa_family_t);
127 static void pf_addr_copyout(struct pf_addr_wrap *);
128 static void pf_src_node_copy(const struct pf_ksrc_node *,
129 struct pf_src_node *);
130 #ifdef ALTQ
131 static int pf_export_kaltq(struct pf_altq *,
132 struct pfioc_altq_v1 *, size_t);
133 static int pf_import_kaltq(struct pfioc_altq_v1 *,
134 struct pf_altq *, size_t);
135 #endif /* ALTQ */
136
137 VNET_DEFINE(struct pf_krule, pf_default_rule);
138
139 #ifdef ALTQ
140 VNET_DEFINE_STATIC(int, pf_altq_running);
141 #define V_pf_altq_running VNET(pf_altq_running)
142 #endif
143
144 #define TAGID_MAX 50000
145 struct pf_tagname {
146 TAILQ_ENTRY(pf_tagname) namehash_entries;
147 TAILQ_ENTRY(pf_tagname) taghash_entries;
148 char name[PF_TAG_NAME_SIZE];
149 uint16_t tag;
150 int ref;
151 };
152
153 struct pf_tagset {
154 TAILQ_HEAD(, pf_tagname) *namehash;
155 TAILQ_HEAD(, pf_tagname) *taghash;
156 unsigned int mask;
157 uint32_t seed;
158 BITSET_DEFINE(, TAGID_MAX) avail;
159 };
160
161 VNET_DEFINE(struct pf_tagset, pf_tags);
162 #define V_pf_tags VNET(pf_tags)
163 static unsigned int pf_rule_tag_hashsize;
164 #define PF_RULE_TAG_HASH_SIZE_DEFAULT 128
165 SYSCTL_UINT(_net_pf, OID_AUTO, rule_tag_hashsize, CTLFLAG_RDTUN,
166 &pf_rule_tag_hashsize, PF_RULE_TAG_HASH_SIZE_DEFAULT,
167 "Size of pf(4) rule tag hashtable");
168
169 #ifdef ALTQ
170 VNET_DEFINE(struct pf_tagset, pf_qids);
171 #define V_pf_qids VNET(pf_qids)
172 static unsigned int pf_queue_tag_hashsize;
173 #define PF_QUEUE_TAG_HASH_SIZE_DEFAULT 128
174 SYSCTL_UINT(_net_pf, OID_AUTO, queue_tag_hashsize, CTLFLAG_RDTUN,
175 &pf_queue_tag_hashsize, PF_QUEUE_TAG_HASH_SIZE_DEFAULT,
176 "Size of pf(4) queue tag hashtable");
177 #endif
178 VNET_DEFINE(uma_zone_t, pf_tag_z);
179 #define V_pf_tag_z VNET(pf_tag_z)
180 static MALLOC_DEFINE(M_PFALTQ, "pf_altq", "pf(4) altq configuration db");
181 static MALLOC_DEFINE(M_PFRULE, "pf_rule", "pf(4) rules");
182
183 #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
184 #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
185 #endif
186
187 static void pf_init_tagset(struct pf_tagset *, unsigned int *,
188 unsigned int);
189 static void pf_cleanup_tagset(struct pf_tagset *);
190 static uint16_t tagname2hashindex(const struct pf_tagset *, const char *);
191 static uint16_t tag2hashindex(const struct pf_tagset *, uint16_t);
192 static u_int16_t tagname2tag(struct pf_tagset *, char *);
193 static u_int16_t pf_tagname2tag(char *);
194 static void tag_unref(struct pf_tagset *, u_int16_t);
195
196 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
197
198 struct cdev *pf_dev;
199
200 /*
201 * XXX - These are new and need to be checked when moveing to a new version
202 */
203 static void pf_clear_all_states(void);
204 static unsigned int pf_clear_states(const struct pf_kstate_kill *);
205 static void pf_killstates(struct pf_kstate_kill *,
206 unsigned int *);
207 static int pf_killstates_row(struct pf_kstate_kill *,
208 struct pf_idhash *);
209 static int pf_killstates_nv(struct pfioc_nv *);
210 static int pf_clearstates_nv(struct pfioc_nv *);
211 static int pf_getstate(struct pfioc_nv *);
212 static int pf_getstatus(struct pfioc_nv *);
213 static int pf_clear_tables(void);
214 static void pf_clear_srcnodes(struct pf_ksrc_node *);
215 static void pf_kill_srcnodes(struct pfioc_src_node_kill *);
216 static int pf_keepcounters(struct pfioc_nv *);
217 static void pf_tbladdr_copyout(struct pf_addr_wrap *);
218
219 /*
220 * Wrapper functions for pfil(9) hooks
221 */
222 #ifdef INET
223 static int pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp,
224 int dir, int flags, struct inpcb *inp);
225 static int pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp,
226 int dir, int flags, struct inpcb *inp);
227 #endif
228 #ifdef INET6
229 static int pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp,
230 int dir, int flags, struct inpcb *inp);
231 static int pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp,
232 int dir, int flags, struct inpcb *inp);
233 #endif
234
235 static int hook_pf(void);
236 static int dehook_pf(void);
237 static int shutdown_pf(void);
238 static int pf_load(void);
239 static void pf_unload(void);
240
241 static struct cdevsw pf_cdevsw = {
242 .d_ioctl = pfioctl,
243 .d_name = PF_NAME,
244 .d_version = D_VERSION,
245 };
246
247 volatile VNET_DEFINE_STATIC(int, pf_pfil_hooked);
248 #define V_pf_pfil_hooked VNET(pf_pfil_hooked)
249
250 /*
251 * We need a flag that is neither hooked nor running to know when
252 * the VNET is "valid". We primarily need this to control (global)
253 * external event, e.g., eventhandlers.
254 */
255 VNET_DEFINE(int, pf_vnet_active);
256 #define V_pf_vnet_active VNET(pf_vnet_active)
257
258 int pf_end_threads;
259 struct proc *pf_purge_proc;
260
261 struct rmlock pf_rules_lock;
262 struct sx pf_ioctl_lock;
263 struct sx pf_end_lock;
264
265 /* pfsync */
266 VNET_DEFINE(pfsync_state_import_t *, pfsync_state_import_ptr);
267 VNET_DEFINE(pfsync_insert_state_t *, pfsync_insert_state_ptr);
268 VNET_DEFINE(pfsync_update_state_t *, pfsync_update_state_ptr);
269 VNET_DEFINE(pfsync_delete_state_t *, pfsync_delete_state_ptr);
270 VNET_DEFINE(pfsync_clear_states_t *, pfsync_clear_states_ptr);
271 VNET_DEFINE(pfsync_defer_t *, pfsync_defer_ptr);
272 pfsync_detach_ifnet_t *pfsync_detach_ifnet_ptr;
273
274 /* pflog */
275 pflog_packet_t *pflog_packet_ptr = NULL;
276
277 #define ERROUT_FUNCTION(target, x) \
278 do { \
279 error = (x); \
280 SDT_PROBE3(pf, ioctl, function, error, __func__, error, \
281 __LINE__); \
282 goto target; \
283 } while (0)
284
285 static void
pfattach_vnet(void)286 pfattach_vnet(void)
287 {
288 u_int32_t *my_timeout = V_pf_default_rule.timeout;
289
290 pf_initialize();
291 pfr_initialize();
292 pfi_initialize_vnet();
293 pf_normalize_init();
294 pf_syncookies_init();
295
296 V_pf_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT;
297 V_pf_limits[PF_LIMIT_SRC_NODES].limit = PFSNODE_HIWAT;
298
299 RB_INIT(&V_pf_anchors);
300 pf_init_kruleset(&pf_main_ruleset);
301
302 /* default rule should never be garbage collected */
303 V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next;
304 #ifdef PF_DEFAULT_TO_DROP
305 V_pf_default_rule.action = PF_DROP;
306 #else
307 V_pf_default_rule.action = PF_PASS;
308 #endif
309 V_pf_default_rule.nr = -1;
310 V_pf_default_rule.rtableid = -1;
311
312 pf_counter_u64_init(&V_pf_default_rule.evaluations, M_WAITOK);
313 for (int i = 0; i < 2; i++) {
314 pf_counter_u64_init(&V_pf_default_rule.packets[i], M_WAITOK);
315 pf_counter_u64_init(&V_pf_default_rule.bytes[i], M_WAITOK);
316 }
317 V_pf_default_rule.states_cur = counter_u64_alloc(M_WAITOK);
318 V_pf_default_rule.states_tot = counter_u64_alloc(M_WAITOK);
319 V_pf_default_rule.src_nodes = counter_u64_alloc(M_WAITOK);
320
321 #ifdef PF_WANT_32_TO_64_COUNTER
322 V_pf_kifmarker = malloc(sizeof(*V_pf_kifmarker), PFI_MTYPE, M_WAITOK | M_ZERO);
323 V_pf_rulemarker = malloc(sizeof(*V_pf_rulemarker), M_PFRULE, M_WAITOK | M_ZERO);
324 PF_RULES_WLOCK();
325 LIST_INSERT_HEAD(&V_pf_allkiflist, V_pf_kifmarker, pfik_allkiflist);
326 LIST_INSERT_HEAD(&V_pf_allrulelist, &V_pf_default_rule, allrulelist);
327 V_pf_allrulecount++;
328 LIST_INSERT_HEAD(&V_pf_allrulelist, V_pf_rulemarker, allrulelist);
329 PF_RULES_WUNLOCK();
330 #endif
331
332 /* initialize default timeouts */
333 my_timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
334 my_timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
335 my_timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
336 my_timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
337 my_timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
338 my_timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
339 my_timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
340 my_timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
341 my_timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
342 my_timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
343 my_timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
344 my_timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
345 my_timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
346 my_timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
347 my_timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
348 my_timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
349 my_timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
350 my_timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
351 my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
352 my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
353
354 bzero(&V_pf_status, sizeof(V_pf_status));
355 V_pf_status.debug = PF_DEBUG_URGENT;
356
357 V_pf_pfil_hooked = 0;
358
359 /* XXX do our best to avoid a conflict */
360 V_pf_status.hostid = arc4random();
361
362 for (int i = 0; i < PFRES_MAX; i++)
363 V_pf_status.counters[i] = counter_u64_alloc(M_WAITOK);
364 for (int i = 0; i < KLCNT_MAX; i++)
365 V_pf_status.lcounters[i] = counter_u64_alloc(M_WAITOK);
366 for (int i = 0; i < FCNT_MAX; i++)
367 pf_counter_u64_init(&V_pf_status.fcounters[i], M_WAITOK);
368 for (int i = 0; i < SCNT_MAX; i++)
369 V_pf_status.scounters[i] = counter_u64_alloc(M_WAITOK);
370
371 if (swi_add(&V_pf_swi_ie, "pf send", pf_intr, curvnet, SWI_NET,
372 INTR_MPSAFE, &V_pf_swi_cookie) != 0)
373 /* XXXGL: leaked all above. */
374 return;
375 }
376
377 static struct pf_kpool *
pf_get_kpool(char * anchor,u_int32_t ticket,u_int8_t rule_action,u_int32_t rule_number,u_int8_t r_last,u_int8_t active,u_int8_t check_ticket)378 pf_get_kpool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
379 u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
380 u_int8_t check_ticket)
381 {
382 struct pf_kruleset *ruleset;
383 struct pf_krule *rule;
384 int rs_num;
385
386 ruleset = pf_find_kruleset(anchor);
387 if (ruleset == NULL)
388 return (NULL);
389 rs_num = pf_get_ruleset_number(rule_action);
390 if (rs_num >= PF_RULESET_MAX)
391 return (NULL);
392 if (active) {
393 if (check_ticket && ticket !=
394 ruleset->rules[rs_num].active.ticket)
395 return (NULL);
396 if (r_last)
397 rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
398 pf_krulequeue);
399 else
400 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
401 } else {
402 if (check_ticket && ticket !=
403 ruleset->rules[rs_num].inactive.ticket)
404 return (NULL);
405 if (r_last)
406 rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
407 pf_krulequeue);
408 else
409 rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
410 }
411 if (!r_last) {
412 while ((rule != NULL) && (rule->nr != rule_number))
413 rule = TAILQ_NEXT(rule, entries);
414 }
415 if (rule == NULL)
416 return (NULL);
417
418 return (&rule->rpool);
419 }
420
421 static void
pf_mv_kpool(struct pf_kpalist * poola,struct pf_kpalist * poolb)422 pf_mv_kpool(struct pf_kpalist *poola, struct pf_kpalist *poolb)
423 {
424 struct pf_kpooladdr *mv_pool_pa;
425
426 while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
427 TAILQ_REMOVE(poola, mv_pool_pa, entries);
428 TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
429 }
430 }
431
432 static void
pf_empty_kpool(struct pf_kpalist * poola)433 pf_empty_kpool(struct pf_kpalist *poola)
434 {
435 struct pf_kpooladdr *pa;
436
437 while ((pa = TAILQ_FIRST(poola)) != NULL) {
438 switch (pa->addr.type) {
439 case PF_ADDR_DYNIFTL:
440 pfi_dynaddr_remove(pa->addr.p.dyn);
441 break;
442 case PF_ADDR_TABLE:
443 /* XXX: this could be unfinished pooladdr on pabuf */
444 if (pa->addr.p.tbl != NULL)
445 pfr_detach_table(pa->addr.p.tbl);
446 break;
447 }
448 if (pa->kif)
449 pfi_kkif_unref(pa->kif);
450 TAILQ_REMOVE(poola, pa, entries);
451 free(pa, M_PFRULE);
452 }
453 }
454
455 static void
pf_unlink_rule_locked(struct pf_krulequeue * rulequeue,struct pf_krule * rule)456 pf_unlink_rule_locked(struct pf_krulequeue *rulequeue, struct pf_krule *rule)
457 {
458
459 PF_RULES_WASSERT();
460 PF_UNLNKDRULES_ASSERT();
461
462 TAILQ_REMOVE(rulequeue, rule, entries);
463
464 rule->rule_ref |= PFRULE_REFS;
465 TAILQ_INSERT_TAIL(&V_pf_unlinked_rules, rule, entries);
466 }
467
468 static void
pf_unlink_rule(struct pf_krulequeue * rulequeue,struct pf_krule * rule)469 pf_unlink_rule(struct pf_krulequeue *rulequeue, struct pf_krule *rule)
470 {
471
472 PF_RULES_WASSERT();
473
474 PF_UNLNKDRULES_LOCK();
475 pf_unlink_rule_locked(rulequeue, rule);
476 PF_UNLNKDRULES_UNLOCK();
477 }
478
479 void
pf_free_rule(struct pf_krule * rule)480 pf_free_rule(struct pf_krule *rule)
481 {
482
483 PF_RULES_WASSERT();
484
485 if (rule->tag)
486 tag_unref(&V_pf_tags, rule->tag);
487 if (rule->match_tag)
488 tag_unref(&V_pf_tags, rule->match_tag);
489 #ifdef ALTQ
490 if (rule->pqid != rule->qid)
491 pf_qid_unref(rule->pqid);
492 pf_qid_unref(rule->qid);
493 #endif
494 switch (rule->src.addr.type) {
495 case PF_ADDR_DYNIFTL:
496 pfi_dynaddr_remove(rule->src.addr.p.dyn);
497 break;
498 case PF_ADDR_TABLE:
499 pfr_detach_table(rule->src.addr.p.tbl);
500 break;
501 }
502 switch (rule->dst.addr.type) {
503 case PF_ADDR_DYNIFTL:
504 pfi_dynaddr_remove(rule->dst.addr.p.dyn);
505 break;
506 case PF_ADDR_TABLE:
507 pfr_detach_table(rule->dst.addr.p.tbl);
508 break;
509 }
510 if (rule->overload_tbl)
511 pfr_detach_table(rule->overload_tbl);
512 if (rule->kif)
513 pfi_kkif_unref(rule->kif);
514 pf_kanchor_remove(rule);
515 pf_empty_kpool(&rule->rpool.list);
516
517 pf_krule_free(rule);
518 }
519
520 static void
pf_init_tagset(struct pf_tagset * ts,unsigned int * tunable_size,unsigned int default_size)521 pf_init_tagset(struct pf_tagset *ts, unsigned int *tunable_size,
522 unsigned int default_size)
523 {
524 unsigned int i;
525 unsigned int hashsize;
526
527 if (*tunable_size == 0 || !powerof2(*tunable_size))
528 *tunable_size = default_size;
529
530 hashsize = *tunable_size;
531 ts->namehash = mallocarray(hashsize, sizeof(*ts->namehash), M_PFHASH,
532 M_WAITOK);
533 ts->taghash = mallocarray(hashsize, sizeof(*ts->taghash), M_PFHASH,
534 M_WAITOK);
535 ts->mask = hashsize - 1;
536 ts->seed = arc4random();
537 for (i = 0; i < hashsize; i++) {
538 TAILQ_INIT(&ts->namehash[i]);
539 TAILQ_INIT(&ts->taghash[i]);
540 }
541 BIT_FILL(TAGID_MAX, &ts->avail);
542 }
543
544 static void
pf_cleanup_tagset(struct pf_tagset * ts)545 pf_cleanup_tagset(struct pf_tagset *ts)
546 {
547 unsigned int i;
548 unsigned int hashsize;
549 struct pf_tagname *t, *tmp;
550
551 /*
552 * Only need to clean up one of the hashes as each tag is hashed
553 * into each table.
554 */
555 hashsize = ts->mask + 1;
556 for (i = 0; i < hashsize; i++)
557 TAILQ_FOREACH_SAFE(t, &ts->namehash[i], namehash_entries, tmp)
558 uma_zfree(V_pf_tag_z, t);
559
560 free(ts->namehash, M_PFHASH);
561 free(ts->taghash, M_PFHASH);
562 }
563
564 static uint16_t
tagname2hashindex(const struct pf_tagset * ts,const char * tagname)565 tagname2hashindex(const struct pf_tagset *ts, const char *tagname)
566 {
567 size_t len;
568
569 len = strnlen(tagname, PF_TAG_NAME_SIZE - 1);
570 return (murmur3_32_hash(tagname, len, ts->seed) & ts->mask);
571 }
572
573 static uint16_t
tag2hashindex(const struct pf_tagset * ts,uint16_t tag)574 tag2hashindex(const struct pf_tagset *ts, uint16_t tag)
575 {
576
577 return (tag & ts->mask);
578 }
579
580 static u_int16_t
tagname2tag(struct pf_tagset * ts,char * tagname)581 tagname2tag(struct pf_tagset *ts, char *tagname)
582 {
583 struct pf_tagname *tag;
584 u_int32_t index;
585 u_int16_t new_tagid;
586
587 PF_RULES_WASSERT();
588
589 index = tagname2hashindex(ts, tagname);
590 TAILQ_FOREACH(tag, &ts->namehash[index], namehash_entries)
591 if (strcmp(tagname, tag->name) == 0) {
592 tag->ref++;
593 return (tag->tag);
594 }
595
596 /*
597 * new entry
598 *
599 * to avoid fragmentation, we do a linear search from the beginning
600 * and take the first free slot we find.
601 */
602 new_tagid = BIT_FFS(TAGID_MAX, &ts->avail);
603 /*
604 * Tags are 1-based, with valid tags in the range [1..TAGID_MAX].
605 * BIT_FFS() returns a 1-based bit number, with 0 indicating no bits
606 * set. It may also return a bit number greater than TAGID_MAX due
607 * to rounding of the number of bits in the vector up to a multiple
608 * of the vector word size at declaration/allocation time.
609 */
610 if ((new_tagid == 0) || (new_tagid > TAGID_MAX))
611 return (0);
612
613 /* Mark the tag as in use. Bits are 0-based for BIT_CLR() */
614 BIT_CLR(TAGID_MAX, new_tagid - 1, &ts->avail);
615
616 /* allocate and fill new struct pf_tagname */
617 tag = uma_zalloc(V_pf_tag_z, M_NOWAIT);
618 if (tag == NULL)
619 return (0);
620 strlcpy(tag->name, tagname, sizeof(tag->name));
621 tag->tag = new_tagid;
622 tag->ref = 1;
623
624 /* Insert into namehash */
625 TAILQ_INSERT_TAIL(&ts->namehash[index], tag, namehash_entries);
626
627 /* Insert into taghash */
628 index = tag2hashindex(ts, new_tagid);
629 TAILQ_INSERT_TAIL(&ts->taghash[index], tag, taghash_entries);
630
631 return (tag->tag);
632 }
633
634 static void
tag_unref(struct pf_tagset * ts,u_int16_t tag)635 tag_unref(struct pf_tagset *ts, u_int16_t tag)
636 {
637 struct pf_tagname *t;
638 uint16_t index;
639
640 PF_RULES_WASSERT();
641
642 index = tag2hashindex(ts, tag);
643 TAILQ_FOREACH(t, &ts->taghash[index], taghash_entries)
644 if (tag == t->tag) {
645 if (--t->ref == 0) {
646 TAILQ_REMOVE(&ts->taghash[index], t,
647 taghash_entries);
648 index = tagname2hashindex(ts, t->name);
649 TAILQ_REMOVE(&ts->namehash[index], t,
650 namehash_entries);
651 /* Bits are 0-based for BIT_SET() */
652 BIT_SET(TAGID_MAX, tag - 1, &ts->avail);
653 uma_zfree(V_pf_tag_z, t);
654 }
655 break;
656 }
657 }
658
659 static u_int16_t
pf_tagname2tag(char * tagname)660 pf_tagname2tag(char *tagname)
661 {
662 return (tagname2tag(&V_pf_tags, tagname));
663 }
664
665 #ifdef ALTQ
666 static uint16_t
pf_qname2qid(char * qname)667 pf_qname2qid(char *qname)
668 {
669 return (tagname2tag(&V_pf_qids, qname));
670 }
671
672 static void
pf_qid_unref(uint16_t qid)673 pf_qid_unref(uint16_t qid)
674 {
675 tag_unref(&V_pf_qids, qid);
676 }
677
678 static int
pf_begin_altq(u_int32_t * ticket)679 pf_begin_altq(u_int32_t *ticket)
680 {
681 struct pf_altq *altq, *tmp;
682 int error = 0;
683
684 PF_RULES_WASSERT();
685
686 /* Purge the old altq lists */
687 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) {
688 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
689 /* detach and destroy the discipline */
690 error = altq_remove(altq);
691 }
692 free(altq, M_PFALTQ);
693 }
694 TAILQ_INIT(V_pf_altq_ifs_inactive);
695 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) {
696 pf_qid_unref(altq->qid);
697 free(altq, M_PFALTQ);
698 }
699 TAILQ_INIT(V_pf_altqs_inactive);
700 if (error)
701 return (error);
702 *ticket = ++V_ticket_altqs_inactive;
703 V_altqs_inactive_open = 1;
704 return (0);
705 }
706
707 static int
pf_rollback_altq(u_int32_t ticket)708 pf_rollback_altq(u_int32_t ticket)
709 {
710 struct pf_altq *altq, *tmp;
711 int error = 0;
712
713 PF_RULES_WASSERT();
714
715 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive)
716 return (0);
717 /* Purge the old altq lists */
718 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) {
719 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
720 /* detach and destroy the discipline */
721 error = altq_remove(altq);
722 }
723 free(altq, M_PFALTQ);
724 }
725 TAILQ_INIT(V_pf_altq_ifs_inactive);
726 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) {
727 pf_qid_unref(altq->qid);
728 free(altq, M_PFALTQ);
729 }
730 TAILQ_INIT(V_pf_altqs_inactive);
731 V_altqs_inactive_open = 0;
732 return (error);
733 }
734
735 static int
pf_commit_altq(u_int32_t ticket)736 pf_commit_altq(u_int32_t ticket)
737 {
738 struct pf_altqqueue *old_altqs, *old_altq_ifs;
739 struct pf_altq *altq, *tmp;
740 int err, error = 0;
741
742 PF_RULES_WASSERT();
743
744 if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive)
745 return (EBUSY);
746
747 /* swap altqs, keep the old. */
748 old_altqs = V_pf_altqs_active;
749 old_altq_ifs = V_pf_altq_ifs_active;
750 V_pf_altqs_active = V_pf_altqs_inactive;
751 V_pf_altq_ifs_active = V_pf_altq_ifs_inactive;
752 V_pf_altqs_inactive = old_altqs;
753 V_pf_altq_ifs_inactive = old_altq_ifs;
754 V_ticket_altqs_active = V_ticket_altqs_inactive;
755
756 /* Attach new disciplines */
757 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
758 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
759 /* attach the discipline */
760 error = altq_pfattach(altq);
761 if (error == 0 && V_pf_altq_running)
762 error = pf_enable_altq(altq);
763 if (error != 0)
764 return (error);
765 }
766 }
767
768 /* Purge the old altq lists */
769 TAILQ_FOREACH_SAFE(altq, V_pf_altq_ifs_inactive, entries, tmp) {
770 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
771 /* detach and destroy the discipline */
772 if (V_pf_altq_running)
773 error = pf_disable_altq(altq);
774 err = altq_pfdetach(altq);
775 if (err != 0 && error == 0)
776 error = err;
777 err = altq_remove(altq);
778 if (err != 0 && error == 0)
779 error = err;
780 }
781 free(altq, M_PFALTQ);
782 }
783 TAILQ_INIT(V_pf_altq_ifs_inactive);
784 TAILQ_FOREACH_SAFE(altq, V_pf_altqs_inactive, entries, tmp) {
785 pf_qid_unref(altq->qid);
786 free(altq, M_PFALTQ);
787 }
788 TAILQ_INIT(V_pf_altqs_inactive);
789
790 V_altqs_inactive_open = 0;
791 return (error);
792 }
793
794 static int
pf_enable_altq(struct pf_altq * altq)795 pf_enable_altq(struct pf_altq *altq)
796 {
797 struct ifnet *ifp;
798 struct tb_profile tb;
799 int error = 0;
800
801 if ((ifp = ifunit(altq->ifname)) == NULL)
802 return (EINVAL);
803
804 if (ifp->if_snd.altq_type != ALTQT_NONE)
805 error = altq_enable(&ifp->if_snd);
806
807 /* set tokenbucket regulator */
808 if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
809 tb.rate = altq->ifbandwidth;
810 tb.depth = altq->tbrsize;
811 error = tbr_set(&ifp->if_snd, &tb);
812 }
813
814 return (error);
815 }
816
817 static int
pf_disable_altq(struct pf_altq * altq)818 pf_disable_altq(struct pf_altq *altq)
819 {
820 struct ifnet *ifp;
821 struct tb_profile tb;
822 int error;
823
824 if ((ifp = ifunit(altq->ifname)) == NULL)
825 return (EINVAL);
826
827 /*
828 * when the discipline is no longer referenced, it was overridden
829 * by a new one. if so, just return.
830 */
831 if (altq->altq_disc != ifp->if_snd.altq_disc)
832 return (0);
833
834 error = altq_disable(&ifp->if_snd);
835
836 if (error == 0) {
837 /* clear tokenbucket regulator */
838 tb.rate = 0;
839 error = tbr_set(&ifp->if_snd, &tb);
840 }
841
842 return (error);
843 }
844
845 static int
pf_altq_ifnet_event_add(struct ifnet * ifp,int remove,u_int32_t ticket,struct pf_altq * altq)846 pf_altq_ifnet_event_add(struct ifnet *ifp, int remove, u_int32_t ticket,
847 struct pf_altq *altq)
848 {
849 struct ifnet *ifp1;
850 int error = 0;
851
852 /* Deactivate the interface in question */
853 altq->local_flags &= ~PFALTQ_FLAG_IF_REMOVED;
854 if ((ifp1 = ifunit(altq->ifname)) == NULL ||
855 (remove && ifp1 == ifp)) {
856 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED;
857 } else {
858 error = altq_add(ifp1, altq);
859
860 if (ticket != V_ticket_altqs_inactive)
861 error = EBUSY;
862
863 if (error)
864 free(altq, M_PFALTQ);
865 }
866
867 return (error);
868 }
869
870 void
pf_altq_ifnet_event(struct ifnet * ifp,int remove)871 pf_altq_ifnet_event(struct ifnet *ifp, int remove)
872 {
873 struct pf_altq *a1, *a2, *a3;
874 u_int32_t ticket;
875 int error = 0;
876
877 /*
878 * No need to re-evaluate the configuration for events on interfaces
879 * that do not support ALTQ, as it's not possible for such
880 * interfaces to be part of the configuration.
881 */
882 if (!ALTQ_IS_READY(&ifp->if_snd))
883 return;
884
885 /* Interrupt userland queue modifications */
886 if (V_altqs_inactive_open)
887 pf_rollback_altq(V_ticket_altqs_inactive);
888
889 /* Start new altq ruleset */
890 if (pf_begin_altq(&ticket))
891 return;
892
893 /* Copy the current active set */
894 TAILQ_FOREACH(a1, V_pf_altq_ifs_active, entries) {
895 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT);
896 if (a2 == NULL) {
897 error = ENOMEM;
898 break;
899 }
900 bcopy(a1, a2, sizeof(struct pf_altq));
901
902 error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2);
903 if (error)
904 break;
905
906 TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, a2, entries);
907 }
908 if (error)
909 goto out;
910 TAILQ_FOREACH(a1, V_pf_altqs_active, entries) {
911 a2 = malloc(sizeof(*a2), M_PFALTQ, M_NOWAIT);
912 if (a2 == NULL) {
913 error = ENOMEM;
914 break;
915 }
916 bcopy(a1, a2, sizeof(struct pf_altq));
917
918 if ((a2->qid = pf_qname2qid(a2->qname)) == 0) {
919 error = EBUSY;
920 free(a2, M_PFALTQ);
921 break;
922 }
923 a2->altq_disc = NULL;
924 TAILQ_FOREACH(a3, V_pf_altq_ifs_inactive, entries) {
925 if (strncmp(a3->ifname, a2->ifname,
926 IFNAMSIZ) == 0) {
927 a2->altq_disc = a3->altq_disc;
928 break;
929 }
930 }
931 error = pf_altq_ifnet_event_add(ifp, remove, ticket, a2);
932 if (error)
933 break;
934
935 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, a2, entries);
936 }
937
938 out:
939 if (error != 0)
940 pf_rollback_altq(ticket);
941 else
942 pf_commit_altq(ticket);
943 }
944 #endif /* ALTQ */
945
946 static int
pf_begin_rules(u_int32_t * ticket,int rs_num,const char * anchor)947 pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
948 {
949 struct pf_kruleset *rs;
950 struct pf_krule *rule;
951
952 PF_RULES_WASSERT();
953
954 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
955 return (EINVAL);
956 rs = pf_find_or_create_kruleset(anchor);
957 if (rs == NULL)
958 return (EINVAL);
959 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
960 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule);
961 rs->rules[rs_num].inactive.rcount--;
962 }
963 *ticket = ++rs->rules[rs_num].inactive.ticket;
964 rs->rules[rs_num].inactive.open = 1;
965 return (0);
966 }
967
968 static int
pf_rollback_rules(u_int32_t ticket,int rs_num,char * anchor)969 pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
970 {
971 struct pf_kruleset *rs;
972 struct pf_krule *rule;
973
974 PF_RULES_WASSERT();
975
976 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
977 return (EINVAL);
978 rs = pf_find_kruleset(anchor);
979 if (rs == NULL || !rs->rules[rs_num].inactive.open ||
980 rs->rules[rs_num].inactive.ticket != ticket)
981 return (0);
982 while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
983 pf_unlink_rule(rs->rules[rs_num].inactive.ptr, rule);
984 rs->rules[rs_num].inactive.rcount--;
985 }
986 rs->rules[rs_num].inactive.open = 0;
987 return (0);
988 }
989
990 #define PF_MD5_UPD(st, elm) \
991 MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm))
992
993 #define PF_MD5_UPD_STR(st, elm) \
994 MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm))
995
996 #define PF_MD5_UPD_HTONL(st, elm, stor) do { \
997 (stor) = htonl((st)->elm); \
998 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\
999 } while (0)
1000
1001 #define PF_MD5_UPD_HTONS(st, elm, stor) do { \
1002 (stor) = htons((st)->elm); \
1003 MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\
1004 } while (0)
1005
1006 static void
pf_hash_rule_addr(MD5_CTX * ctx,struct pf_rule_addr * pfr)1007 pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
1008 {
1009 PF_MD5_UPD(pfr, addr.type);
1010 switch (pfr->addr.type) {
1011 case PF_ADDR_DYNIFTL:
1012 PF_MD5_UPD(pfr, addr.v.ifname);
1013 PF_MD5_UPD(pfr, addr.iflags);
1014 break;
1015 case PF_ADDR_TABLE:
1016 PF_MD5_UPD(pfr, addr.v.tblname);
1017 break;
1018 case PF_ADDR_ADDRMASK:
1019 /* XXX ignore af? */
1020 PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
1021 PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
1022 break;
1023 }
1024
1025 PF_MD5_UPD(pfr, port[0]);
1026 PF_MD5_UPD(pfr, port[1]);
1027 PF_MD5_UPD(pfr, neg);
1028 PF_MD5_UPD(pfr, port_op);
1029 }
1030
1031 static void
pf_hash_rule(MD5_CTX * ctx,struct pf_krule * rule)1032 pf_hash_rule(MD5_CTX *ctx, struct pf_krule *rule)
1033 {
1034 u_int16_t x;
1035 u_int32_t y;
1036
1037 pf_hash_rule_addr(ctx, &rule->src);
1038 pf_hash_rule_addr(ctx, &rule->dst);
1039 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
1040 PF_MD5_UPD_STR(rule, label[i]);
1041 PF_MD5_UPD_STR(rule, ifname);
1042 PF_MD5_UPD_STR(rule, match_tagname);
1043 PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
1044 PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
1045 PF_MD5_UPD_HTONL(rule, prob, y);
1046 PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
1047 PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
1048 PF_MD5_UPD(rule, uid.op);
1049 PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
1050 PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
1051 PF_MD5_UPD(rule, gid.op);
1052 PF_MD5_UPD_HTONL(rule, rule_flag, y);
1053 PF_MD5_UPD(rule, action);
1054 PF_MD5_UPD(rule, direction);
1055 PF_MD5_UPD(rule, af);
1056 PF_MD5_UPD(rule, quick);
1057 PF_MD5_UPD(rule, ifnot);
1058 PF_MD5_UPD(rule, match_tag_not);
1059 PF_MD5_UPD(rule, natpass);
1060 PF_MD5_UPD(rule, keep_state);
1061 PF_MD5_UPD(rule, proto);
1062 PF_MD5_UPD(rule, type);
1063 PF_MD5_UPD(rule, code);
1064 PF_MD5_UPD(rule, flags);
1065 PF_MD5_UPD(rule, flagset);
1066 PF_MD5_UPD(rule, allow_opts);
1067 PF_MD5_UPD(rule, rt);
1068 PF_MD5_UPD(rule, tos);
1069 }
1070
1071 static bool
pf_krule_compare(struct pf_krule * a,struct pf_krule * b)1072 pf_krule_compare(struct pf_krule *a, struct pf_krule *b)
1073 {
1074 MD5_CTX ctx[2];
1075 u_int8_t digest[2][PF_MD5_DIGEST_LENGTH];
1076
1077 MD5Init(&ctx[0]);
1078 MD5Init(&ctx[1]);
1079 pf_hash_rule(&ctx[0], a);
1080 pf_hash_rule(&ctx[1], b);
1081 MD5Final(digest[0], &ctx[0]);
1082 MD5Final(digest[1], &ctx[1]);
1083
1084 return (memcmp(digest[0], digest[1], PF_MD5_DIGEST_LENGTH) == 0);
1085 }
1086
1087 static int
pf_commit_rules(u_int32_t ticket,int rs_num,char * anchor)1088 pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
1089 {
1090 struct pf_kruleset *rs;
1091 struct pf_krule *rule, **old_array, *tail;
1092 struct pf_krulequeue *old_rules;
1093 int error;
1094 u_int32_t old_rcount;
1095
1096 PF_RULES_WASSERT();
1097
1098 if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
1099 return (EINVAL);
1100 rs = pf_find_kruleset(anchor);
1101 if (rs == NULL || !rs->rules[rs_num].inactive.open ||
1102 ticket != rs->rules[rs_num].inactive.ticket)
1103 return (EBUSY);
1104
1105 /* Calculate checksum for the main ruleset */
1106 if (rs == &pf_main_ruleset) {
1107 error = pf_setup_pfsync_matching(rs);
1108 if (error != 0)
1109 return (error);
1110 }
1111
1112 /* Swap rules, keep the old. */
1113 old_rules = rs->rules[rs_num].active.ptr;
1114 old_rcount = rs->rules[rs_num].active.rcount;
1115 old_array = rs->rules[rs_num].active.ptr_array;
1116
1117 rs->rules[rs_num].active.ptr =
1118 rs->rules[rs_num].inactive.ptr;
1119 rs->rules[rs_num].active.ptr_array =
1120 rs->rules[rs_num].inactive.ptr_array;
1121 rs->rules[rs_num].active.rcount =
1122 rs->rules[rs_num].inactive.rcount;
1123
1124 /* Attempt to preserve counter information. */
1125 if (V_pf_status.keep_counters) {
1126 TAILQ_FOREACH(rule, rs->rules[rs_num].active.ptr,
1127 entries) {
1128 tail = TAILQ_FIRST(old_rules);
1129 while ((tail != NULL) && ! pf_krule_compare(tail, rule))
1130 tail = TAILQ_NEXT(tail, entries);
1131 if (tail != NULL) {
1132 pf_counter_u64_critical_enter();
1133 pf_counter_u64_add_protected(&rule->evaluations,
1134 pf_counter_u64_fetch(&tail->evaluations));
1135 pf_counter_u64_add_protected(&rule->packets[0],
1136 pf_counter_u64_fetch(&tail->packets[0]));
1137 pf_counter_u64_add_protected(&rule->packets[1],
1138 pf_counter_u64_fetch(&tail->packets[1]));
1139 pf_counter_u64_add_protected(&rule->bytes[0],
1140 pf_counter_u64_fetch(&tail->bytes[0]));
1141 pf_counter_u64_add_protected(&rule->bytes[1],
1142 pf_counter_u64_fetch(&tail->bytes[1]));
1143 pf_counter_u64_critical_exit();
1144 }
1145 }
1146 }
1147
1148 rs->rules[rs_num].inactive.ptr = old_rules;
1149 rs->rules[rs_num].inactive.ptr_array = old_array;
1150 rs->rules[rs_num].inactive.rcount = old_rcount;
1151
1152 rs->rules[rs_num].active.ticket =
1153 rs->rules[rs_num].inactive.ticket;
1154 pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
1155
1156
1157 /* Purge the old rule list. */
1158 PF_UNLNKDRULES_LOCK();
1159 while ((rule = TAILQ_FIRST(old_rules)) != NULL)
1160 pf_unlink_rule_locked(old_rules, rule);
1161 PF_UNLNKDRULES_UNLOCK();
1162 if (rs->rules[rs_num].inactive.ptr_array)
1163 free(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
1164 rs->rules[rs_num].inactive.ptr_array = NULL;
1165 rs->rules[rs_num].inactive.rcount = 0;
1166 rs->rules[rs_num].inactive.open = 0;
1167 pf_remove_if_empty_kruleset(rs);
1168
1169 return (0);
1170 }
1171
1172 static int
pf_setup_pfsync_matching(struct pf_kruleset * rs)1173 pf_setup_pfsync_matching(struct pf_kruleset *rs)
1174 {
1175 MD5_CTX ctx;
1176 struct pf_krule *rule;
1177 int rs_cnt;
1178 u_int8_t digest[PF_MD5_DIGEST_LENGTH];
1179
1180 MD5Init(&ctx);
1181 for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
1182 /* XXX PF_RULESET_SCRUB as well? */
1183 if (rs_cnt == PF_RULESET_SCRUB)
1184 continue;
1185
1186 if (rs->rules[rs_cnt].inactive.ptr_array)
1187 free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
1188 rs->rules[rs_cnt].inactive.ptr_array = NULL;
1189
1190 if (rs->rules[rs_cnt].inactive.rcount) {
1191 rs->rules[rs_cnt].inactive.ptr_array =
1192 malloc(sizeof(caddr_t) *
1193 rs->rules[rs_cnt].inactive.rcount,
1194 M_TEMP, M_NOWAIT);
1195
1196 if (!rs->rules[rs_cnt].inactive.ptr_array)
1197 return (ENOMEM);
1198 }
1199
1200 TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
1201 entries) {
1202 pf_hash_rule(&ctx, rule);
1203 (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
1204 }
1205 }
1206
1207 MD5Final(digest, &ctx);
1208 memcpy(V_pf_status.pf_chksum, digest, sizeof(V_pf_status.pf_chksum));
1209 return (0);
1210 }
1211
1212 static int
pf_addr_setup(struct pf_kruleset * ruleset,struct pf_addr_wrap * addr,sa_family_t af)1213 pf_addr_setup(struct pf_kruleset *ruleset, struct pf_addr_wrap *addr,
1214 sa_family_t af)
1215 {
1216 int error = 0;
1217
1218 switch (addr->type) {
1219 case PF_ADDR_TABLE:
1220 addr->p.tbl = pfr_attach_table(ruleset, addr->v.tblname);
1221 if (addr->p.tbl == NULL)
1222 error = ENOMEM;
1223 break;
1224 case PF_ADDR_DYNIFTL:
1225 error = pfi_dynaddr_setup(addr, af);
1226 break;
1227 }
1228
1229 return (error);
1230 }
1231
1232 static void
pf_addr_copyout(struct pf_addr_wrap * addr)1233 pf_addr_copyout(struct pf_addr_wrap *addr)
1234 {
1235
1236 switch (addr->type) {
1237 case PF_ADDR_DYNIFTL:
1238 pfi_dynaddr_copyout(addr);
1239 break;
1240 case PF_ADDR_TABLE:
1241 pf_tbladdr_copyout(addr);
1242 break;
1243 }
1244 }
1245
1246 static void
pf_src_node_copy(const struct pf_ksrc_node * in,struct pf_src_node * out)1247 pf_src_node_copy(const struct pf_ksrc_node *in, struct pf_src_node *out)
1248 {
1249 int secs = time_uptime, diff;
1250
1251 bzero(out, sizeof(struct pf_src_node));
1252
1253 bcopy(&in->addr, &out->addr, sizeof(struct pf_addr));
1254 bcopy(&in->raddr, &out->raddr, sizeof(struct pf_addr));
1255
1256 if (in->rule.ptr != NULL)
1257 out->rule.nr = in->rule.ptr->nr;
1258
1259 for (int i = 0; i < 2; i++) {
1260 out->bytes[i] = counter_u64_fetch(in->bytes[i]);
1261 out->packets[i] = counter_u64_fetch(in->packets[i]);
1262 }
1263
1264 out->states = in->states;
1265 out->conn = in->conn;
1266 out->af = in->af;
1267 out->ruletype = in->ruletype;
1268
1269 out->creation = secs - in->creation;
1270 if (out->expire > secs)
1271 out->expire -= secs;
1272 else
1273 out->expire = 0;
1274
1275 /* Adjust the connection rate estimate. */
1276 diff = secs - in->conn_rate.last;
1277 if (diff >= in->conn_rate.seconds)
1278 out->conn_rate.count = 0;
1279 else
1280 out->conn_rate.count -=
1281 in->conn_rate.count * diff /
1282 in->conn_rate.seconds;
1283 }
1284
1285 #ifdef ALTQ
1286 /*
1287 * Handle export of struct pf_kaltq to user binaries that may be using any
1288 * version of struct pf_altq.
1289 */
1290 static int
pf_export_kaltq(struct pf_altq * q,struct pfioc_altq_v1 * pa,size_t ioc_size)1291 pf_export_kaltq(struct pf_altq *q, struct pfioc_altq_v1 *pa, size_t ioc_size)
1292 {
1293 u_int32_t version;
1294
1295 if (ioc_size == sizeof(struct pfioc_altq_v0))
1296 version = 0;
1297 else
1298 version = pa->version;
1299
1300 if (version > PFIOC_ALTQ_VERSION)
1301 return (EINVAL);
1302
1303 #define ASSIGN(x) exported_q->x = q->x
1304 #define COPY(x) \
1305 bcopy(&q->x, &exported_q->x, min(sizeof(q->x), sizeof(exported_q->x)))
1306 #define SATU16(x) (u_int32_t)uqmin((x), USHRT_MAX)
1307 #define SATU32(x) (u_int32_t)uqmin((x), UINT_MAX)
1308
1309 switch (version) {
1310 case 0: {
1311 struct pf_altq_v0 *exported_q =
1312 &((struct pfioc_altq_v0 *)pa)->altq;
1313
1314 COPY(ifname);
1315
1316 ASSIGN(scheduler);
1317 ASSIGN(tbrsize);
1318 exported_q->tbrsize = SATU16(q->tbrsize);
1319 exported_q->ifbandwidth = SATU32(q->ifbandwidth);
1320
1321 COPY(qname);
1322 COPY(parent);
1323 ASSIGN(parent_qid);
1324 exported_q->bandwidth = SATU32(q->bandwidth);
1325 ASSIGN(priority);
1326 ASSIGN(local_flags);
1327
1328 ASSIGN(qlimit);
1329 ASSIGN(flags);
1330
1331 if (q->scheduler == ALTQT_HFSC) {
1332 #define ASSIGN_OPT(x) exported_q->pq_u.hfsc_opts.x = q->pq_u.hfsc_opts.x
1333 #define ASSIGN_OPT_SATU32(x) exported_q->pq_u.hfsc_opts.x = \
1334 SATU32(q->pq_u.hfsc_opts.x)
1335
1336 ASSIGN_OPT_SATU32(rtsc_m1);
1337 ASSIGN_OPT(rtsc_d);
1338 ASSIGN_OPT_SATU32(rtsc_m2);
1339
1340 ASSIGN_OPT_SATU32(lssc_m1);
1341 ASSIGN_OPT(lssc_d);
1342 ASSIGN_OPT_SATU32(lssc_m2);
1343
1344 ASSIGN_OPT_SATU32(ulsc_m1);
1345 ASSIGN_OPT(ulsc_d);
1346 ASSIGN_OPT_SATU32(ulsc_m2);
1347
1348 ASSIGN_OPT(flags);
1349
1350 #undef ASSIGN_OPT
1351 #undef ASSIGN_OPT_SATU32
1352 } else
1353 COPY(pq_u);
1354
1355 ASSIGN(qid);
1356 break;
1357 }
1358 case 1: {
1359 struct pf_altq_v1 *exported_q =
1360 &((struct pfioc_altq_v1 *)pa)->altq;
1361
1362 COPY(ifname);
1363
1364 ASSIGN(scheduler);
1365 ASSIGN(tbrsize);
1366 ASSIGN(ifbandwidth);
1367
1368 COPY(qname);
1369 COPY(parent);
1370 ASSIGN(parent_qid);
1371 ASSIGN(bandwidth);
1372 ASSIGN(priority);
1373 ASSIGN(local_flags);
1374
1375 ASSIGN(qlimit);
1376 ASSIGN(flags);
1377 COPY(pq_u);
1378
1379 ASSIGN(qid);
1380 break;
1381 }
1382 default:
1383 panic("%s: unhandled struct pfioc_altq version", __func__);
1384 break;
1385 }
1386
1387 #undef ASSIGN
1388 #undef COPY
1389 #undef SATU16
1390 #undef SATU32
1391
1392 return (0);
1393 }
1394
1395 /*
1396 * Handle import to struct pf_kaltq of struct pf_altq from user binaries
1397 * that may be using any version of it.
1398 */
1399 static int
pf_import_kaltq(struct pfioc_altq_v1 * pa,struct pf_altq * q,size_t ioc_size)1400 pf_import_kaltq(struct pfioc_altq_v1 *pa, struct pf_altq *q, size_t ioc_size)
1401 {
1402 u_int32_t version;
1403
1404 if (ioc_size == sizeof(struct pfioc_altq_v0))
1405 version = 0;
1406 else
1407 version = pa->version;
1408
1409 if (version > PFIOC_ALTQ_VERSION)
1410 return (EINVAL);
1411
1412 #define ASSIGN(x) q->x = imported_q->x
1413 #define COPY(x) \
1414 bcopy(&imported_q->x, &q->x, min(sizeof(imported_q->x), sizeof(q->x)))
1415
1416 switch (version) {
1417 case 0: {
1418 struct pf_altq_v0 *imported_q =
1419 &((struct pfioc_altq_v0 *)pa)->altq;
1420
1421 COPY(ifname);
1422
1423 ASSIGN(scheduler);
1424 ASSIGN(tbrsize); /* 16-bit -> 32-bit */
1425 ASSIGN(ifbandwidth); /* 32-bit -> 64-bit */
1426
1427 COPY(qname);
1428 COPY(parent);
1429 ASSIGN(parent_qid);
1430 ASSIGN(bandwidth); /* 32-bit -> 64-bit */
1431 ASSIGN(priority);
1432 ASSIGN(local_flags);
1433
1434 ASSIGN(qlimit);
1435 ASSIGN(flags);
1436
1437 if (imported_q->scheduler == ALTQT_HFSC) {
1438 #define ASSIGN_OPT(x) q->pq_u.hfsc_opts.x = imported_q->pq_u.hfsc_opts.x
1439
1440 /*
1441 * The m1 and m2 parameters are being copied from
1442 * 32-bit to 64-bit.
1443 */
1444 ASSIGN_OPT(rtsc_m1);
1445 ASSIGN_OPT(rtsc_d);
1446 ASSIGN_OPT(rtsc_m2);
1447
1448 ASSIGN_OPT(lssc_m1);
1449 ASSIGN_OPT(lssc_d);
1450 ASSIGN_OPT(lssc_m2);
1451
1452 ASSIGN_OPT(ulsc_m1);
1453 ASSIGN_OPT(ulsc_d);
1454 ASSIGN_OPT(ulsc_m2);
1455
1456 ASSIGN_OPT(flags);
1457
1458 #undef ASSIGN_OPT
1459 } else
1460 COPY(pq_u);
1461
1462 ASSIGN(qid);
1463 break;
1464 }
1465 case 1: {
1466 struct pf_altq_v1 *imported_q =
1467 &((struct pfioc_altq_v1 *)pa)->altq;
1468
1469 COPY(ifname);
1470
1471 ASSIGN(scheduler);
1472 ASSIGN(tbrsize);
1473 ASSIGN(ifbandwidth);
1474
1475 COPY(qname);
1476 COPY(parent);
1477 ASSIGN(parent_qid);
1478 ASSIGN(bandwidth);
1479 ASSIGN(priority);
1480 ASSIGN(local_flags);
1481
1482 ASSIGN(qlimit);
1483 ASSIGN(flags);
1484 COPY(pq_u);
1485
1486 ASSIGN(qid);
1487 break;
1488 }
1489 default:
1490 panic("%s: unhandled struct pfioc_altq version", __func__);
1491 break;
1492 }
1493
1494 #undef ASSIGN
1495 #undef COPY
1496
1497 return (0);
1498 }
1499
1500 static struct pf_altq *
pf_altq_get_nth_active(u_int32_t n)1501 pf_altq_get_nth_active(u_int32_t n)
1502 {
1503 struct pf_altq *altq;
1504 u_int32_t nr;
1505
1506 nr = 0;
1507 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
1508 if (nr == n)
1509 return (altq);
1510 nr++;
1511 }
1512
1513 TAILQ_FOREACH(altq, V_pf_altqs_active, entries) {
1514 if (nr == n)
1515 return (altq);
1516 nr++;
1517 }
1518
1519 return (NULL);
1520 }
1521 #endif /* ALTQ */
1522
1523 struct pf_krule *
pf_krule_alloc(void)1524 pf_krule_alloc(void)
1525 {
1526 struct pf_krule *rule;
1527
1528 rule = malloc(sizeof(struct pf_krule), M_PFRULE, M_WAITOK | M_ZERO);
1529 mtx_init(&rule->rpool.mtx, "pf_krule_pool", NULL, MTX_DEF);
1530 return (rule);
1531 }
1532
1533 void
pf_krule_free(struct pf_krule * rule)1534 pf_krule_free(struct pf_krule *rule)
1535 {
1536 #ifdef PF_WANT_32_TO_64_COUNTER
1537 bool wowned;
1538 #endif
1539
1540 if (rule == NULL)
1541 return;
1542
1543 #ifdef PF_WANT_32_TO_64_COUNTER
1544 if (rule->allrulelinked) {
1545 wowned = PF_RULES_WOWNED();
1546 if (!wowned)
1547 PF_RULES_WLOCK();
1548 LIST_REMOVE(rule, allrulelist);
1549 V_pf_allrulecount--;
1550 if (!wowned)
1551 PF_RULES_WUNLOCK();
1552 }
1553 #endif
1554
1555 pf_counter_u64_deinit(&rule->evaluations);
1556 for (int i = 0; i < 2; i++) {
1557 pf_counter_u64_deinit(&rule->packets[i]);
1558 pf_counter_u64_deinit(&rule->bytes[i]);
1559 }
1560 counter_u64_free(rule->states_cur);
1561 counter_u64_free(rule->states_tot);
1562 counter_u64_free(rule->src_nodes);
1563
1564 mtx_destroy(&rule->rpool.mtx);
1565 free(rule, M_PFRULE);
1566 }
1567
1568 static void
pf_kpooladdr_to_pooladdr(const struct pf_kpooladdr * kpool,struct pf_pooladdr * pool)1569 pf_kpooladdr_to_pooladdr(const struct pf_kpooladdr *kpool,
1570 struct pf_pooladdr *pool)
1571 {
1572
1573 bzero(pool, sizeof(*pool));
1574 bcopy(&kpool->addr, &pool->addr, sizeof(pool->addr));
1575 strlcpy(pool->ifname, kpool->ifname, sizeof(pool->ifname));
1576 }
1577
1578 static void
pf_pooladdr_to_kpooladdr(const struct pf_pooladdr * pool,struct pf_kpooladdr * kpool)1579 pf_pooladdr_to_kpooladdr(const struct pf_pooladdr *pool,
1580 struct pf_kpooladdr *kpool)
1581 {
1582
1583 bzero(kpool, sizeof(*kpool));
1584 bcopy(&pool->addr, &kpool->addr, sizeof(kpool->addr));
1585 strlcpy(kpool->ifname, pool->ifname, sizeof(kpool->ifname));
1586 }
1587
1588 static void
pf_kpool_to_pool(const struct pf_kpool * kpool,struct pf_pool * pool)1589 pf_kpool_to_pool(const struct pf_kpool *kpool, struct pf_pool *pool)
1590 {
1591 bzero(pool, sizeof(*pool));
1592
1593 bcopy(&kpool->key, &pool->key, sizeof(pool->key));
1594 bcopy(&kpool->counter, &pool->counter, sizeof(pool->counter));
1595
1596 pool->tblidx = kpool->tblidx;
1597 pool->proxy_port[0] = kpool->proxy_port[0];
1598 pool->proxy_port[1] = kpool->proxy_port[1];
1599 pool->opts = kpool->opts;
1600 }
1601
1602 static void
pf_pool_to_kpool(const struct pf_pool * pool,struct pf_kpool * kpool)1603 pf_pool_to_kpool(const struct pf_pool *pool, struct pf_kpool *kpool)
1604 {
1605 _Static_assert(sizeof(pool->key) == sizeof(kpool->key), "");
1606 _Static_assert(sizeof(pool->counter) == sizeof(kpool->counter), "");
1607
1608 bcopy(&pool->key, &kpool->key, sizeof(kpool->key));
1609 bcopy(&pool->counter, &kpool->counter, sizeof(kpool->counter));
1610
1611 kpool->tblidx = pool->tblidx;
1612 kpool->proxy_port[0] = pool->proxy_port[0];
1613 kpool->proxy_port[1] = pool->proxy_port[1];
1614 kpool->opts = pool->opts;
1615 }
1616
1617 static void
pf_krule_to_rule(const struct pf_krule * krule,struct pf_rule * rule)1618 pf_krule_to_rule(const struct pf_krule *krule, struct pf_rule *rule)
1619 {
1620
1621 bzero(rule, sizeof(*rule));
1622
1623 bcopy(&krule->src, &rule->src, sizeof(rule->src));
1624 bcopy(&krule->dst, &rule->dst, sizeof(rule->dst));
1625
1626 for (int i = 0; i < PF_SKIP_COUNT; ++i) {
1627 if (rule->skip[i].ptr == NULL)
1628 rule->skip[i].nr = -1;
1629 else
1630 rule->skip[i].nr = krule->skip[i].ptr->nr;
1631 }
1632
1633 strlcpy(rule->label, krule->label[0], sizeof(rule->label));
1634 strlcpy(rule->ifname, krule->ifname, sizeof(rule->ifname));
1635 strlcpy(rule->qname, krule->qname, sizeof(rule->qname));
1636 strlcpy(rule->pqname, krule->pqname, sizeof(rule->pqname));
1637 strlcpy(rule->tagname, krule->tagname, sizeof(rule->tagname));
1638 strlcpy(rule->match_tagname, krule->match_tagname,
1639 sizeof(rule->match_tagname));
1640 strlcpy(rule->overload_tblname, krule->overload_tblname,
1641 sizeof(rule->overload_tblname));
1642
1643 pf_kpool_to_pool(&krule->rpool, &rule->rpool);
1644
1645 rule->evaluations = pf_counter_u64_fetch(&krule->evaluations);
1646 for (int i = 0; i < 2; i++) {
1647 rule->packets[i] = pf_counter_u64_fetch(&krule->packets[i]);
1648 rule->bytes[i] = pf_counter_u64_fetch(&krule->bytes[i]);
1649 }
1650
1651 /* kif, anchor, overload_tbl are not copied over. */
1652
1653 rule->os_fingerprint = krule->os_fingerprint;
1654
1655 rule->rtableid = krule->rtableid;
1656 bcopy(krule->timeout, rule->timeout, sizeof(krule->timeout));
1657 rule->max_states = krule->max_states;
1658 rule->max_src_nodes = krule->max_src_nodes;
1659 rule->max_src_states = krule->max_src_states;
1660 rule->max_src_conn = krule->max_src_conn;
1661 rule->max_src_conn_rate.limit = krule->max_src_conn_rate.limit;
1662 rule->max_src_conn_rate.seconds = krule->max_src_conn_rate.seconds;
1663 rule->qid = krule->qid;
1664 rule->pqid = krule->pqid;
1665 rule->nr = krule->nr;
1666 rule->prob = krule->prob;
1667 rule->cuid = krule->cuid;
1668 rule->cpid = krule->cpid;
1669
1670 rule->return_icmp = krule->return_icmp;
1671 rule->return_icmp6 = krule->return_icmp6;
1672 rule->max_mss = krule->max_mss;
1673 rule->tag = krule->tag;
1674 rule->match_tag = krule->match_tag;
1675 rule->scrub_flags = krule->scrub_flags;
1676
1677 bcopy(&krule->uid, &rule->uid, sizeof(krule->uid));
1678 bcopy(&krule->gid, &rule->gid, sizeof(krule->gid));
1679
1680 rule->rule_flag = krule->rule_flag;
1681 rule->action = krule->action;
1682 rule->direction = krule->direction;
1683 rule->log = krule->log;
1684 rule->logif = krule->logif;
1685 rule->quick = krule->quick;
1686 rule->ifnot = krule->ifnot;
1687 rule->match_tag_not = krule->match_tag_not;
1688 rule->natpass = krule->natpass;
1689
1690 rule->keep_state = krule->keep_state;
1691 rule->af = krule->af;
1692 rule->proto = krule->proto;
1693 rule->type = krule->type;
1694 rule->code = krule->code;
1695 rule->flags = krule->flags;
1696 rule->flagset = krule->flagset;
1697 rule->min_ttl = krule->min_ttl;
1698 rule->allow_opts = krule->allow_opts;
1699 rule->rt = krule->rt;
1700 rule->return_ttl = krule->return_ttl;
1701 rule->tos = krule->tos;
1702 rule->set_tos = krule->set_tos;
1703 rule->anchor_relative = krule->anchor_relative;
1704 rule->anchor_wildcard = krule->anchor_wildcard;
1705
1706 rule->flush = krule->flush;
1707 rule->prio = krule->prio;
1708 rule->set_prio[0] = krule->set_prio[0];
1709 rule->set_prio[1] = krule->set_prio[1];
1710
1711 bcopy(&krule->divert, &rule->divert, sizeof(krule->divert));
1712
1713 rule->u_states_cur = counter_u64_fetch(krule->states_cur);
1714 rule->u_states_tot = counter_u64_fetch(krule->states_tot);
1715 rule->u_src_nodes = counter_u64_fetch(krule->src_nodes);
1716 }
1717
1718 static int
pf_rule_to_krule(const struct pf_rule * rule,struct pf_krule * krule)1719 pf_rule_to_krule(const struct pf_rule *rule, struct pf_krule *krule)
1720 {
1721 int ret;
1722
1723 #ifndef INET
1724 if (rule->af == AF_INET) {
1725 return (EAFNOSUPPORT);
1726 }
1727 #endif /* INET */
1728 #ifndef INET6
1729 if (rule->af == AF_INET6) {
1730 return (EAFNOSUPPORT);
1731 }
1732 #endif /* INET6 */
1733
1734 ret = pf_check_rule_addr(&rule->src);
1735 if (ret != 0)
1736 return (ret);
1737 ret = pf_check_rule_addr(&rule->dst);
1738 if (ret != 0)
1739 return (ret);
1740
1741 bcopy(&rule->src, &krule->src, sizeof(rule->src));
1742 bcopy(&rule->dst, &krule->dst, sizeof(rule->dst));
1743
1744 strlcpy(krule->label[0], rule->label, sizeof(rule->label));
1745 strlcpy(krule->ifname, rule->ifname, sizeof(rule->ifname));
1746 strlcpy(krule->qname, rule->qname, sizeof(rule->qname));
1747 strlcpy(krule->pqname, rule->pqname, sizeof(rule->pqname));
1748 strlcpy(krule->tagname, rule->tagname, sizeof(rule->tagname));
1749 strlcpy(krule->match_tagname, rule->match_tagname,
1750 sizeof(rule->match_tagname));
1751 strlcpy(krule->overload_tblname, rule->overload_tblname,
1752 sizeof(rule->overload_tblname));
1753
1754 pf_pool_to_kpool(&rule->rpool, &krule->rpool);
1755
1756 /* Don't allow userspace to set evaulations, packets or bytes. */
1757 /* kif, anchor, overload_tbl are not copied over. */
1758
1759 krule->os_fingerprint = rule->os_fingerprint;
1760
1761 krule->rtableid = rule->rtableid;
1762 bcopy(rule->timeout, krule->timeout, sizeof(krule->timeout));
1763 krule->max_states = rule->max_states;
1764 krule->max_src_nodes = rule->max_src_nodes;
1765 krule->max_src_states = rule->max_src_states;
1766 krule->max_src_conn = rule->max_src_conn;
1767 krule->max_src_conn_rate.limit = rule->max_src_conn_rate.limit;
1768 krule->max_src_conn_rate.seconds = rule->max_src_conn_rate.seconds;
1769 krule->qid = rule->qid;
1770 krule->pqid = rule->pqid;
1771 krule->nr = rule->nr;
1772 krule->prob = rule->prob;
1773 krule->cuid = rule->cuid;
1774 krule->cpid = rule->cpid;
1775
1776 krule->return_icmp = rule->return_icmp;
1777 krule->return_icmp6 = rule->return_icmp6;
1778 krule->max_mss = rule->max_mss;
1779 krule->tag = rule->tag;
1780 krule->match_tag = rule->match_tag;
1781 krule->scrub_flags = rule->scrub_flags;
1782
1783 bcopy(&rule->uid, &krule->uid, sizeof(krule->uid));
1784 bcopy(&rule->gid, &krule->gid, sizeof(krule->gid));
1785
1786 krule->rule_flag = rule->rule_flag;
1787 krule->action = rule->action;
1788 krule->direction = rule->direction;
1789 krule->log = rule->log;
1790 krule->logif = rule->logif;
1791 krule->quick = rule->quick;
1792 krule->ifnot = rule->ifnot;
1793 krule->match_tag_not = rule->match_tag_not;
1794 krule->natpass = rule->natpass;
1795
1796 krule->keep_state = rule->keep_state;
1797 krule->af = rule->af;
1798 krule->proto = rule->proto;
1799 krule->type = rule->type;
1800 krule->code = rule->code;
1801 krule->flags = rule->flags;
1802 krule->flagset = rule->flagset;
1803 krule->min_ttl = rule->min_ttl;
1804 krule->allow_opts = rule->allow_opts;
1805 krule->rt = rule->rt;
1806 krule->return_ttl = rule->return_ttl;
1807 krule->tos = rule->tos;
1808 krule->set_tos = rule->set_tos;
1809
1810 krule->flush = rule->flush;
1811 krule->prio = rule->prio;
1812 krule->set_prio[0] = rule->set_prio[0];
1813 krule->set_prio[1] = rule->set_prio[1];
1814
1815 bcopy(&rule->divert, &krule->divert, sizeof(krule->divert));
1816
1817 return (0);
1818 }
1819
1820 static bool
pf_label_match(const struct pf_krule * rule,const char * label)1821 pf_label_match(const struct pf_krule *rule, const char *label)
1822 {
1823 int i = 0;
1824
1825 while (*rule->label[i]) {
1826 if (strcmp(rule->label[i], label) == 0)
1827 return (true);
1828 i++;
1829 }
1830
1831 return (false);
1832 }
1833
1834 static unsigned int
pf_kill_matching_state(struct pf_state_key_cmp * key,int dir)1835 pf_kill_matching_state(struct pf_state_key_cmp *key, int dir)
1836 {
1837 struct pf_kstate *match;
1838 int more = 0;
1839 unsigned int killed = 0;
1840
1841 /* Call with unlocked hashrow */
1842
1843 match = pf_find_state_all(key, dir, &more);
1844 if (match && !more) {
1845 pf_unlink_state(match, 0);
1846 killed++;
1847 }
1848
1849 return (killed);
1850 }
1851
1852 static int
pf_killstates_row(struct pf_kstate_kill * psk,struct pf_idhash * ih)1853 pf_killstates_row(struct pf_kstate_kill *psk, struct pf_idhash *ih)
1854 {
1855 struct pf_kstate *s;
1856 struct pf_state_key *sk;
1857 struct pf_addr *srcaddr, *dstaddr;
1858 struct pf_state_key_cmp match_key;
1859 int idx, killed = 0;
1860 unsigned int dir;
1861 u_int16_t srcport, dstport;
1862 struct pfi_kkif *kif;
1863
1864 relock_DIOCKILLSTATES:
1865 PF_HASHROW_LOCK(ih);
1866 LIST_FOREACH(s, &ih->states, entry) {
1867 /* For floating states look at the original kif. */
1868 kif = s->kif == V_pfi_all ? s->orig_kif : s->kif;
1869
1870 sk = s->key[PF_SK_WIRE];
1871 if (s->direction == PF_OUT) {
1872 srcaddr = &sk->addr[1];
1873 dstaddr = &sk->addr[0];
1874 srcport = sk->port[1];
1875 dstport = sk->port[0];
1876 } else {
1877 srcaddr = &sk->addr[0];
1878 dstaddr = &sk->addr[1];
1879 srcport = sk->port[0];
1880 dstport = sk->port[1];
1881 }
1882
1883 if (psk->psk_af && sk->af != psk->psk_af)
1884 continue;
1885
1886 if (psk->psk_proto && psk->psk_proto != sk->proto)
1887 continue;
1888
1889 if (! PF_MATCHA(psk->psk_src.neg, &psk->psk_src.addr.v.a.addr,
1890 &psk->psk_src.addr.v.a.mask, srcaddr, sk->af))
1891 continue;
1892
1893 if (! PF_MATCHA(psk->psk_dst.neg, &psk->psk_dst.addr.v.a.addr,
1894 &psk->psk_dst.addr.v.a.mask, dstaddr, sk->af))
1895 continue;
1896
1897 if (! PF_MATCHA(psk->psk_rt_addr.neg,
1898 &psk->psk_rt_addr.addr.v.a.addr,
1899 &psk->psk_rt_addr.addr.v.a.mask,
1900 &s->rt_addr, sk->af))
1901 continue;
1902
1903 if (psk->psk_src.port_op != 0 &&
1904 ! pf_match_port(psk->psk_src.port_op,
1905 psk->psk_src.port[0], psk->psk_src.port[1], srcport))
1906 continue;
1907
1908 if (psk->psk_dst.port_op != 0 &&
1909 ! pf_match_port(psk->psk_dst.port_op,
1910 psk->psk_dst.port[0], psk->psk_dst.port[1], dstport))
1911 continue;
1912
1913 if (psk->psk_label[0] &&
1914 ! pf_label_match(s->rule.ptr, psk->psk_label))
1915 continue;
1916
1917 if (psk->psk_ifname[0] && strcmp(psk->psk_ifname,
1918 kif->pfik_name))
1919 continue;
1920
1921 if (psk->psk_kill_match) {
1922 /* Create the key to find matching states, with lock
1923 * held. */
1924
1925 bzero(&match_key, sizeof(match_key));
1926
1927 if (s->direction == PF_OUT) {
1928 dir = PF_IN;
1929 idx = PF_SK_STACK;
1930 } else {
1931 dir = PF_OUT;
1932 idx = PF_SK_WIRE;
1933 }
1934
1935 match_key.af = s->key[idx]->af;
1936 match_key.proto = s->key[idx]->proto;
1937 PF_ACPY(&match_key.addr[0],
1938 &s->key[idx]->addr[1], match_key.af);
1939 match_key.port[0] = s->key[idx]->port[1];
1940 PF_ACPY(&match_key.addr[1],
1941 &s->key[idx]->addr[0], match_key.af);
1942 match_key.port[1] = s->key[idx]->port[0];
1943 }
1944
1945 pf_unlink_state(s, PF_ENTER_LOCKED);
1946 killed++;
1947
1948 if (psk->psk_kill_match)
1949 killed += pf_kill_matching_state(&match_key, dir);
1950
1951 goto relock_DIOCKILLSTATES;
1952 }
1953 PF_HASHROW_UNLOCK(ih);
1954
1955 return (killed);
1956 }
1957
1958 static int
pf_state_kill_to_kstate_kill(const struct pfioc_state_kill * psk,struct pf_kstate_kill * kill)1959 pf_state_kill_to_kstate_kill(const struct pfioc_state_kill *psk,
1960 struct pf_kstate_kill *kill)
1961 {
1962 bzero(kill, sizeof(*kill));
1963
1964 bcopy(&psk->psk_pfcmp, &kill->psk_pfcmp, sizeof(kill->psk_pfcmp));
1965 kill->psk_af = psk->psk_af;
1966 kill->psk_proto = psk->psk_proto;
1967 bcopy(&psk->psk_src, &kill->psk_src, sizeof(kill->psk_src));
1968 bcopy(&psk->psk_dst, &kill->psk_dst, sizeof(kill->psk_dst));
1969 strlcpy(kill->psk_ifname, psk->psk_ifname, sizeof(kill->psk_ifname));
1970 strlcpy(kill->psk_label, psk->psk_label, sizeof(kill->psk_label));
1971
1972 return (0);
1973 }
1974
1975 static int
pf_ioctl_addrule(struct pf_krule * rule,uint32_t ticket,uint32_t pool_ticket,const char * anchor,const char * anchor_call,struct thread * td)1976 pf_ioctl_addrule(struct pf_krule *rule, uint32_t ticket,
1977 uint32_t pool_ticket, const char *anchor, const char *anchor_call,
1978 struct thread *td)
1979 {
1980 struct pf_kruleset *ruleset;
1981 struct pf_krule *tail;
1982 struct pf_kpooladdr *pa;
1983 struct pfi_kkif *kif = NULL;
1984 int rs_num;
1985 int error = 0;
1986
1987 if ((rule->return_icmp >> 8) > ICMP_MAXTYPE) {
1988 error = EINVAL;
1989 goto errout_unlocked;
1990 }
1991
1992 #define ERROUT(x) ERROUT_FUNCTION(errout, x)
1993
1994 if (rule->ifname[0])
1995 kif = pf_kkif_create(M_WAITOK);
1996 pf_counter_u64_init(&rule->evaluations, M_WAITOK);
1997 for (int i = 0; i < 2; i++) {
1998 pf_counter_u64_init(&rule->packets[i], M_WAITOK);
1999 pf_counter_u64_init(&rule->bytes[i], M_WAITOK);
2000 }
2001 rule->states_cur = counter_u64_alloc(M_WAITOK);
2002 rule->states_tot = counter_u64_alloc(M_WAITOK);
2003 rule->src_nodes = counter_u64_alloc(M_WAITOK);
2004 rule->cuid = td->td_ucred->cr_ruid;
2005 rule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
2006 TAILQ_INIT(&rule->rpool.list);
2007
2008 PF_RULES_WLOCK();
2009 #ifdef PF_WANT_32_TO_64_COUNTER
2010 LIST_INSERT_HEAD(&V_pf_allrulelist, rule, allrulelist);
2011 MPASS(!rule->allrulelinked);
2012 rule->allrulelinked = true;
2013 V_pf_allrulecount++;
2014 #endif
2015 ruleset = pf_find_kruleset(anchor);
2016 if (ruleset == NULL)
2017 ERROUT(EINVAL);
2018 rs_num = pf_get_ruleset_number(rule->action);
2019 if (rs_num >= PF_RULESET_MAX)
2020 ERROUT(EINVAL);
2021 if (ticket != ruleset->rules[rs_num].inactive.ticket) {
2022 DPFPRINTF(PF_DEBUG_MISC,
2023 ("ticket: %d != [%d]%d\n", ticket, rs_num,
2024 ruleset->rules[rs_num].inactive.ticket));
2025 ERROUT(EBUSY);
2026 }
2027 if (pool_ticket != V_ticket_pabuf) {
2028 DPFPRINTF(PF_DEBUG_MISC,
2029 ("pool_ticket: %d != %d\n", pool_ticket,
2030 V_ticket_pabuf));
2031 ERROUT(EBUSY);
2032 }
2033
2034 tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
2035 pf_krulequeue);
2036 if (tail)
2037 rule->nr = tail->nr + 1;
2038 else
2039 rule->nr = 0;
2040 if (rule->ifname[0]) {
2041 rule->kif = pfi_kkif_attach(kif, rule->ifname);
2042 kif = NULL;
2043 pfi_kkif_ref(rule->kif);
2044 } else
2045 rule->kif = NULL;
2046
2047 if (rule->rtableid > 0 && rule->rtableid >= rt_numfibs)
2048 error = EBUSY;
2049
2050 #ifdef ALTQ
2051 /* set queue IDs */
2052 if (rule->qname[0] != 0) {
2053 if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
2054 error = EBUSY;
2055 else if (rule->pqname[0] != 0) {
2056 if ((rule->pqid =
2057 pf_qname2qid(rule->pqname)) == 0)
2058 error = EBUSY;
2059 } else
2060 rule->pqid = rule->qid;
2061 }
2062 #endif
2063 if (rule->tagname[0])
2064 if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
2065 error = EBUSY;
2066 if (rule->match_tagname[0])
2067 if ((rule->match_tag =
2068 pf_tagname2tag(rule->match_tagname)) == 0)
2069 error = EBUSY;
2070 if (rule->rt && !rule->direction)
2071 error = EINVAL;
2072 if (!rule->log)
2073 rule->logif = 0;
2074 if (rule->logif >= PFLOGIFS_MAX)
2075 error = EINVAL;
2076 if (pf_addr_setup(ruleset, &rule->src.addr, rule->af))
2077 error = ENOMEM;
2078 if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af))
2079 error = ENOMEM;
2080 if (pf_kanchor_setup(rule, ruleset, anchor_call))
2081 error = EINVAL;
2082 if (rule->scrub_flags & PFSTATE_SETPRIO &&
2083 (rule->set_prio[0] > PF_PRIO_MAX ||
2084 rule->set_prio[1] > PF_PRIO_MAX))
2085 error = EINVAL;
2086 TAILQ_FOREACH(pa, &V_pf_pabuf, entries)
2087 if (pa->addr.type == PF_ADDR_TABLE) {
2088 pa->addr.p.tbl = pfr_attach_table(ruleset,
2089 pa->addr.v.tblname);
2090 if (pa->addr.p.tbl == NULL)
2091 error = ENOMEM;
2092 }
2093
2094 rule->overload_tbl = NULL;
2095 if (rule->overload_tblname[0]) {
2096 if ((rule->overload_tbl = pfr_attach_table(ruleset,
2097 rule->overload_tblname)) == NULL)
2098 error = EINVAL;
2099 else
2100 rule->overload_tbl->pfrkt_flags |=
2101 PFR_TFLAG_ACTIVE;
2102 }
2103
2104 pf_mv_kpool(&V_pf_pabuf, &rule->rpool.list);
2105 if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
2106 (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
2107 (rule->rt > PF_NOPFROUTE)) &&
2108 (TAILQ_FIRST(&rule->rpool.list) == NULL))
2109 error = EINVAL;
2110
2111 if (error) {
2112 pf_free_rule(rule);
2113 rule = NULL;
2114 ERROUT(error);
2115 }
2116
2117 rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
2118 TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
2119 rule, entries);
2120 ruleset->rules[rs_num].inactive.rcount++;
2121
2122 PF_RULES_WUNLOCK();
2123
2124 return (0);
2125
2126 #undef ERROUT
2127 errout:
2128 PF_RULES_WUNLOCK();
2129 errout_unlocked:
2130 pf_kkif_free(kif);
2131 pf_krule_free(rule);
2132 return (error);
2133 }
2134
2135 static int
pfioctl(struct cdev * dev,u_long cmd,caddr_t addr,int flags,struct thread * td)2136 pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td)
2137 {
2138 int error = 0;
2139 PF_RULES_RLOCK_TRACKER;
2140
2141 #define ERROUT_IOCTL(target, x) \
2142 do { \
2143 error = (x); \
2144 SDT_PROBE3(pf, ioctl, ioctl, error, cmd, error, __LINE__); \
2145 goto target; \
2146 } while (0)
2147
2148
2149 /* XXX keep in sync with switch() below */
2150 if (securelevel_gt(td->td_ucred, 2))
2151 switch (cmd) {
2152 case DIOCGETRULES:
2153 case DIOCGETRULE:
2154 case DIOCGETRULENV:
2155 case DIOCGETADDRS:
2156 case DIOCGETADDR:
2157 case DIOCGETSTATE:
2158 case DIOCGETSTATENV:
2159 case DIOCSETSTATUSIF:
2160 case DIOCGETSTATUS:
2161 case DIOCGETSTATUSNV:
2162 case DIOCCLRSTATUS:
2163 case DIOCNATLOOK:
2164 case DIOCSETDEBUG:
2165 case DIOCGETSTATES:
2166 case DIOCGETSTATESV2:
2167 case DIOCGETTIMEOUT:
2168 case DIOCCLRRULECTRS:
2169 case DIOCGETLIMIT:
2170 case DIOCGETALTQSV0:
2171 case DIOCGETALTQSV1:
2172 case DIOCGETALTQV0:
2173 case DIOCGETALTQV1:
2174 case DIOCGETQSTATSV0:
2175 case DIOCGETQSTATSV1:
2176 case DIOCGETRULESETS:
2177 case DIOCGETRULESET:
2178 case DIOCRGETTABLES:
2179 case DIOCRGETTSTATS:
2180 case DIOCRCLRTSTATS:
2181 case DIOCRCLRADDRS:
2182 case DIOCRADDADDRS:
2183 case DIOCRDELADDRS:
2184 case DIOCRSETADDRS:
2185 case DIOCRGETADDRS:
2186 case DIOCRGETASTATS:
2187 case DIOCRCLRASTATS:
2188 case DIOCRTSTADDRS:
2189 case DIOCOSFPGET:
2190 case DIOCGETSRCNODES:
2191 case DIOCCLRSRCNODES:
2192 case DIOCGETSYNCOOKIES:
2193 case DIOCIGETIFACES:
2194 case DIOCGIFSPEEDV0:
2195 case DIOCGIFSPEEDV1:
2196 case DIOCSETIFFLAG:
2197 case DIOCCLRIFFLAG:
2198 break;
2199 case DIOCRCLRTABLES:
2200 case DIOCRADDTABLES:
2201 case DIOCRDELTABLES:
2202 case DIOCRSETTFLAGS:
2203 if (((struct pfioc_table *)addr)->pfrio_flags &
2204 PFR_FLAG_DUMMY)
2205 break; /* dummy operation ok */
2206 return (EPERM);
2207 default:
2208 return (EPERM);
2209 }
2210
2211 if (!(flags & FWRITE))
2212 switch (cmd) {
2213 case DIOCGETRULES:
2214 case DIOCGETADDRS:
2215 case DIOCGETADDR:
2216 case DIOCGETSTATE:
2217 case DIOCGETSTATENV:
2218 case DIOCGETSTATUS:
2219 case DIOCGETSTATUSNV:
2220 case DIOCGETSTATES:
2221 case DIOCGETSTATESV2:
2222 case DIOCGETTIMEOUT:
2223 case DIOCGETLIMIT:
2224 case DIOCGETALTQSV0:
2225 case DIOCGETALTQSV1:
2226 case DIOCGETALTQV0:
2227 case DIOCGETALTQV1:
2228 case DIOCGETQSTATSV0:
2229 case DIOCGETQSTATSV1:
2230 case DIOCGETRULESETS:
2231 case DIOCGETRULESET:
2232 case DIOCNATLOOK:
2233 case DIOCRGETTABLES:
2234 case DIOCRGETTSTATS:
2235 case DIOCRGETADDRS:
2236 case DIOCRGETASTATS:
2237 case DIOCRTSTADDRS:
2238 case DIOCOSFPGET:
2239 case DIOCGETSRCNODES:
2240 case DIOCGETSYNCOOKIES:
2241 case DIOCIGETIFACES:
2242 case DIOCGIFSPEEDV1:
2243 case DIOCGIFSPEEDV0:
2244 case DIOCGETRULENV:
2245 break;
2246 case DIOCRCLRTABLES:
2247 case DIOCRADDTABLES:
2248 case DIOCRDELTABLES:
2249 case DIOCRCLRTSTATS:
2250 case DIOCRCLRADDRS:
2251 case DIOCRADDADDRS:
2252 case DIOCRDELADDRS:
2253 case DIOCRSETADDRS:
2254 case DIOCRSETTFLAGS:
2255 if (((struct pfioc_table *)addr)->pfrio_flags &
2256 PFR_FLAG_DUMMY) {
2257 flags |= FWRITE; /* need write lock for dummy */
2258 break; /* dummy operation ok */
2259 }
2260 return (EACCES);
2261 case DIOCGETRULE:
2262 if (((struct pfioc_rule *)addr)->action ==
2263 PF_GET_CLR_CNTR)
2264 return (EACCES);
2265 break;
2266 default:
2267 return (EACCES);
2268 }
2269
2270 CURVNET_SET(TD_TO_VNET(td));
2271
2272 switch (cmd) {
2273 case DIOCSTART:
2274 sx_xlock(&pf_ioctl_lock);
2275 if (V_pf_status.running)
2276 error = EEXIST;
2277 else {
2278 int cpu;
2279
2280 error = hook_pf();
2281 if (error) {
2282 DPFPRINTF(PF_DEBUG_MISC,
2283 ("pf: pfil registration failed\n"));
2284 break;
2285 }
2286 V_pf_status.running = 1;
2287 V_pf_status.since = time_second;
2288
2289 CPU_FOREACH(cpu)
2290 V_pf_stateid[cpu] = time_second;
2291
2292 DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
2293 }
2294 break;
2295
2296 case DIOCSTOP:
2297 sx_xlock(&pf_ioctl_lock);
2298 if (!V_pf_status.running)
2299 error = ENOENT;
2300 else {
2301 V_pf_status.running = 0;
2302 error = dehook_pf();
2303 if (error) {
2304 V_pf_status.running = 1;
2305 DPFPRINTF(PF_DEBUG_MISC,
2306 ("pf: pfil unregistration failed\n"));
2307 }
2308 V_pf_status.since = time_second;
2309 DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
2310 }
2311 break;
2312
2313 case DIOCADDRULENV: {
2314 struct pfioc_nv *nv = (struct pfioc_nv *)addr;
2315 nvlist_t *nvl = NULL;
2316 void *nvlpacked = NULL;
2317 struct pf_krule *rule = NULL;
2318 const char *anchor = "", *anchor_call = "";
2319 uint32_t ticket = 0, pool_ticket = 0;
2320
2321 #define ERROUT(x) ERROUT_IOCTL(DIOCADDRULENV_error, x)
2322
2323 if (nv->len > pf_ioctl_maxcount)
2324 ERROUT(ENOMEM);
2325
2326 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK);
2327 error = copyin(nv->data, nvlpacked, nv->len);
2328 if (error)
2329 ERROUT(error);
2330
2331 nvl = nvlist_unpack(nvlpacked, nv->len, 0);
2332 if (nvl == NULL)
2333 ERROUT(EBADMSG);
2334
2335 if (! nvlist_exists_number(nvl, "ticket"))
2336 ERROUT(EINVAL);
2337 ticket = nvlist_get_number(nvl, "ticket");
2338
2339 if (! nvlist_exists_number(nvl, "pool_ticket"))
2340 ERROUT(EINVAL);
2341 pool_ticket = nvlist_get_number(nvl, "pool_ticket");
2342
2343 if (! nvlist_exists_nvlist(nvl, "rule"))
2344 ERROUT(EINVAL);
2345
2346 rule = pf_krule_alloc();
2347 error = pf_nvrule_to_krule(nvlist_get_nvlist(nvl, "rule"),
2348 rule);
2349 if (error)
2350 ERROUT(error);
2351
2352 if (nvlist_exists_string(nvl, "anchor"))
2353 anchor = nvlist_get_string(nvl, "anchor");
2354 if (nvlist_exists_string(nvl, "anchor_call"))
2355 anchor_call = nvlist_get_string(nvl, "anchor_call");
2356
2357 if ((error = nvlist_error(nvl)))
2358 ERROUT(error);
2359
2360 /* Frees rule on error */
2361 error = pf_ioctl_addrule(rule, ticket, pool_ticket, anchor,
2362 anchor_call, td);
2363
2364 nvlist_destroy(nvl);
2365 free(nvlpacked, M_NVLIST);
2366 break;
2367 #undef ERROUT
2368 DIOCADDRULENV_error:
2369 pf_krule_free(rule);
2370 nvlist_destroy(nvl);
2371 free(nvlpacked, M_NVLIST);
2372
2373 break;
2374 }
2375 case DIOCADDRULE: {
2376 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
2377 struct pf_krule *rule;
2378
2379 rule = pf_krule_alloc();
2380 error = pf_rule_to_krule(&pr->rule, rule);
2381 if (error != 0) {
2382 pf_krule_free(rule);
2383 break;
2384 }
2385
2386 pr->anchor[sizeof(pr->anchor) - 1] = 0;
2387
2388 /* Frees rule on error */
2389 error = pf_ioctl_addrule(rule, pr->ticket, pr->pool_ticket,
2390 pr->anchor, pr->anchor_call, td);
2391 break;
2392 }
2393
2394 case DIOCGETRULES: {
2395 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
2396 struct pf_kruleset *ruleset;
2397 struct pf_krule *tail;
2398 int rs_num;
2399
2400 PF_RULES_WLOCK();
2401 pr->anchor[sizeof(pr->anchor) - 1] = 0;
2402 ruleset = pf_find_kruleset(pr->anchor);
2403 if (ruleset == NULL) {
2404 PF_RULES_WUNLOCK();
2405 error = EINVAL;
2406 break;
2407 }
2408 rs_num = pf_get_ruleset_number(pr->rule.action);
2409 if (rs_num >= PF_RULESET_MAX) {
2410 PF_RULES_WUNLOCK();
2411 error = EINVAL;
2412 break;
2413 }
2414 tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
2415 pf_krulequeue);
2416 if (tail)
2417 pr->nr = tail->nr + 1;
2418 else
2419 pr->nr = 0;
2420 pr->ticket = ruleset->rules[rs_num].active.ticket;
2421 PF_RULES_WUNLOCK();
2422 break;
2423 }
2424
2425 case DIOCGETRULE: {
2426 struct pfioc_rule *pr = (struct pfioc_rule *)addr;
2427 struct pf_kruleset *ruleset;
2428 struct pf_krule *rule;
2429 int rs_num;
2430
2431 PF_RULES_WLOCK();
2432 pr->anchor[sizeof(pr->anchor) - 1] = 0;
2433 ruleset = pf_find_kruleset(pr->anchor);
2434 if (ruleset == NULL) {
2435 PF_RULES_WUNLOCK();
2436 error = EINVAL;
2437 break;
2438 }
2439 rs_num = pf_get_ruleset_number(pr->rule.action);
2440 if (rs_num >= PF_RULESET_MAX) {
2441 PF_RULES_WUNLOCK();
2442 error = EINVAL;
2443 break;
2444 }
2445 if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
2446 PF_RULES_WUNLOCK();
2447 error = EBUSY;
2448 break;
2449 }
2450 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
2451 while ((rule != NULL) && (rule->nr != pr->nr))
2452 rule = TAILQ_NEXT(rule, entries);
2453 if (rule == NULL) {
2454 PF_RULES_WUNLOCK();
2455 error = EBUSY;
2456 break;
2457 }
2458
2459 pf_krule_to_rule(rule, &pr->rule);
2460
2461 if (pf_kanchor_copyout(ruleset, rule, pr)) {
2462 PF_RULES_WUNLOCK();
2463 error = EBUSY;
2464 break;
2465 }
2466 pf_addr_copyout(&pr->rule.src.addr);
2467 pf_addr_copyout(&pr->rule.dst.addr);
2468
2469 if (pr->action == PF_GET_CLR_CNTR) {
2470 pf_counter_u64_zero(&rule->evaluations);
2471 for (int i = 0; i < 2; i++) {
2472 pf_counter_u64_zero(&rule->packets[i]);
2473 pf_counter_u64_zero(&rule->bytes[i]);
2474 }
2475 counter_u64_zero(rule->states_tot);
2476 }
2477 PF_RULES_WUNLOCK();
2478 break;
2479 }
2480
2481 case DIOCGETRULENV: {
2482 struct pfioc_nv *nv = (struct pfioc_nv *)addr;
2483 nvlist_t *nvrule = NULL;
2484 nvlist_t *nvl = NULL;
2485 struct pf_kruleset *ruleset;
2486 struct pf_krule *rule;
2487 void *nvlpacked = NULL;
2488 int rs_num, nr;
2489 bool clear_counter = false;
2490
2491 #define ERROUT(x) ERROUT_IOCTL(DIOCGETRULENV_error, x)
2492
2493 if (nv->len > pf_ioctl_maxcount)
2494 ERROUT(ENOMEM);
2495
2496 /* Copy the request in */
2497 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK);
2498 if (nvlpacked == NULL)
2499 ERROUT(ENOMEM);
2500
2501 error = copyin(nv->data, nvlpacked, nv->len);
2502 if (error)
2503 ERROUT(error);
2504
2505 nvl = nvlist_unpack(nvlpacked, nv->len, 0);
2506 if (nvl == NULL)
2507 ERROUT(EBADMSG);
2508
2509 if (! nvlist_exists_string(nvl, "anchor"))
2510 ERROUT(EBADMSG);
2511 if (! nvlist_exists_number(nvl, "ruleset"))
2512 ERROUT(EBADMSG);
2513 if (! nvlist_exists_number(nvl, "ticket"))
2514 ERROUT(EBADMSG);
2515 if (! nvlist_exists_number(nvl, "nr"))
2516 ERROUT(EBADMSG);
2517
2518 if (nvlist_exists_bool(nvl, "clear_counter"))
2519 clear_counter = nvlist_get_bool(nvl, "clear_counter");
2520
2521 if (clear_counter && !(flags & FWRITE))
2522 ERROUT(EACCES);
2523
2524 nr = nvlist_get_number(nvl, "nr");
2525
2526 PF_RULES_WLOCK();
2527 ruleset = pf_find_kruleset(nvlist_get_string(nvl, "anchor"));
2528 if (ruleset == NULL) {
2529 PF_RULES_WUNLOCK();
2530 ERROUT(ENOENT);
2531 }
2532
2533 rs_num = pf_get_ruleset_number(nvlist_get_number(nvl, "ruleset"));
2534 if (rs_num >= PF_RULESET_MAX) {
2535 PF_RULES_WUNLOCK();
2536 ERROUT(EINVAL);
2537 }
2538
2539 if (nvlist_get_number(nvl, "ticket") !=
2540 ruleset->rules[rs_num].active.ticket) {
2541 PF_RULES_WUNLOCK();
2542 ERROUT(EBUSY);
2543 }
2544
2545 if ((error = nvlist_error(nvl))) {
2546 PF_RULES_WUNLOCK();
2547 ERROUT(error);
2548 }
2549
2550 rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
2551 while ((rule != NULL) && (rule->nr != nr))
2552 rule = TAILQ_NEXT(rule, entries);
2553 if (rule == NULL) {
2554 PF_RULES_WUNLOCK();
2555 ERROUT(EBUSY);
2556 }
2557
2558 nvrule = pf_krule_to_nvrule(rule);
2559
2560 nvlist_destroy(nvl);
2561 nvl = nvlist_create(0);
2562 if (nvl == NULL) {
2563 PF_RULES_WUNLOCK();
2564 ERROUT(ENOMEM);
2565 }
2566 nvlist_add_number(nvl, "nr", nr);
2567 nvlist_add_nvlist(nvl, "rule", nvrule);
2568 nvlist_destroy(nvrule);
2569 nvrule = NULL;
2570 if (pf_kanchor_nvcopyout(ruleset, rule, nvl)) {
2571 PF_RULES_WUNLOCK();
2572 ERROUT(EBUSY);
2573 }
2574
2575 free(nvlpacked, M_NVLIST);
2576 nvlpacked = nvlist_pack(nvl, &nv->len);
2577 if (nvlpacked == NULL) {
2578 PF_RULES_WUNLOCK();
2579 ERROUT(ENOMEM);
2580 }
2581
2582 if (nv->size == 0) {
2583 PF_RULES_WUNLOCK();
2584 ERROUT(0);
2585 }
2586 else if (nv->size < nv->len) {
2587 PF_RULES_WUNLOCK();
2588 ERROUT(ENOSPC);
2589 }
2590
2591 if (clear_counter) {
2592 pf_counter_u64_zero(&rule->evaluations);
2593 for (int i = 0; i < 2; i++) {
2594 pf_counter_u64_zero(&rule->packets[i]);
2595 pf_counter_u64_zero(&rule->bytes[i]);
2596 }
2597 counter_u64_zero(rule->states_tot);
2598 }
2599 PF_RULES_WUNLOCK();
2600
2601 error = copyout(nvlpacked, nv->data, nv->len);
2602
2603 #undef ERROUT
2604 DIOCGETRULENV_error:
2605 free(nvlpacked, M_NVLIST);
2606 nvlist_destroy(nvrule);
2607 nvlist_destroy(nvl);
2608
2609 break;
2610 }
2611
2612 case DIOCCHANGERULE: {
2613 struct pfioc_rule *pcr = (struct pfioc_rule *)addr;
2614 struct pf_kruleset *ruleset;
2615 struct pf_krule *oldrule = NULL, *newrule = NULL;
2616 struct pfi_kkif *kif = NULL;
2617 struct pf_kpooladdr *pa;
2618 u_int32_t nr = 0;
2619 int rs_num;
2620
2621 if (pcr->action < PF_CHANGE_ADD_HEAD ||
2622 pcr->action > PF_CHANGE_GET_TICKET) {
2623 error = EINVAL;
2624 break;
2625 }
2626 if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
2627 error = EINVAL;
2628 break;
2629 }
2630
2631 if (pcr->action != PF_CHANGE_REMOVE) {
2632 newrule = pf_krule_alloc();
2633 error = pf_rule_to_krule(&pcr->rule, newrule);
2634 if (error != 0) {
2635 free(newrule, M_PFRULE);
2636 break;
2637 }
2638
2639 if (newrule->ifname[0])
2640 kif = pf_kkif_create(M_WAITOK);
2641 pf_counter_u64_init(&newrule->evaluations, M_WAITOK);
2642 for (int i = 0; i < 2; i++) {
2643 pf_counter_u64_init(&newrule->packets[i], M_WAITOK);
2644 pf_counter_u64_init(&newrule->bytes[i], M_WAITOK);
2645 }
2646 newrule->states_cur = counter_u64_alloc(M_WAITOK);
2647 newrule->states_tot = counter_u64_alloc(M_WAITOK);
2648 newrule->src_nodes = counter_u64_alloc(M_WAITOK);
2649 newrule->cuid = td->td_ucred->cr_ruid;
2650 newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
2651 TAILQ_INIT(&newrule->rpool.list);
2652 }
2653
2654 #define ERROUT(x) ERROUT_IOCTL(DIOCCHANGERULE_error, x)
2655
2656 PF_RULES_WLOCK();
2657 #ifdef PF_WANT_32_TO_64_COUNTER
2658 if (newrule != NULL) {
2659 LIST_INSERT_HEAD(&V_pf_allrulelist, newrule, allrulelist);
2660 newrule->allrulelinked = true;
2661 V_pf_allrulecount++;
2662 }
2663 #endif
2664
2665 if (!(pcr->action == PF_CHANGE_REMOVE ||
2666 pcr->action == PF_CHANGE_GET_TICKET) &&
2667 pcr->pool_ticket != V_ticket_pabuf)
2668 ERROUT(EBUSY);
2669
2670 ruleset = pf_find_kruleset(pcr->anchor);
2671 if (ruleset == NULL)
2672 ERROUT(EINVAL);
2673
2674 rs_num = pf_get_ruleset_number(pcr->rule.action);
2675 if (rs_num >= PF_RULESET_MAX)
2676 ERROUT(EINVAL);
2677
2678 if (pcr->action == PF_CHANGE_GET_TICKET) {
2679 pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
2680 ERROUT(0);
2681 } else if (pcr->ticket !=
2682 ruleset->rules[rs_num].active.ticket)
2683 ERROUT(EINVAL);
2684
2685 if (pcr->action != PF_CHANGE_REMOVE) {
2686 if (newrule->ifname[0]) {
2687 newrule->kif = pfi_kkif_attach(kif,
2688 newrule->ifname);
2689 kif = NULL;
2690 pfi_kkif_ref(newrule->kif);
2691 } else
2692 newrule->kif = NULL;
2693
2694 if (newrule->rtableid > 0 &&
2695 newrule->rtableid >= rt_numfibs)
2696 error = EBUSY;
2697
2698 #ifdef ALTQ
2699 /* set queue IDs */
2700 if (newrule->qname[0] != 0) {
2701 if ((newrule->qid =
2702 pf_qname2qid(newrule->qname)) == 0)
2703 error = EBUSY;
2704 else if (newrule->pqname[0] != 0) {
2705 if ((newrule->pqid =
2706 pf_qname2qid(newrule->pqname)) == 0)
2707 error = EBUSY;
2708 } else
2709 newrule->pqid = newrule->qid;
2710 }
2711 #endif /* ALTQ */
2712 if (newrule->tagname[0])
2713 if ((newrule->tag =
2714 pf_tagname2tag(newrule->tagname)) == 0)
2715 error = EBUSY;
2716 if (newrule->match_tagname[0])
2717 if ((newrule->match_tag = pf_tagname2tag(
2718 newrule->match_tagname)) == 0)
2719 error = EBUSY;
2720 if (newrule->rt && !newrule->direction)
2721 error = EINVAL;
2722 if (!newrule->log)
2723 newrule->logif = 0;
2724 if (newrule->logif >= PFLOGIFS_MAX)
2725 error = EINVAL;
2726 if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af))
2727 error = ENOMEM;
2728 if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af))
2729 error = ENOMEM;
2730 if (pf_kanchor_setup(newrule, ruleset, pcr->anchor_call))
2731 error = EINVAL;
2732 TAILQ_FOREACH(pa, &V_pf_pabuf, entries)
2733 if (pa->addr.type == PF_ADDR_TABLE) {
2734 pa->addr.p.tbl =
2735 pfr_attach_table(ruleset,
2736 pa->addr.v.tblname);
2737 if (pa->addr.p.tbl == NULL)
2738 error = ENOMEM;
2739 }
2740
2741 newrule->overload_tbl = NULL;
2742 if (newrule->overload_tblname[0]) {
2743 if ((newrule->overload_tbl = pfr_attach_table(
2744 ruleset, newrule->overload_tblname)) ==
2745 NULL)
2746 error = EINVAL;
2747 else
2748 newrule->overload_tbl->pfrkt_flags |=
2749 PFR_TFLAG_ACTIVE;
2750 }
2751
2752 pf_mv_kpool(&V_pf_pabuf, &newrule->rpool.list);
2753 if (((((newrule->action == PF_NAT) ||
2754 (newrule->action == PF_RDR) ||
2755 (newrule->action == PF_BINAT) ||
2756 (newrule->rt > PF_NOPFROUTE)) &&
2757 !newrule->anchor)) &&
2758 (TAILQ_FIRST(&newrule->rpool.list) == NULL))
2759 error = EINVAL;
2760
2761 if (error) {
2762 pf_free_rule(newrule);
2763 PF_RULES_WUNLOCK();
2764 break;
2765 }
2766
2767 newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
2768 }
2769 pf_empty_kpool(&V_pf_pabuf);
2770
2771 if (pcr->action == PF_CHANGE_ADD_HEAD)
2772 oldrule = TAILQ_FIRST(
2773 ruleset->rules[rs_num].active.ptr);
2774 else if (pcr->action == PF_CHANGE_ADD_TAIL)
2775 oldrule = TAILQ_LAST(
2776 ruleset->rules[rs_num].active.ptr, pf_krulequeue);
2777 else {
2778 oldrule = TAILQ_FIRST(
2779 ruleset->rules[rs_num].active.ptr);
2780 while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
2781 oldrule = TAILQ_NEXT(oldrule, entries);
2782 if (oldrule == NULL) {
2783 if (newrule != NULL)
2784 pf_free_rule(newrule);
2785 PF_RULES_WUNLOCK();
2786 error = EINVAL;
2787 break;
2788 }
2789 }
2790
2791 if (pcr->action == PF_CHANGE_REMOVE) {
2792 pf_unlink_rule(ruleset->rules[rs_num].active.ptr,
2793 oldrule);
2794 ruleset->rules[rs_num].active.rcount--;
2795 } else {
2796 if (oldrule == NULL)
2797 TAILQ_INSERT_TAIL(
2798 ruleset->rules[rs_num].active.ptr,
2799 newrule, entries);
2800 else if (pcr->action == PF_CHANGE_ADD_HEAD ||
2801 pcr->action == PF_CHANGE_ADD_BEFORE)
2802 TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
2803 else
2804 TAILQ_INSERT_AFTER(
2805 ruleset->rules[rs_num].active.ptr,
2806 oldrule, newrule, entries);
2807 ruleset->rules[rs_num].active.rcount++;
2808 }
2809
2810 nr = 0;
2811 TAILQ_FOREACH(oldrule,
2812 ruleset->rules[rs_num].active.ptr, entries)
2813 oldrule->nr = nr++;
2814
2815 ruleset->rules[rs_num].active.ticket++;
2816
2817 pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
2818 pf_remove_if_empty_kruleset(ruleset);
2819
2820 PF_RULES_WUNLOCK();
2821 break;
2822
2823 #undef ERROUT
2824 DIOCCHANGERULE_error:
2825 PF_RULES_WUNLOCK();
2826 pf_krule_free(newrule);
2827 pf_kkif_free(kif);
2828 break;
2829 }
2830
2831 case DIOCCLRSTATES: {
2832 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
2833 struct pf_kstate_kill kill;
2834
2835 error = pf_state_kill_to_kstate_kill(psk, &kill);
2836 if (error)
2837 break;
2838
2839 psk->psk_killed = pf_clear_states(&kill);
2840 break;
2841 }
2842
2843 case DIOCCLRSTATESNV: {
2844 error = pf_clearstates_nv((struct pfioc_nv *)addr);
2845 break;
2846 }
2847
2848 case DIOCKILLSTATES: {
2849 struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
2850 struct pf_kstate_kill kill;
2851
2852 error = pf_state_kill_to_kstate_kill(psk, &kill);
2853 if (error)
2854 break;
2855
2856 psk->psk_killed = 0;
2857 pf_killstates(&kill, &psk->psk_killed);
2858 break;
2859 }
2860
2861 case DIOCKILLSTATESNV: {
2862 error = pf_killstates_nv((struct pfioc_nv *)addr);
2863 break;
2864 }
2865
2866 case DIOCADDSTATE: {
2867 struct pfioc_state *ps = (struct pfioc_state *)addr;
2868 struct pfsync_state *sp = &ps->state;
2869
2870 if (sp->timeout >= PFTM_MAX) {
2871 error = EINVAL;
2872 break;
2873 }
2874 if (V_pfsync_state_import_ptr != NULL) {
2875 PF_RULES_RLOCK();
2876 error = V_pfsync_state_import_ptr(sp, PFSYNC_SI_IOCTL);
2877 PF_RULES_RUNLOCK();
2878 } else
2879 error = EOPNOTSUPP;
2880 break;
2881 }
2882
2883 case DIOCGETSTATE: {
2884 struct pfioc_state *ps = (struct pfioc_state *)addr;
2885 struct pf_kstate *s;
2886
2887 s = pf_find_state_byid(ps->state.id, ps->state.creatorid);
2888 if (s == NULL) {
2889 error = ENOENT;
2890 break;
2891 }
2892
2893 pfsync_state_export(&ps->state, s);
2894 PF_STATE_UNLOCK(s);
2895 break;
2896 }
2897
2898 case DIOCGETSTATENV: {
2899 error = pf_getstate((struct pfioc_nv *)addr);
2900 break;
2901 }
2902
2903 case DIOCGETSTATES: {
2904 struct pfioc_states *ps = (struct pfioc_states *)addr;
2905 struct pf_kstate *s;
2906 struct pfsync_state *pstore, *p;
2907 int i, nr;
2908 size_t slice_count = 16, count;
2909 void *out;
2910
2911 if (ps->ps_len <= 0) {
2912 nr = uma_zone_get_cur(V_pf_state_z);
2913 ps->ps_len = sizeof(struct pfsync_state) * nr;
2914 break;
2915 }
2916
2917 out = ps->ps_states;
2918 pstore = mallocarray(slice_count,
2919 sizeof(struct pfsync_state), M_TEMP, M_WAITOK | M_ZERO);
2920 nr = 0;
2921
2922 for (i = 0; i <= pf_hashmask; i++) {
2923 struct pf_idhash *ih = &V_pf_idhash[i];
2924
2925 DIOCGETSTATES_retry:
2926 p = pstore;
2927
2928 if (LIST_EMPTY(&ih->states))
2929 continue;
2930
2931 PF_HASHROW_LOCK(ih);
2932 count = 0;
2933 LIST_FOREACH(s, &ih->states, entry) {
2934 if (s->timeout == PFTM_UNLINKED)
2935 continue;
2936 count++;
2937 }
2938
2939 if (count > slice_count) {
2940 PF_HASHROW_UNLOCK(ih);
2941 free(pstore, M_TEMP);
2942 slice_count = count * 2;
2943 pstore = mallocarray(slice_count,
2944 sizeof(struct pfsync_state), M_TEMP,
2945 M_WAITOK | M_ZERO);
2946 goto DIOCGETSTATES_retry;
2947 }
2948
2949 if ((nr+count) * sizeof(*p) > ps->ps_len) {
2950 PF_HASHROW_UNLOCK(ih);
2951 goto DIOCGETSTATES_full;
2952 }
2953
2954 LIST_FOREACH(s, &ih->states, entry) {
2955
2956 if (s->timeout == PFTM_UNLINKED)
2957 continue;
2958
2959 pfsync_state_export(p, s);
2960 p++;
2961 nr++;
2962 }
2963 PF_HASHROW_UNLOCK(ih);
2964 error = copyout(pstore, out,
2965 sizeof(struct pfsync_state) * count);
2966 if (error)
2967 break;
2968 out = ps->ps_states + nr;
2969 }
2970 DIOCGETSTATES_full:
2971 ps->ps_len = sizeof(struct pfsync_state) * nr;
2972 free(pstore, M_TEMP);
2973
2974 break;
2975 }
2976
2977 case DIOCGETSTATESV2: {
2978 struct pfioc_states_v2 *ps = (struct pfioc_states_v2 *)addr;
2979 struct pf_kstate *s;
2980 struct pf_state_export *pstore, *p;
2981 int i, nr;
2982 size_t slice_count = 16, count;
2983 void *out;
2984
2985 if (ps->ps_req_version > PF_STATE_VERSION) {
2986 error = ENOTSUP;
2987 break;
2988 }
2989
2990 if (ps->ps_len <= 0) {
2991 nr = uma_zone_get_cur(V_pf_state_z);
2992 ps->ps_len = sizeof(struct pf_state_export) * nr;
2993 break;
2994 }
2995
2996 out = ps->ps_states;
2997 pstore = mallocarray(slice_count,
2998 sizeof(struct pf_state_export), M_TEMP, M_WAITOK | M_ZERO);
2999 nr = 0;
3000
3001 for (i = 0; i <= pf_hashmask; i++) {
3002 struct pf_idhash *ih = &V_pf_idhash[i];
3003
3004 DIOCGETSTATESV2_retry:
3005 p = pstore;
3006
3007 if (LIST_EMPTY(&ih->states))
3008 continue;
3009
3010 PF_HASHROW_LOCK(ih);
3011 count = 0;
3012 LIST_FOREACH(s, &ih->states, entry) {
3013 if (s->timeout == PFTM_UNLINKED)
3014 continue;
3015 count++;
3016 }
3017
3018 if (count > slice_count) {
3019 PF_HASHROW_UNLOCK(ih);
3020 free(pstore, M_TEMP);
3021 slice_count = count * 2;
3022 pstore = mallocarray(slice_count,
3023 sizeof(struct pf_state_export), M_TEMP,
3024 M_WAITOK | M_ZERO);
3025 goto DIOCGETSTATESV2_retry;
3026 }
3027
3028 if ((nr+count) * sizeof(*p) > ps->ps_len) {
3029 PF_HASHROW_UNLOCK(ih);
3030 goto DIOCGETSTATESV2_full;
3031 }
3032
3033 LIST_FOREACH(s, &ih->states, entry) {
3034 if (s->timeout == PFTM_UNLINKED)
3035 continue;
3036
3037 pf_state_export(p, s);
3038 p++;
3039 nr++;
3040 }
3041 PF_HASHROW_UNLOCK(ih);
3042 error = copyout(pstore, out,
3043 sizeof(struct pf_state_export) * count);
3044 if (error)
3045 break;
3046 out = ps->ps_states + nr;
3047 }
3048 DIOCGETSTATESV2_full:
3049 ps->ps_len = nr * sizeof(struct pf_state_export);
3050 free(pstore, M_TEMP);
3051
3052 break;
3053 }
3054
3055 case DIOCGETSTATUS: {
3056 struct pf_status *s = (struct pf_status *)addr;
3057
3058 PF_RULES_RLOCK();
3059 s->running = V_pf_status.running;
3060 s->since = V_pf_status.since;
3061 s->debug = V_pf_status.debug;
3062 s->hostid = V_pf_status.hostid;
3063 s->states = V_pf_status.states;
3064 s->src_nodes = V_pf_status.src_nodes;
3065
3066 for (int i = 0; i < PFRES_MAX; i++)
3067 s->counters[i] =
3068 counter_u64_fetch(V_pf_status.counters[i]);
3069 for (int i = 0; i < LCNT_MAX; i++)
3070 s->lcounters[i] =
3071 counter_u64_fetch(V_pf_status.lcounters[i]);
3072 for (int i = 0; i < FCNT_MAX; i++)
3073 s->fcounters[i] =
3074 pf_counter_u64_fetch(&V_pf_status.fcounters[i]);
3075 for (int i = 0; i < SCNT_MAX; i++)
3076 s->scounters[i] =
3077 counter_u64_fetch(V_pf_status.scounters[i]);
3078
3079 bcopy(V_pf_status.ifname, s->ifname, IFNAMSIZ);
3080 bcopy(V_pf_status.pf_chksum, s->pf_chksum,
3081 PF_MD5_DIGEST_LENGTH);
3082
3083 pfi_update_status(s->ifname, s);
3084 PF_RULES_RUNLOCK();
3085 break;
3086 }
3087
3088 case DIOCGETSTATUSNV: {
3089 error = pf_getstatus((struct pfioc_nv *)addr);
3090 break;
3091 }
3092
3093 case DIOCSETSTATUSIF: {
3094 struct pfioc_if *pi = (struct pfioc_if *)addr;
3095
3096 if (pi->ifname[0] == 0) {
3097 bzero(V_pf_status.ifname, IFNAMSIZ);
3098 break;
3099 }
3100 PF_RULES_WLOCK();
3101 strlcpy(V_pf_status.ifname, pi->ifname, IFNAMSIZ);
3102 PF_RULES_WUNLOCK();
3103 break;
3104 }
3105
3106 case DIOCCLRSTATUS: {
3107 PF_RULES_WLOCK();
3108 for (int i = 0; i < PFRES_MAX; i++)
3109 counter_u64_zero(V_pf_status.counters[i]);
3110 for (int i = 0; i < FCNT_MAX; i++)
3111 pf_counter_u64_zero(&V_pf_status.fcounters[i]);
3112 for (int i = 0; i < SCNT_MAX; i++)
3113 counter_u64_zero(V_pf_status.scounters[i]);
3114 for (int i = 0; i < KLCNT_MAX; i++)
3115 counter_u64_zero(V_pf_status.lcounters[i]);
3116 V_pf_status.since = time_second;
3117 if (*V_pf_status.ifname)
3118 pfi_update_status(V_pf_status.ifname, NULL);
3119 PF_RULES_WUNLOCK();
3120 break;
3121 }
3122
3123 case DIOCNATLOOK: {
3124 struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr;
3125 struct pf_state_key *sk;
3126 struct pf_kstate *state;
3127 struct pf_state_key_cmp key;
3128 int m = 0, direction = pnl->direction;
3129 int sidx, didx;
3130
3131 /* NATLOOK src and dst are reversed, so reverse sidx/didx */
3132 sidx = (direction == PF_IN) ? 1 : 0;
3133 didx = (direction == PF_IN) ? 0 : 1;
3134
3135 if (!pnl->proto ||
3136 PF_AZERO(&pnl->saddr, pnl->af) ||
3137 PF_AZERO(&pnl->daddr, pnl->af) ||
3138 ((pnl->proto == IPPROTO_TCP ||
3139 pnl->proto == IPPROTO_UDP) &&
3140 (!pnl->dport || !pnl->sport)))
3141 error = EINVAL;
3142 else {
3143 bzero(&key, sizeof(key));
3144 key.af = pnl->af;
3145 key.proto = pnl->proto;
3146 PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af);
3147 key.port[sidx] = pnl->sport;
3148 PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af);
3149 key.port[didx] = pnl->dport;
3150
3151 state = pf_find_state_all(&key, direction, &m);
3152
3153 if (m > 1)
3154 error = E2BIG; /* more than one state */
3155 else if (state != NULL) {
3156 /* XXXGL: not locked read */
3157 sk = state->key[sidx];
3158 PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af);
3159 pnl->rsport = sk->port[sidx];
3160 PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af);
3161 pnl->rdport = sk->port[didx];
3162 } else
3163 error = ENOENT;
3164 }
3165 break;
3166 }
3167
3168 case DIOCSETTIMEOUT: {
3169 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
3170 int old;
3171
3172 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
3173 pt->seconds < 0) {
3174 error = EINVAL;
3175 break;
3176 }
3177 PF_RULES_WLOCK();
3178 old = V_pf_default_rule.timeout[pt->timeout];
3179 if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
3180 pt->seconds = 1;
3181 V_pf_default_rule.timeout[pt->timeout] = pt->seconds;
3182 if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
3183 wakeup(pf_purge_thread);
3184 pt->seconds = old;
3185 PF_RULES_WUNLOCK();
3186 break;
3187 }
3188
3189 case DIOCGETTIMEOUT: {
3190 struct pfioc_tm *pt = (struct pfioc_tm *)addr;
3191
3192 if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
3193 error = EINVAL;
3194 break;
3195 }
3196 PF_RULES_RLOCK();
3197 pt->seconds = V_pf_default_rule.timeout[pt->timeout];
3198 PF_RULES_RUNLOCK();
3199 break;
3200 }
3201
3202 case DIOCGETLIMIT: {
3203 struct pfioc_limit *pl = (struct pfioc_limit *)addr;
3204
3205 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
3206 error = EINVAL;
3207 break;
3208 }
3209 PF_RULES_RLOCK();
3210 pl->limit = V_pf_limits[pl->index].limit;
3211 PF_RULES_RUNLOCK();
3212 break;
3213 }
3214
3215 case DIOCSETLIMIT: {
3216 struct pfioc_limit *pl = (struct pfioc_limit *)addr;
3217 int old_limit;
3218
3219 PF_RULES_WLOCK();
3220 if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
3221 V_pf_limits[pl->index].zone == NULL) {
3222 PF_RULES_WUNLOCK();
3223 error = EINVAL;
3224 break;
3225 }
3226 uma_zone_set_max(V_pf_limits[pl->index].zone, pl->limit);
3227 old_limit = V_pf_limits[pl->index].limit;
3228 V_pf_limits[pl->index].limit = pl->limit;
3229 pl->limit = old_limit;
3230 PF_RULES_WUNLOCK();
3231 break;
3232 }
3233
3234 case DIOCSETDEBUG: {
3235 u_int32_t *level = (u_int32_t *)addr;
3236
3237 PF_RULES_WLOCK();
3238 V_pf_status.debug = *level;
3239 PF_RULES_WUNLOCK();
3240 break;
3241 }
3242
3243 case DIOCCLRRULECTRS: {
3244 /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
3245 struct pf_kruleset *ruleset = &pf_main_ruleset;
3246 struct pf_krule *rule;
3247
3248 PF_RULES_WLOCK();
3249 TAILQ_FOREACH(rule,
3250 ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
3251 pf_counter_u64_zero(&rule->evaluations);
3252 for (int i = 0; i < 2; i++) {
3253 pf_counter_u64_zero(&rule->packets[i]);
3254 pf_counter_u64_zero(&rule->bytes[i]);
3255 }
3256 }
3257 PF_RULES_WUNLOCK();
3258 break;
3259 }
3260
3261 case DIOCGIFSPEEDV0:
3262 case DIOCGIFSPEEDV1: {
3263 struct pf_ifspeed_v1 *psp = (struct pf_ifspeed_v1 *)addr;
3264 struct pf_ifspeed_v1 ps;
3265 struct ifnet *ifp;
3266
3267 if (psp->ifname[0] != 0) {
3268 /* Can we completely trust user-land? */
3269 strlcpy(ps.ifname, psp->ifname, IFNAMSIZ);
3270 ifp = ifunit(ps.ifname);
3271 if (ifp != NULL) {
3272 psp->baudrate32 =
3273 (u_int32_t)uqmin(ifp->if_baudrate, UINT_MAX);
3274 if (cmd == DIOCGIFSPEEDV1)
3275 psp->baudrate = ifp->if_baudrate;
3276 } else
3277 error = EINVAL;
3278 } else
3279 error = EINVAL;
3280 break;
3281 }
3282
3283 #ifdef ALTQ
3284 case DIOCSTARTALTQ: {
3285 struct pf_altq *altq;
3286
3287 PF_RULES_WLOCK();
3288 /* enable all altq interfaces on active list */
3289 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
3290 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
3291 error = pf_enable_altq(altq);
3292 if (error != 0)
3293 break;
3294 }
3295 }
3296 if (error == 0)
3297 V_pf_altq_running = 1;
3298 PF_RULES_WUNLOCK();
3299 DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
3300 break;
3301 }
3302
3303 case DIOCSTOPALTQ: {
3304 struct pf_altq *altq;
3305
3306 PF_RULES_WLOCK();
3307 /* disable all altq interfaces on active list */
3308 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries) {
3309 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
3310 error = pf_disable_altq(altq);
3311 if (error != 0)
3312 break;
3313 }
3314 }
3315 if (error == 0)
3316 V_pf_altq_running = 0;
3317 PF_RULES_WUNLOCK();
3318 DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
3319 break;
3320 }
3321
3322 case DIOCADDALTQV0:
3323 case DIOCADDALTQV1: {
3324 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr;
3325 struct pf_altq *altq, *a;
3326 struct ifnet *ifp;
3327
3328 altq = malloc(sizeof(*altq), M_PFALTQ, M_WAITOK | M_ZERO);
3329 error = pf_import_kaltq(pa, altq, IOCPARM_LEN(cmd));
3330 if (error)
3331 break;
3332 altq->local_flags = 0;
3333
3334 PF_RULES_WLOCK();
3335 if (pa->ticket != V_ticket_altqs_inactive) {
3336 PF_RULES_WUNLOCK();
3337 free(altq, M_PFALTQ);
3338 error = EBUSY;
3339 break;
3340 }
3341
3342 /*
3343 * if this is for a queue, find the discipline and
3344 * copy the necessary fields
3345 */
3346 if (altq->qname[0] != 0) {
3347 if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
3348 PF_RULES_WUNLOCK();
3349 error = EBUSY;
3350 free(altq, M_PFALTQ);
3351 break;
3352 }
3353 altq->altq_disc = NULL;
3354 TAILQ_FOREACH(a, V_pf_altq_ifs_inactive, entries) {
3355 if (strncmp(a->ifname, altq->ifname,
3356 IFNAMSIZ) == 0) {
3357 altq->altq_disc = a->altq_disc;
3358 break;
3359 }
3360 }
3361 }
3362
3363 if ((ifp = ifunit(altq->ifname)) == NULL)
3364 altq->local_flags |= PFALTQ_FLAG_IF_REMOVED;
3365 else
3366 error = altq_add(ifp, altq);
3367
3368 if (error) {
3369 PF_RULES_WUNLOCK();
3370 free(altq, M_PFALTQ);
3371 break;
3372 }
3373
3374 if (altq->qname[0] != 0)
3375 TAILQ_INSERT_TAIL(V_pf_altqs_inactive, altq, entries);
3376 else
3377 TAILQ_INSERT_TAIL(V_pf_altq_ifs_inactive, altq, entries);
3378 /* version error check done on import above */
3379 pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd));
3380 PF_RULES_WUNLOCK();
3381 break;
3382 }
3383
3384 case DIOCGETALTQSV0:
3385 case DIOCGETALTQSV1: {
3386 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr;
3387 struct pf_altq *altq;
3388
3389 PF_RULES_RLOCK();
3390 pa->nr = 0;
3391 TAILQ_FOREACH(altq, V_pf_altq_ifs_active, entries)
3392 pa->nr++;
3393 TAILQ_FOREACH(altq, V_pf_altqs_active, entries)
3394 pa->nr++;
3395 pa->ticket = V_ticket_altqs_active;
3396 PF_RULES_RUNLOCK();
3397 break;
3398 }
3399
3400 case DIOCGETALTQV0:
3401 case DIOCGETALTQV1: {
3402 struct pfioc_altq_v1 *pa = (struct pfioc_altq_v1 *)addr;
3403 struct pf_altq *altq;
3404
3405 PF_RULES_RLOCK();
3406 if (pa->ticket != V_ticket_altqs_active) {
3407 PF_RULES_RUNLOCK();
3408 error = EBUSY;
3409 break;
3410 }
3411 altq = pf_altq_get_nth_active(pa->nr);
3412 if (altq == NULL) {
3413 PF_RULES_RUNLOCK();
3414 error = EBUSY;
3415 break;
3416 }
3417 pf_export_kaltq(altq, pa, IOCPARM_LEN(cmd));
3418 PF_RULES_RUNLOCK();
3419 break;
3420 }
3421
3422 case DIOCCHANGEALTQV0:
3423 case DIOCCHANGEALTQV1:
3424 /* CHANGEALTQ not supported yet! */
3425 error = ENODEV;
3426 break;
3427
3428 case DIOCGETQSTATSV0:
3429 case DIOCGETQSTATSV1: {
3430 struct pfioc_qstats_v1 *pq = (struct pfioc_qstats_v1 *)addr;
3431 struct pf_altq *altq;
3432 int nbytes;
3433 u_int32_t version;
3434
3435 PF_RULES_RLOCK();
3436 if (pq->ticket != V_ticket_altqs_active) {
3437 PF_RULES_RUNLOCK();
3438 error = EBUSY;
3439 break;
3440 }
3441 nbytes = pq->nbytes;
3442 altq = pf_altq_get_nth_active(pq->nr);
3443 if (altq == NULL) {
3444 PF_RULES_RUNLOCK();
3445 error = EBUSY;
3446 break;
3447 }
3448
3449 if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) != 0) {
3450 PF_RULES_RUNLOCK();
3451 error = ENXIO;
3452 break;
3453 }
3454 PF_RULES_RUNLOCK();
3455 if (cmd == DIOCGETQSTATSV0)
3456 version = 0; /* DIOCGETQSTATSV0 means stats struct v0 */
3457 else
3458 version = pq->version;
3459 error = altq_getqstats(altq, pq->buf, &nbytes, version);
3460 if (error == 0) {
3461 pq->scheduler = altq->scheduler;
3462 pq->nbytes = nbytes;
3463 }
3464 break;
3465 }
3466 #endif /* ALTQ */
3467
3468 case DIOCBEGINADDRS: {
3469 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
3470
3471 PF_RULES_WLOCK();
3472 pf_empty_kpool(&V_pf_pabuf);
3473 pp->ticket = ++V_ticket_pabuf;
3474 PF_RULES_WUNLOCK();
3475 break;
3476 }
3477
3478 case DIOCADDADDR: {
3479 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
3480 struct pf_kpooladdr *pa;
3481 struct pfi_kkif *kif = NULL;
3482
3483 #ifndef INET
3484 if (pp->af == AF_INET) {
3485 error = EAFNOSUPPORT;
3486 break;
3487 }
3488 #endif /* INET */
3489 #ifndef INET6
3490 if (pp->af == AF_INET6) {
3491 error = EAFNOSUPPORT;
3492 break;
3493 }
3494 #endif /* INET6 */
3495 if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
3496 pp->addr.addr.type != PF_ADDR_DYNIFTL &&
3497 pp->addr.addr.type != PF_ADDR_TABLE) {
3498 error = EINVAL;
3499 break;
3500 }
3501 if (pp->addr.addr.p.dyn != NULL) {
3502 error = EINVAL;
3503 break;
3504 }
3505 pa = malloc(sizeof(*pa), M_PFRULE, M_WAITOK);
3506 pf_pooladdr_to_kpooladdr(&pp->addr, pa);
3507 if (pa->ifname[0])
3508 kif = pf_kkif_create(M_WAITOK);
3509 PF_RULES_WLOCK();
3510 if (pp->ticket != V_ticket_pabuf) {
3511 PF_RULES_WUNLOCK();
3512 if (pa->ifname[0])
3513 pf_kkif_free(kif);
3514 free(pa, M_PFRULE);
3515 error = EBUSY;
3516 break;
3517 }
3518 if (pa->ifname[0]) {
3519 pa->kif = pfi_kkif_attach(kif, pa->ifname);
3520 kif = NULL;
3521 pfi_kkif_ref(pa->kif);
3522 } else
3523 pa->kif = NULL;
3524 if (pa->addr.type == PF_ADDR_DYNIFTL && ((error =
3525 pfi_dynaddr_setup(&pa->addr, pp->af)) != 0)) {
3526 if (pa->ifname[0])
3527 pfi_kkif_unref(pa->kif);
3528 PF_RULES_WUNLOCK();
3529 free(pa, M_PFRULE);
3530 break;
3531 }
3532 TAILQ_INSERT_TAIL(&V_pf_pabuf, pa, entries);
3533 PF_RULES_WUNLOCK();
3534 break;
3535 }
3536
3537 case DIOCGETADDRS: {
3538 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
3539 struct pf_kpool *pool;
3540 struct pf_kpooladdr *pa;
3541
3542 PF_RULES_RLOCK();
3543 pp->nr = 0;
3544 pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action,
3545 pp->r_num, 0, 1, 0);
3546 if (pool == NULL) {
3547 PF_RULES_RUNLOCK();
3548 error = EBUSY;
3549 break;
3550 }
3551 TAILQ_FOREACH(pa, &pool->list, entries)
3552 pp->nr++;
3553 PF_RULES_RUNLOCK();
3554 break;
3555 }
3556
3557 case DIOCGETADDR: {
3558 struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
3559 struct pf_kpool *pool;
3560 struct pf_kpooladdr *pa;
3561 u_int32_t nr = 0;
3562
3563 PF_RULES_RLOCK();
3564 pool = pf_get_kpool(pp->anchor, pp->ticket, pp->r_action,
3565 pp->r_num, 0, 1, 1);
3566 if (pool == NULL) {
3567 PF_RULES_RUNLOCK();
3568 error = EBUSY;
3569 break;
3570 }
3571 pa = TAILQ_FIRST(&pool->list);
3572 while ((pa != NULL) && (nr < pp->nr)) {
3573 pa = TAILQ_NEXT(pa, entries);
3574 nr++;
3575 }
3576 if (pa == NULL) {
3577 PF_RULES_RUNLOCK();
3578 error = EBUSY;
3579 break;
3580 }
3581 pf_kpooladdr_to_pooladdr(pa, &pp->addr);
3582 pf_addr_copyout(&pp->addr.addr);
3583 PF_RULES_RUNLOCK();
3584 break;
3585 }
3586
3587 case DIOCCHANGEADDR: {
3588 struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr;
3589 struct pf_kpool *pool;
3590 struct pf_kpooladdr *oldpa = NULL, *newpa = NULL;
3591 struct pf_kruleset *ruleset;
3592 struct pfi_kkif *kif = NULL;
3593
3594 if (pca->action < PF_CHANGE_ADD_HEAD ||
3595 pca->action > PF_CHANGE_REMOVE) {
3596 error = EINVAL;
3597 break;
3598 }
3599 if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
3600 pca->addr.addr.type != PF_ADDR_DYNIFTL &&
3601 pca->addr.addr.type != PF_ADDR_TABLE) {
3602 error = EINVAL;
3603 break;
3604 }
3605 if (pca->addr.addr.p.dyn != NULL) {
3606 error = EINVAL;
3607 break;
3608 }
3609
3610 if (pca->action != PF_CHANGE_REMOVE) {
3611 #ifndef INET
3612 if (pca->af == AF_INET) {
3613 error = EAFNOSUPPORT;
3614 break;
3615 }
3616 #endif /* INET */
3617 #ifndef INET6
3618 if (pca->af == AF_INET6) {
3619 error = EAFNOSUPPORT;
3620 break;
3621 }
3622 #endif /* INET6 */
3623 newpa = malloc(sizeof(*newpa), M_PFRULE, M_WAITOK);
3624 bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr));
3625 if (newpa->ifname[0])
3626 kif = pf_kkif_create(M_WAITOK);
3627 newpa->kif = NULL;
3628 }
3629
3630 #define ERROUT(x) ERROUT_IOCTL(DIOCCHANGEADDR_error, x)
3631 PF_RULES_WLOCK();
3632 ruleset = pf_find_kruleset(pca->anchor);
3633 if (ruleset == NULL)
3634 ERROUT(EBUSY);
3635
3636 pool = pf_get_kpool(pca->anchor, pca->ticket, pca->r_action,
3637 pca->r_num, pca->r_last, 1, 1);
3638 if (pool == NULL)
3639 ERROUT(EBUSY);
3640
3641 if (pca->action != PF_CHANGE_REMOVE) {
3642 if (newpa->ifname[0]) {
3643 newpa->kif = pfi_kkif_attach(kif, newpa->ifname);
3644 pfi_kkif_ref(newpa->kif);
3645 kif = NULL;
3646 }
3647
3648 switch (newpa->addr.type) {
3649 case PF_ADDR_DYNIFTL:
3650 error = pfi_dynaddr_setup(&newpa->addr,
3651 pca->af);
3652 break;
3653 case PF_ADDR_TABLE:
3654 newpa->addr.p.tbl = pfr_attach_table(ruleset,
3655 newpa->addr.v.tblname);
3656 if (newpa->addr.p.tbl == NULL)
3657 error = ENOMEM;
3658 break;
3659 }
3660 if (error)
3661 goto DIOCCHANGEADDR_error;
3662 }
3663
3664 switch (pca->action) {
3665 case PF_CHANGE_ADD_HEAD:
3666 oldpa = TAILQ_FIRST(&pool->list);
3667 break;
3668 case PF_CHANGE_ADD_TAIL:
3669 oldpa = TAILQ_LAST(&pool->list, pf_kpalist);
3670 break;
3671 default:
3672 oldpa = TAILQ_FIRST(&pool->list);
3673 for (int i = 0; oldpa && i < pca->nr; i++)
3674 oldpa = TAILQ_NEXT(oldpa, entries);
3675
3676 if (oldpa == NULL)
3677 ERROUT(EINVAL);
3678 }
3679
3680 if (pca->action == PF_CHANGE_REMOVE) {
3681 TAILQ_REMOVE(&pool->list, oldpa, entries);
3682 switch (oldpa->addr.type) {
3683 case PF_ADDR_DYNIFTL:
3684 pfi_dynaddr_remove(oldpa->addr.p.dyn);
3685 break;
3686 case PF_ADDR_TABLE:
3687 pfr_detach_table(oldpa->addr.p.tbl);
3688 break;
3689 }
3690 if (oldpa->kif)
3691 pfi_kkif_unref(oldpa->kif);
3692 free(oldpa, M_PFRULE);
3693 } else {
3694 if (oldpa == NULL)
3695 TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
3696 else if (pca->action == PF_CHANGE_ADD_HEAD ||
3697 pca->action == PF_CHANGE_ADD_BEFORE)
3698 TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
3699 else
3700 TAILQ_INSERT_AFTER(&pool->list, oldpa,
3701 newpa, entries);
3702 }
3703
3704 pool->cur = TAILQ_FIRST(&pool->list);
3705 PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr, pca->af);
3706 PF_RULES_WUNLOCK();
3707 break;
3708
3709 #undef ERROUT
3710 DIOCCHANGEADDR_error:
3711 if (newpa != NULL) {
3712 if (newpa->kif)
3713 pfi_kkif_unref(newpa->kif);
3714 free(newpa, M_PFRULE);
3715 }
3716 PF_RULES_WUNLOCK();
3717 pf_kkif_free(kif);
3718 break;
3719 }
3720
3721 case DIOCGETRULESETS: {
3722 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
3723 struct pf_kruleset *ruleset;
3724 struct pf_kanchor *anchor;
3725
3726 PF_RULES_RLOCK();
3727 pr->path[sizeof(pr->path) - 1] = 0;
3728 if ((ruleset = pf_find_kruleset(pr->path)) == NULL) {
3729 PF_RULES_RUNLOCK();
3730 error = ENOENT;
3731 break;
3732 }
3733 pr->nr = 0;
3734 if (ruleset->anchor == NULL) {
3735 /* XXX kludge for pf_main_ruleset */
3736 RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors)
3737 if (anchor->parent == NULL)
3738 pr->nr++;
3739 } else {
3740 RB_FOREACH(anchor, pf_kanchor_node,
3741 &ruleset->anchor->children)
3742 pr->nr++;
3743 }
3744 PF_RULES_RUNLOCK();
3745 break;
3746 }
3747
3748 case DIOCGETRULESET: {
3749 struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
3750 struct pf_kruleset *ruleset;
3751 struct pf_kanchor *anchor;
3752 u_int32_t nr = 0;
3753
3754 PF_RULES_RLOCK();
3755 pr->path[sizeof(pr->path) - 1] = 0;
3756 if ((ruleset = pf_find_kruleset(pr->path)) == NULL) {
3757 PF_RULES_RUNLOCK();
3758 error = ENOENT;
3759 break;
3760 }
3761 pr->name[0] = 0;
3762 if (ruleset->anchor == NULL) {
3763 /* XXX kludge for pf_main_ruleset */
3764 RB_FOREACH(anchor, pf_kanchor_global, &V_pf_anchors)
3765 if (anchor->parent == NULL && nr++ == pr->nr) {
3766 strlcpy(pr->name, anchor->name,
3767 sizeof(pr->name));
3768 break;
3769 }
3770 } else {
3771 RB_FOREACH(anchor, pf_kanchor_node,
3772 &ruleset->anchor->children)
3773 if (nr++ == pr->nr) {
3774 strlcpy(pr->name, anchor->name,
3775 sizeof(pr->name));
3776 break;
3777 }
3778 }
3779 if (!pr->name[0])
3780 error = EBUSY;
3781 PF_RULES_RUNLOCK();
3782 break;
3783 }
3784
3785 case DIOCRCLRTABLES: {
3786 struct pfioc_table *io = (struct pfioc_table *)addr;
3787
3788 if (io->pfrio_esize != 0) {
3789 error = ENODEV;
3790 break;
3791 }
3792 PF_RULES_WLOCK();
3793 error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
3794 io->pfrio_flags | PFR_FLAG_USERIOCTL);
3795 PF_RULES_WUNLOCK();
3796 break;
3797 }
3798
3799 case DIOCRADDTABLES: {
3800 struct pfioc_table *io = (struct pfioc_table *)addr;
3801 struct pfr_table *pfrts;
3802 size_t totlen;
3803
3804 if (io->pfrio_esize != sizeof(struct pfr_table)) {
3805 error = ENODEV;
3806 break;
3807 }
3808
3809 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount ||
3810 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) {
3811 error = ENOMEM;
3812 break;
3813 }
3814
3815 totlen = io->pfrio_size * sizeof(struct pfr_table);
3816 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
3817 M_TEMP, M_WAITOK);
3818 error = copyin(io->pfrio_buffer, pfrts, totlen);
3819 if (error) {
3820 free(pfrts, M_TEMP);
3821 break;
3822 }
3823 PF_RULES_WLOCK();
3824 error = pfr_add_tables(pfrts, io->pfrio_size,
3825 &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3826 PF_RULES_WUNLOCK();
3827 free(pfrts, M_TEMP);
3828 break;
3829 }
3830
3831 case DIOCRDELTABLES: {
3832 struct pfioc_table *io = (struct pfioc_table *)addr;
3833 struct pfr_table *pfrts;
3834 size_t totlen;
3835
3836 if (io->pfrio_esize != sizeof(struct pfr_table)) {
3837 error = ENODEV;
3838 break;
3839 }
3840
3841 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount ||
3842 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) {
3843 error = ENOMEM;
3844 break;
3845 }
3846
3847 totlen = io->pfrio_size * sizeof(struct pfr_table);
3848 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
3849 M_TEMP, M_WAITOK);
3850 error = copyin(io->pfrio_buffer, pfrts, totlen);
3851 if (error) {
3852 free(pfrts, M_TEMP);
3853 break;
3854 }
3855 PF_RULES_WLOCK();
3856 error = pfr_del_tables(pfrts, io->pfrio_size,
3857 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3858 PF_RULES_WUNLOCK();
3859 free(pfrts, M_TEMP);
3860 break;
3861 }
3862
3863 case DIOCRGETTABLES: {
3864 struct pfioc_table *io = (struct pfioc_table *)addr;
3865 struct pfr_table *pfrts;
3866 size_t totlen;
3867 int n;
3868
3869 if (io->pfrio_esize != sizeof(struct pfr_table)) {
3870 error = ENODEV;
3871 break;
3872 }
3873 PF_RULES_RLOCK();
3874 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
3875 if (n < 0) {
3876 PF_RULES_RUNLOCK();
3877 error = EINVAL;
3878 break;
3879 }
3880 io->pfrio_size = min(io->pfrio_size, n);
3881
3882 totlen = io->pfrio_size * sizeof(struct pfr_table);
3883
3884 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
3885 M_TEMP, M_NOWAIT);
3886 if (pfrts == NULL) {
3887 error = ENOMEM;
3888 PF_RULES_RUNLOCK();
3889 break;
3890 }
3891 error = pfr_get_tables(&io->pfrio_table, pfrts,
3892 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3893 PF_RULES_RUNLOCK();
3894 if (error == 0)
3895 error = copyout(pfrts, io->pfrio_buffer, totlen);
3896 free(pfrts, M_TEMP);
3897 break;
3898 }
3899
3900 case DIOCRGETTSTATS: {
3901 struct pfioc_table *io = (struct pfioc_table *)addr;
3902 struct pfr_tstats *pfrtstats;
3903 size_t totlen;
3904 int n;
3905
3906 if (io->pfrio_esize != sizeof(struct pfr_tstats)) {
3907 error = ENODEV;
3908 break;
3909 }
3910 PF_TABLE_STATS_LOCK();
3911 PF_RULES_RLOCK();
3912 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
3913 if (n < 0) {
3914 PF_RULES_RUNLOCK();
3915 PF_TABLE_STATS_UNLOCK();
3916 error = EINVAL;
3917 break;
3918 }
3919 io->pfrio_size = min(io->pfrio_size, n);
3920
3921 totlen = io->pfrio_size * sizeof(struct pfr_tstats);
3922 pfrtstats = mallocarray(io->pfrio_size,
3923 sizeof(struct pfr_tstats), M_TEMP, M_NOWAIT);
3924 if (pfrtstats == NULL) {
3925 error = ENOMEM;
3926 PF_RULES_RUNLOCK();
3927 PF_TABLE_STATS_UNLOCK();
3928 break;
3929 }
3930 error = pfr_get_tstats(&io->pfrio_table, pfrtstats,
3931 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3932 PF_RULES_RUNLOCK();
3933 PF_TABLE_STATS_UNLOCK();
3934 if (error == 0)
3935 error = copyout(pfrtstats, io->pfrio_buffer, totlen);
3936 free(pfrtstats, M_TEMP);
3937 break;
3938 }
3939
3940 case DIOCRCLRTSTATS: {
3941 struct pfioc_table *io = (struct pfioc_table *)addr;
3942 struct pfr_table *pfrts;
3943 size_t totlen;
3944
3945 if (io->pfrio_esize != sizeof(struct pfr_table)) {
3946 error = ENODEV;
3947 break;
3948 }
3949
3950 if (io->pfrio_size < 0 || io->pfrio_size > pf_ioctl_maxcount ||
3951 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_table))) {
3952 /* We used to count tables and use the minimum required
3953 * size, so we didn't fail on overly large requests.
3954 * Keep doing so. */
3955 io->pfrio_size = pf_ioctl_maxcount;
3956 break;
3957 }
3958
3959 totlen = io->pfrio_size * sizeof(struct pfr_table);
3960 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
3961 M_TEMP, M_NOWAIT);
3962 if (pfrts == NULL) {
3963 error = ENOMEM;
3964 break;
3965 }
3966 error = copyin(io->pfrio_buffer, pfrts, totlen);
3967 if (error) {
3968 free(pfrts, M_TEMP);
3969 break;
3970 }
3971
3972 PF_TABLE_STATS_LOCK();
3973 PF_RULES_RLOCK();
3974 error = pfr_clr_tstats(pfrts, io->pfrio_size,
3975 &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
3976 PF_RULES_RUNLOCK();
3977 PF_TABLE_STATS_UNLOCK();
3978 free(pfrts, M_TEMP);
3979 break;
3980 }
3981
3982 case DIOCRSETTFLAGS: {
3983 struct pfioc_table *io = (struct pfioc_table *)addr;
3984 struct pfr_table *pfrts;
3985 size_t totlen;
3986 int n;
3987
3988 if (io->pfrio_esize != sizeof(struct pfr_table)) {
3989 error = ENODEV;
3990 break;
3991 }
3992
3993 PF_RULES_RLOCK();
3994 n = pfr_table_count(&io->pfrio_table, io->pfrio_flags);
3995 if (n < 0) {
3996 PF_RULES_RUNLOCK();
3997 error = EINVAL;
3998 break;
3999 }
4000
4001 io->pfrio_size = min(io->pfrio_size, n);
4002 PF_RULES_RUNLOCK();
4003
4004 totlen = io->pfrio_size * sizeof(struct pfr_table);
4005 pfrts = mallocarray(io->pfrio_size, sizeof(struct pfr_table),
4006 M_TEMP, M_WAITOK);
4007 error = copyin(io->pfrio_buffer, pfrts, totlen);
4008 if (error) {
4009 free(pfrts, M_TEMP);
4010 break;
4011 }
4012 PF_RULES_WLOCK();
4013 error = pfr_set_tflags(pfrts, io->pfrio_size,
4014 io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
4015 &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
4016 PF_RULES_WUNLOCK();
4017 free(pfrts, M_TEMP);
4018 break;
4019 }
4020
4021 case DIOCRCLRADDRS: {
4022 struct pfioc_table *io = (struct pfioc_table *)addr;
4023
4024 if (io->pfrio_esize != 0) {
4025 error = ENODEV;
4026 break;
4027 }
4028 PF_RULES_WLOCK();
4029 error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
4030 io->pfrio_flags | PFR_FLAG_USERIOCTL);
4031 PF_RULES_WUNLOCK();
4032 break;
4033 }
4034
4035 case DIOCRADDADDRS: {
4036 struct pfioc_table *io = (struct pfioc_table *)addr;
4037 struct pfr_addr *pfras;
4038 size_t totlen;
4039
4040 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
4041 error = ENODEV;
4042 break;
4043 }
4044 if (io->pfrio_size < 0 ||
4045 io->pfrio_size > pf_ioctl_maxcount ||
4046 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
4047 error = EINVAL;
4048 break;
4049 }
4050 totlen = io->pfrio_size * sizeof(struct pfr_addr);
4051 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
4052 M_TEMP, M_NOWAIT);
4053 if (! pfras) {
4054 error = ENOMEM;
4055 break;
4056 }
4057 error = copyin(io->pfrio_buffer, pfras, totlen);
4058 if (error) {
4059 free(pfras, M_TEMP);
4060 break;
4061 }
4062 PF_RULES_WLOCK();
4063 error = pfr_add_addrs(&io->pfrio_table, pfras,
4064 io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
4065 PFR_FLAG_USERIOCTL);
4066 PF_RULES_WUNLOCK();
4067 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
4068 error = copyout(pfras, io->pfrio_buffer, totlen);
4069 free(pfras, M_TEMP);
4070 break;
4071 }
4072
4073 case DIOCRDELADDRS: {
4074 struct pfioc_table *io = (struct pfioc_table *)addr;
4075 struct pfr_addr *pfras;
4076 size_t totlen;
4077
4078 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
4079 error = ENODEV;
4080 break;
4081 }
4082 if (io->pfrio_size < 0 ||
4083 io->pfrio_size > pf_ioctl_maxcount ||
4084 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
4085 error = EINVAL;
4086 break;
4087 }
4088 totlen = io->pfrio_size * sizeof(struct pfr_addr);
4089 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
4090 M_TEMP, M_NOWAIT);
4091 if (! pfras) {
4092 error = ENOMEM;
4093 break;
4094 }
4095 error = copyin(io->pfrio_buffer, pfras, totlen);
4096 if (error) {
4097 free(pfras, M_TEMP);
4098 break;
4099 }
4100 PF_RULES_WLOCK();
4101 error = pfr_del_addrs(&io->pfrio_table, pfras,
4102 io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
4103 PFR_FLAG_USERIOCTL);
4104 PF_RULES_WUNLOCK();
4105 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
4106 error = copyout(pfras, io->pfrio_buffer, totlen);
4107 free(pfras, M_TEMP);
4108 break;
4109 }
4110
4111 case DIOCRSETADDRS: {
4112 struct pfioc_table *io = (struct pfioc_table *)addr;
4113 struct pfr_addr *pfras;
4114 size_t totlen, count;
4115
4116 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
4117 error = ENODEV;
4118 break;
4119 }
4120 if (io->pfrio_size < 0 || io->pfrio_size2 < 0) {
4121 error = EINVAL;
4122 break;
4123 }
4124 count = max(io->pfrio_size, io->pfrio_size2);
4125 if (count > pf_ioctl_maxcount ||
4126 WOULD_OVERFLOW(count, sizeof(struct pfr_addr))) {
4127 error = EINVAL;
4128 break;
4129 }
4130 totlen = count * sizeof(struct pfr_addr);
4131 pfras = mallocarray(count, sizeof(struct pfr_addr), M_TEMP,
4132 M_NOWAIT);
4133 if (! pfras) {
4134 error = ENOMEM;
4135 break;
4136 }
4137 error = copyin(io->pfrio_buffer, pfras, totlen);
4138 if (error) {
4139 free(pfras, M_TEMP);
4140 break;
4141 }
4142 PF_RULES_WLOCK();
4143 error = pfr_set_addrs(&io->pfrio_table, pfras,
4144 io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
4145 &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
4146 PFR_FLAG_USERIOCTL, 0);
4147 PF_RULES_WUNLOCK();
4148 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
4149 error = copyout(pfras, io->pfrio_buffer, totlen);
4150 free(pfras, M_TEMP);
4151 break;
4152 }
4153
4154 case DIOCRGETADDRS: {
4155 struct pfioc_table *io = (struct pfioc_table *)addr;
4156 struct pfr_addr *pfras;
4157 size_t totlen;
4158
4159 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
4160 error = ENODEV;
4161 break;
4162 }
4163 if (io->pfrio_size < 0 ||
4164 io->pfrio_size > pf_ioctl_maxcount ||
4165 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
4166 error = EINVAL;
4167 break;
4168 }
4169 totlen = io->pfrio_size * sizeof(struct pfr_addr);
4170 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
4171 M_TEMP, M_NOWAIT);
4172 if (! pfras) {
4173 error = ENOMEM;
4174 break;
4175 }
4176 PF_RULES_RLOCK();
4177 error = pfr_get_addrs(&io->pfrio_table, pfras,
4178 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
4179 PF_RULES_RUNLOCK();
4180 if (error == 0)
4181 error = copyout(pfras, io->pfrio_buffer, totlen);
4182 free(pfras, M_TEMP);
4183 break;
4184 }
4185
4186 case DIOCRGETASTATS: {
4187 struct pfioc_table *io = (struct pfioc_table *)addr;
4188 struct pfr_astats *pfrastats;
4189 size_t totlen;
4190
4191 if (io->pfrio_esize != sizeof(struct pfr_astats)) {
4192 error = ENODEV;
4193 break;
4194 }
4195 if (io->pfrio_size < 0 ||
4196 io->pfrio_size > pf_ioctl_maxcount ||
4197 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_astats))) {
4198 error = EINVAL;
4199 break;
4200 }
4201 totlen = io->pfrio_size * sizeof(struct pfr_astats);
4202 pfrastats = mallocarray(io->pfrio_size,
4203 sizeof(struct pfr_astats), M_TEMP, M_NOWAIT);
4204 if (! pfrastats) {
4205 error = ENOMEM;
4206 break;
4207 }
4208 PF_RULES_RLOCK();
4209 error = pfr_get_astats(&io->pfrio_table, pfrastats,
4210 &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
4211 PF_RULES_RUNLOCK();
4212 if (error == 0)
4213 error = copyout(pfrastats, io->pfrio_buffer, totlen);
4214 free(pfrastats, M_TEMP);
4215 break;
4216 }
4217
4218 case DIOCRCLRASTATS: {
4219 struct pfioc_table *io = (struct pfioc_table *)addr;
4220 struct pfr_addr *pfras;
4221 size_t totlen;
4222
4223 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
4224 error = ENODEV;
4225 break;
4226 }
4227 if (io->pfrio_size < 0 ||
4228 io->pfrio_size > pf_ioctl_maxcount ||
4229 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
4230 error = EINVAL;
4231 break;
4232 }
4233 totlen = io->pfrio_size * sizeof(struct pfr_addr);
4234 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
4235 M_TEMP, M_NOWAIT);
4236 if (! pfras) {
4237 error = ENOMEM;
4238 break;
4239 }
4240 error = copyin(io->pfrio_buffer, pfras, totlen);
4241 if (error) {
4242 free(pfras, M_TEMP);
4243 break;
4244 }
4245 PF_RULES_WLOCK();
4246 error = pfr_clr_astats(&io->pfrio_table, pfras,
4247 io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
4248 PFR_FLAG_USERIOCTL);
4249 PF_RULES_WUNLOCK();
4250 if (error == 0 && io->pfrio_flags & PFR_FLAG_FEEDBACK)
4251 error = copyout(pfras, io->pfrio_buffer, totlen);
4252 free(pfras, M_TEMP);
4253 break;
4254 }
4255
4256 case DIOCRTSTADDRS: {
4257 struct pfioc_table *io = (struct pfioc_table *)addr;
4258 struct pfr_addr *pfras;
4259 size_t totlen;
4260
4261 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
4262 error = ENODEV;
4263 break;
4264 }
4265 if (io->pfrio_size < 0 ||
4266 io->pfrio_size > pf_ioctl_maxcount ||
4267 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
4268 error = EINVAL;
4269 break;
4270 }
4271 totlen = io->pfrio_size * sizeof(struct pfr_addr);
4272 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
4273 M_TEMP, M_NOWAIT);
4274 if (! pfras) {
4275 error = ENOMEM;
4276 break;
4277 }
4278 error = copyin(io->pfrio_buffer, pfras, totlen);
4279 if (error) {
4280 free(pfras, M_TEMP);
4281 break;
4282 }
4283 PF_RULES_RLOCK();
4284 error = pfr_tst_addrs(&io->pfrio_table, pfras,
4285 io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
4286 PFR_FLAG_USERIOCTL);
4287 PF_RULES_RUNLOCK();
4288 if (error == 0)
4289 error = copyout(pfras, io->pfrio_buffer, totlen);
4290 free(pfras, M_TEMP);
4291 break;
4292 }
4293
4294 case DIOCRINADEFINE: {
4295 struct pfioc_table *io = (struct pfioc_table *)addr;
4296 struct pfr_addr *pfras;
4297 size_t totlen;
4298
4299 if (io->pfrio_esize != sizeof(struct pfr_addr)) {
4300 error = ENODEV;
4301 break;
4302 }
4303 if (io->pfrio_size < 0 ||
4304 io->pfrio_size > pf_ioctl_maxcount ||
4305 WOULD_OVERFLOW(io->pfrio_size, sizeof(struct pfr_addr))) {
4306 error = EINVAL;
4307 break;
4308 }
4309 totlen = io->pfrio_size * sizeof(struct pfr_addr);
4310 pfras = mallocarray(io->pfrio_size, sizeof(struct pfr_addr),
4311 M_TEMP, M_NOWAIT);
4312 if (! pfras) {
4313 error = ENOMEM;
4314 break;
4315 }
4316 error = copyin(io->pfrio_buffer, pfras, totlen);
4317 if (error) {
4318 free(pfras, M_TEMP);
4319 break;
4320 }
4321 PF_RULES_WLOCK();
4322 error = pfr_ina_define(&io->pfrio_table, pfras,
4323 io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
4324 io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
4325 PF_RULES_WUNLOCK();
4326 free(pfras, M_TEMP);
4327 break;
4328 }
4329
4330 case DIOCOSFPADD: {
4331 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
4332 PF_RULES_WLOCK();
4333 error = pf_osfp_add(io);
4334 PF_RULES_WUNLOCK();
4335 break;
4336 }
4337
4338 case DIOCOSFPGET: {
4339 struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
4340 PF_RULES_RLOCK();
4341 error = pf_osfp_get(io);
4342 PF_RULES_RUNLOCK();
4343 break;
4344 }
4345
4346 case DIOCXBEGIN: {
4347 struct pfioc_trans *io = (struct pfioc_trans *)addr;
4348 struct pfioc_trans_e *ioes, *ioe;
4349 size_t totlen;
4350 int i;
4351
4352 if (io->esize != sizeof(*ioe)) {
4353 error = ENODEV;
4354 break;
4355 }
4356 if (io->size < 0 ||
4357 io->size > pf_ioctl_maxcount ||
4358 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
4359 error = EINVAL;
4360 break;
4361 }
4362 totlen = sizeof(struct pfioc_trans_e) * io->size;
4363 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e),
4364 M_TEMP, M_NOWAIT);
4365 if (! ioes) {
4366 error = ENOMEM;
4367 break;
4368 }
4369 error = copyin(io->array, ioes, totlen);
4370 if (error) {
4371 free(ioes, M_TEMP);
4372 break;
4373 }
4374 PF_RULES_WLOCK();
4375 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
4376 switch (ioe->rs_num) {
4377 #ifdef ALTQ
4378 case PF_RULESET_ALTQ:
4379 if (ioe->anchor[0]) {
4380 PF_RULES_WUNLOCK();
4381 free(ioes, M_TEMP);
4382 error = EINVAL;
4383 goto fail;
4384 }
4385 if ((error = pf_begin_altq(&ioe->ticket))) {
4386 PF_RULES_WUNLOCK();
4387 free(ioes, M_TEMP);
4388 goto fail;
4389 }
4390 break;
4391 #endif /* ALTQ */
4392 case PF_RULESET_TABLE:
4393 {
4394 struct pfr_table table;
4395
4396 bzero(&table, sizeof(table));
4397 strlcpy(table.pfrt_anchor, ioe->anchor,
4398 sizeof(table.pfrt_anchor));
4399 if ((error = pfr_ina_begin(&table,
4400 &ioe->ticket, NULL, 0))) {
4401 PF_RULES_WUNLOCK();
4402 free(ioes, M_TEMP);
4403 goto fail;
4404 }
4405 break;
4406 }
4407 default:
4408 if ((error = pf_begin_rules(&ioe->ticket,
4409 ioe->rs_num, ioe->anchor))) {
4410 PF_RULES_WUNLOCK();
4411 free(ioes, M_TEMP);
4412 goto fail;
4413 }
4414 break;
4415 }
4416 }
4417 PF_RULES_WUNLOCK();
4418 error = copyout(ioes, io->array, totlen);
4419 free(ioes, M_TEMP);
4420 break;
4421 }
4422
4423 case DIOCXROLLBACK: {
4424 struct pfioc_trans *io = (struct pfioc_trans *)addr;
4425 struct pfioc_trans_e *ioe, *ioes;
4426 size_t totlen;
4427 int i;
4428
4429 if (io->esize != sizeof(*ioe)) {
4430 error = ENODEV;
4431 break;
4432 }
4433 if (io->size < 0 ||
4434 io->size > pf_ioctl_maxcount ||
4435 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
4436 error = EINVAL;
4437 break;
4438 }
4439 totlen = sizeof(struct pfioc_trans_e) * io->size;
4440 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e),
4441 M_TEMP, M_NOWAIT);
4442 if (! ioes) {
4443 error = ENOMEM;
4444 break;
4445 }
4446 error = copyin(io->array, ioes, totlen);
4447 if (error) {
4448 free(ioes, M_TEMP);
4449 break;
4450 }
4451 PF_RULES_WLOCK();
4452 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
4453 switch (ioe->rs_num) {
4454 #ifdef ALTQ
4455 case PF_RULESET_ALTQ:
4456 if (ioe->anchor[0]) {
4457 PF_RULES_WUNLOCK();
4458 free(ioes, M_TEMP);
4459 error = EINVAL;
4460 goto fail;
4461 }
4462 if ((error = pf_rollback_altq(ioe->ticket))) {
4463 PF_RULES_WUNLOCK();
4464 free(ioes, M_TEMP);
4465 goto fail; /* really bad */
4466 }
4467 break;
4468 #endif /* ALTQ */
4469 case PF_RULESET_TABLE:
4470 {
4471 struct pfr_table table;
4472
4473 bzero(&table, sizeof(table));
4474 strlcpy(table.pfrt_anchor, ioe->anchor,
4475 sizeof(table.pfrt_anchor));
4476 if ((error = pfr_ina_rollback(&table,
4477 ioe->ticket, NULL, 0))) {
4478 PF_RULES_WUNLOCK();
4479 free(ioes, M_TEMP);
4480 goto fail; /* really bad */
4481 }
4482 break;
4483 }
4484 default:
4485 if ((error = pf_rollback_rules(ioe->ticket,
4486 ioe->rs_num, ioe->anchor))) {
4487 PF_RULES_WUNLOCK();
4488 free(ioes, M_TEMP);
4489 goto fail; /* really bad */
4490 }
4491 break;
4492 }
4493 }
4494 PF_RULES_WUNLOCK();
4495 free(ioes, M_TEMP);
4496 break;
4497 }
4498
4499 case DIOCXCOMMIT: {
4500 struct pfioc_trans *io = (struct pfioc_trans *)addr;
4501 struct pfioc_trans_e *ioe, *ioes;
4502 struct pf_kruleset *rs;
4503 size_t totlen;
4504 int i;
4505
4506 if (io->esize != sizeof(*ioe)) {
4507 error = ENODEV;
4508 break;
4509 }
4510
4511 if (io->size < 0 ||
4512 io->size > pf_ioctl_maxcount ||
4513 WOULD_OVERFLOW(io->size, sizeof(struct pfioc_trans_e))) {
4514 error = EINVAL;
4515 break;
4516 }
4517
4518 totlen = sizeof(struct pfioc_trans_e) * io->size;
4519 ioes = mallocarray(io->size, sizeof(struct pfioc_trans_e),
4520 M_TEMP, M_NOWAIT);
4521 if (ioes == NULL) {
4522 error = ENOMEM;
4523 break;
4524 }
4525 error = copyin(io->array, ioes, totlen);
4526 if (error) {
4527 free(ioes, M_TEMP);
4528 break;
4529 }
4530 PF_RULES_WLOCK();
4531 /* First makes sure everything will succeed. */
4532 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
4533 switch (ioe->rs_num) {
4534 #ifdef ALTQ
4535 case PF_RULESET_ALTQ:
4536 if (ioe->anchor[0]) {
4537 PF_RULES_WUNLOCK();
4538 free(ioes, M_TEMP);
4539 error = EINVAL;
4540 goto fail;
4541 }
4542 if (!V_altqs_inactive_open || ioe->ticket !=
4543 V_ticket_altqs_inactive) {
4544 PF_RULES_WUNLOCK();
4545 free(ioes, M_TEMP);
4546 error = EBUSY;
4547 goto fail;
4548 }
4549 break;
4550 #endif /* ALTQ */
4551 case PF_RULESET_TABLE:
4552 rs = pf_find_kruleset(ioe->anchor);
4553 if (rs == NULL || !rs->topen || ioe->ticket !=
4554 rs->tticket) {
4555 PF_RULES_WUNLOCK();
4556 free(ioes, M_TEMP);
4557 error = EBUSY;
4558 goto fail;
4559 }
4560 break;
4561 default:
4562 if (ioe->rs_num < 0 || ioe->rs_num >=
4563 PF_RULESET_MAX) {
4564 PF_RULES_WUNLOCK();
4565 free(ioes, M_TEMP);
4566 error = EINVAL;
4567 goto fail;
4568 }
4569 rs = pf_find_kruleset(ioe->anchor);
4570 if (rs == NULL ||
4571 !rs->rules[ioe->rs_num].inactive.open ||
4572 rs->rules[ioe->rs_num].inactive.ticket !=
4573 ioe->ticket) {
4574 PF_RULES_WUNLOCK();
4575 free(ioes, M_TEMP);
4576 error = EBUSY;
4577 goto fail;
4578 }
4579 break;
4580 }
4581 }
4582 /* Now do the commit - no errors should happen here. */
4583 for (i = 0, ioe = ioes; i < io->size; i++, ioe++) {
4584 switch (ioe->rs_num) {
4585 #ifdef ALTQ
4586 case PF_RULESET_ALTQ:
4587 if ((error = pf_commit_altq(ioe->ticket))) {
4588 PF_RULES_WUNLOCK();
4589 free(ioes, M_TEMP);
4590 goto fail; /* really bad */
4591 }
4592 break;
4593 #endif /* ALTQ */
4594 case PF_RULESET_TABLE:
4595 {
4596 struct pfr_table table;
4597
4598 bzero(&table, sizeof(table));
4599 strlcpy(table.pfrt_anchor, ioe->anchor,
4600 sizeof(table.pfrt_anchor));
4601 if ((error = pfr_ina_commit(&table,
4602 ioe->ticket, NULL, NULL, 0))) {
4603 PF_RULES_WUNLOCK();
4604 free(ioes, M_TEMP);
4605 goto fail; /* really bad */
4606 }
4607 break;
4608 }
4609 default:
4610 if ((error = pf_commit_rules(ioe->ticket,
4611 ioe->rs_num, ioe->anchor))) {
4612 PF_RULES_WUNLOCK();
4613 free(ioes, M_TEMP);
4614 goto fail; /* really bad */
4615 }
4616 break;
4617 }
4618 }
4619 PF_RULES_WUNLOCK();
4620 free(ioes, M_TEMP);
4621 break;
4622 }
4623
4624 case DIOCGETSRCNODES: {
4625 struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr;
4626 struct pf_srchash *sh;
4627 struct pf_ksrc_node *n;
4628 struct pf_src_node *p, *pstore;
4629 uint32_t i, nr = 0;
4630
4631 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
4632 i++, sh++) {
4633 PF_HASHROW_LOCK(sh);
4634 LIST_FOREACH(n, &sh->nodes, entry)
4635 nr++;
4636 PF_HASHROW_UNLOCK(sh);
4637 }
4638
4639 psn->psn_len = min(psn->psn_len,
4640 sizeof(struct pf_src_node) * nr);
4641
4642 if (psn->psn_len == 0) {
4643 psn->psn_len = sizeof(struct pf_src_node) * nr;
4644 break;
4645 }
4646
4647 nr = 0;
4648
4649 p = pstore = malloc(psn->psn_len, M_TEMP, M_WAITOK | M_ZERO);
4650 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
4651 i++, sh++) {
4652 PF_HASHROW_LOCK(sh);
4653 LIST_FOREACH(n, &sh->nodes, entry) {
4654
4655 if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len)
4656 break;
4657
4658 pf_src_node_copy(n, p);
4659
4660 p++;
4661 nr++;
4662 }
4663 PF_HASHROW_UNLOCK(sh);
4664 }
4665 error = copyout(pstore, psn->psn_src_nodes,
4666 sizeof(struct pf_src_node) * nr);
4667 if (error) {
4668 free(pstore, M_TEMP);
4669 break;
4670 }
4671 psn->psn_len = sizeof(struct pf_src_node) * nr;
4672 free(pstore, M_TEMP);
4673 break;
4674 }
4675
4676 case DIOCCLRSRCNODES: {
4677
4678 pf_clear_srcnodes(NULL);
4679 pf_purge_expired_src_nodes();
4680 break;
4681 }
4682
4683 case DIOCKILLSRCNODES:
4684 pf_kill_srcnodes((struct pfioc_src_node_kill *)addr);
4685 break;
4686
4687 case DIOCKEEPCOUNTERS:
4688 error = pf_keepcounters((struct pfioc_nv *)addr);
4689 break;
4690
4691 case DIOCGETSYNCOOKIES:
4692 error = pf_get_syncookies((struct pfioc_nv *)addr);
4693 break;
4694
4695 case DIOCSETSYNCOOKIES:
4696 error = pf_set_syncookies((struct pfioc_nv *)addr);
4697 break;
4698
4699 case DIOCSETHOSTID: {
4700 u_int32_t *hostid = (u_int32_t *)addr;
4701
4702 PF_RULES_WLOCK();
4703 if (*hostid == 0)
4704 V_pf_status.hostid = arc4random();
4705 else
4706 V_pf_status.hostid = *hostid;
4707 PF_RULES_WUNLOCK();
4708 break;
4709 }
4710
4711 case DIOCOSFPFLUSH:
4712 PF_RULES_WLOCK();
4713 pf_osfp_flush();
4714 PF_RULES_WUNLOCK();
4715 break;
4716
4717 case DIOCIGETIFACES: {
4718 struct pfioc_iface *io = (struct pfioc_iface *)addr;
4719 struct pfi_kif *ifstore;
4720 size_t bufsiz;
4721
4722 if (io->pfiio_esize != sizeof(struct pfi_kif)) {
4723 error = ENODEV;
4724 break;
4725 }
4726
4727 if (io->pfiio_size < 0 ||
4728 io->pfiio_size > pf_ioctl_maxcount ||
4729 WOULD_OVERFLOW(io->pfiio_size, sizeof(struct pfi_kif))) {
4730 error = EINVAL;
4731 break;
4732 }
4733
4734 bufsiz = io->pfiio_size * sizeof(struct pfi_kif);
4735 ifstore = mallocarray(io->pfiio_size, sizeof(struct pfi_kif),
4736 M_TEMP, M_NOWAIT);
4737 if (ifstore == NULL) {
4738 error = ENOMEM;
4739 break;
4740 }
4741
4742 PF_RULES_RLOCK();
4743 pfi_get_ifaces(io->pfiio_name, ifstore, &io->pfiio_size);
4744 PF_RULES_RUNLOCK();
4745 error = copyout(ifstore, io->pfiio_buffer, bufsiz);
4746 free(ifstore, M_TEMP);
4747 break;
4748 }
4749
4750 case DIOCSETIFFLAG: {
4751 struct pfioc_iface *io = (struct pfioc_iface *)addr;
4752
4753 PF_RULES_WLOCK();
4754 error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
4755 PF_RULES_WUNLOCK();
4756 break;
4757 }
4758
4759 case DIOCCLRIFFLAG: {
4760 struct pfioc_iface *io = (struct pfioc_iface *)addr;
4761
4762 PF_RULES_WLOCK();
4763 error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
4764 PF_RULES_WUNLOCK();
4765 break;
4766 }
4767
4768 default:
4769 error = ENODEV;
4770 break;
4771 }
4772 fail:
4773 if (sx_xlocked(&pf_ioctl_lock))
4774 sx_xunlock(&pf_ioctl_lock);
4775 CURVNET_RESTORE();
4776
4777 #undef ERROUT_IOCTL
4778
4779 return (error);
4780 }
4781
4782 void
pfsync_state_export(struct pfsync_state * sp,struct pf_kstate * st)4783 pfsync_state_export(struct pfsync_state *sp, struct pf_kstate *st)
4784 {
4785 bzero(sp, sizeof(struct pfsync_state));
4786
4787 /* copy from state key */
4788 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0];
4789 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1];
4790 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0];
4791 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1];
4792 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0];
4793 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1];
4794 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0];
4795 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1];
4796 sp->proto = st->key[PF_SK_WIRE]->proto;
4797 sp->af = st->key[PF_SK_WIRE]->af;
4798
4799 /* copy from state */
4800 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
4801 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
4802 sp->creation = htonl(time_uptime - st->creation);
4803 sp->expire = pf_state_expires(st);
4804 if (sp->expire <= time_uptime)
4805 sp->expire = htonl(0);
4806 else
4807 sp->expire = htonl(sp->expire - time_uptime);
4808
4809 sp->direction = st->direction;
4810 sp->log = st->log;
4811 sp->timeout = st->timeout;
4812 sp->state_flags = st->state_flags;
4813 if (st->src_node)
4814 sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
4815 if (st->nat_src_node)
4816 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
4817
4818 sp->id = st->id;
4819 sp->creatorid = st->creatorid;
4820 pf_state_peer_hton(&st->src, &sp->src);
4821 pf_state_peer_hton(&st->dst, &sp->dst);
4822
4823 if (st->rule.ptr == NULL)
4824 sp->rule = htonl(-1);
4825 else
4826 sp->rule = htonl(st->rule.ptr->nr);
4827 if (st->anchor.ptr == NULL)
4828 sp->anchor = htonl(-1);
4829 else
4830 sp->anchor = htonl(st->anchor.ptr->nr);
4831 if (st->nat_rule.ptr == NULL)
4832 sp->nat_rule = htonl(-1);
4833 else
4834 sp->nat_rule = htonl(st->nat_rule.ptr->nr);
4835
4836 pf_state_counter_hton(st->packets[0], sp->packets[0]);
4837 pf_state_counter_hton(st->packets[1], sp->packets[1]);
4838 pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
4839 pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
4840 }
4841
4842 void
pf_state_export(struct pf_state_export * sp,struct pf_kstate * st)4843 pf_state_export(struct pf_state_export *sp, struct pf_kstate *st)
4844 {
4845 bzero(sp, sizeof(*sp));
4846
4847 sp->version = PF_STATE_VERSION;
4848
4849 /* copy from state key */
4850 sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0];
4851 sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1];
4852 sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0];
4853 sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1];
4854 sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0];
4855 sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1];
4856 sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0];
4857 sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1];
4858 sp->proto = st->key[PF_SK_WIRE]->proto;
4859 sp->af = st->key[PF_SK_WIRE]->af;
4860
4861 /* copy from state */
4862 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
4863 strlcpy(sp->orig_ifname, st->orig_kif->pfik_name,
4864 sizeof(sp->orig_ifname));
4865 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
4866 sp->creation = htonl(time_uptime - st->creation);
4867 sp->expire = pf_state_expires(st);
4868 if (sp->expire <= time_uptime)
4869 sp->expire = htonl(0);
4870 else
4871 sp->expire = htonl(sp->expire - time_uptime);
4872
4873 sp->direction = st->direction;
4874 sp->log = st->log;
4875 sp->timeout = st->timeout;
4876 sp->state_flags = st->state_flags;
4877 if (st->src_node)
4878 sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
4879 if (st->nat_src_node)
4880 sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
4881
4882 sp->id = st->id;
4883 sp->creatorid = st->creatorid;
4884 pf_state_peer_hton(&st->src, &sp->src);
4885 pf_state_peer_hton(&st->dst, &sp->dst);
4886
4887 if (st->rule.ptr == NULL)
4888 sp->rule = htonl(-1);
4889 else
4890 sp->rule = htonl(st->rule.ptr->nr);
4891 if (st->anchor.ptr == NULL)
4892 sp->anchor = htonl(-1);
4893 else
4894 sp->anchor = htonl(st->anchor.ptr->nr);
4895 if (st->nat_rule.ptr == NULL)
4896 sp->nat_rule = htonl(-1);
4897 else
4898 sp->nat_rule = htonl(st->nat_rule.ptr->nr);
4899
4900 sp->packets[0] = st->packets[0];
4901 sp->packets[1] = st->packets[1];
4902 sp->bytes[0] = st->bytes[0];
4903 sp->bytes[1] = st->bytes[1];
4904 }
4905
4906 static void
pf_tbladdr_copyout(struct pf_addr_wrap * aw)4907 pf_tbladdr_copyout(struct pf_addr_wrap *aw)
4908 {
4909 struct pfr_ktable *kt;
4910
4911 KASSERT(aw->type == PF_ADDR_TABLE, ("%s: type %u", __func__, aw->type));
4912
4913 kt = aw->p.tbl;
4914 if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
4915 kt = kt->pfrkt_root;
4916 aw->p.tbl = NULL;
4917 aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
4918 kt->pfrkt_cnt : -1;
4919 }
4920
4921 static int
pf_add_status_counters(nvlist_t * nvl,const char * name,counter_u64_t * counters,size_t number,char ** names)4922 pf_add_status_counters(nvlist_t *nvl, const char *name, counter_u64_t *counters,
4923 size_t number, char **names)
4924 {
4925 nvlist_t *nvc;
4926
4927 nvc = nvlist_create(0);
4928 if (nvc == NULL)
4929 return (ENOMEM);
4930
4931 for (int i = 0; i < number; i++) {
4932 nvlist_append_number_array(nvc, "counters",
4933 counter_u64_fetch(counters[i]));
4934 nvlist_append_string_array(nvc, "names",
4935 names[i]);
4936 nvlist_append_number_array(nvc, "ids",
4937 i);
4938 }
4939 nvlist_add_nvlist(nvl, name, nvc);
4940 nvlist_destroy(nvc);
4941
4942 return (0);
4943 }
4944
4945 static int
pf_getstatus(struct pfioc_nv * nv)4946 pf_getstatus(struct pfioc_nv *nv)
4947 {
4948 nvlist_t *nvl = NULL, *nvc = NULL;
4949 void *nvlpacked = NULL;
4950 int error;
4951 struct pf_status s;
4952 char *pf_reasons[PFRES_MAX+1] = PFRES_NAMES;
4953 char *pf_lcounter[KLCNT_MAX+1] = KLCNT_NAMES;
4954 char *pf_fcounter[FCNT_MAX+1] = FCNT_NAMES;
4955 PF_RULES_RLOCK_TRACKER;
4956
4957 #define ERROUT(x) ERROUT_FUNCTION(errout, x)
4958
4959 PF_RULES_RLOCK();
4960
4961 nvl = nvlist_create(0);
4962 if (nvl == NULL)
4963 ERROUT(ENOMEM);
4964
4965 nvlist_add_bool(nvl, "running", V_pf_status.running);
4966 nvlist_add_number(nvl, "since", V_pf_status.since);
4967 nvlist_add_number(nvl, "debug", V_pf_status.debug);
4968 nvlist_add_number(nvl, "hostid", V_pf_status.hostid);
4969 nvlist_add_number(nvl, "states", V_pf_status.states);
4970 nvlist_add_number(nvl, "src_nodes", V_pf_status.src_nodes);
4971
4972 /* counters */
4973 error = pf_add_status_counters(nvl, "counters", V_pf_status.counters,
4974 PFRES_MAX, pf_reasons);
4975 if (error != 0)
4976 ERROUT(error);
4977
4978 /* lcounters */
4979 error = pf_add_status_counters(nvl, "lcounters", V_pf_status.lcounters,
4980 KLCNT_MAX, pf_lcounter);
4981 if (error != 0)
4982 ERROUT(error);
4983
4984 /* fcounters */
4985 nvc = nvlist_create(0);
4986 if (nvc == NULL)
4987 ERROUT(ENOMEM);
4988
4989 for (int i = 0; i < FCNT_MAX; i++) {
4990 nvlist_append_number_array(nvc, "counters",
4991 pf_counter_u64_fetch(&V_pf_status.fcounters[i]));
4992 nvlist_append_string_array(nvc, "names",
4993 pf_fcounter[i]);
4994 nvlist_append_number_array(nvc, "ids",
4995 i);
4996 }
4997 nvlist_add_nvlist(nvl, "fcounters", nvc);
4998 nvlist_destroy(nvc);
4999 nvc = NULL;
5000
5001 /* scounters */
5002 error = pf_add_status_counters(nvl, "scounters", V_pf_status.scounters,
5003 SCNT_MAX, pf_fcounter);
5004 if (error != 0)
5005 ERROUT(error);
5006
5007 nvlist_add_string(nvl, "ifname", V_pf_status.ifname);
5008 nvlist_add_binary(nvl, "chksum", V_pf_status.pf_chksum,
5009 PF_MD5_DIGEST_LENGTH);
5010
5011 pfi_update_status(V_pf_status.ifname, &s);
5012
5013 /* pcounters / bcounters */
5014 for (int i = 0; i < 2; i++) {
5015 for (int j = 0; j < 2; j++) {
5016 for (int k = 0; k < 2; k++) {
5017 nvlist_append_number_array(nvl, "pcounters",
5018 s.pcounters[i][j][k]);
5019 }
5020 nvlist_append_number_array(nvl, "bcounters",
5021 s.bcounters[i][j]);
5022 }
5023 }
5024
5025 nvlpacked = nvlist_pack(nvl, &nv->len);
5026 if (nvlpacked == NULL)
5027 ERROUT(ENOMEM);
5028
5029 if (nv->size == 0)
5030 ERROUT(0);
5031 else if (nv->size < nv->len)
5032 ERROUT(ENOSPC);
5033
5034 PF_RULES_RUNLOCK();
5035 error = copyout(nvlpacked, nv->data, nv->len);
5036 goto done;
5037
5038 #undef ERROUT
5039 errout:
5040 PF_RULES_RUNLOCK();
5041 done:
5042 free(nvlpacked, M_NVLIST);
5043 nvlist_destroy(nvc);
5044 nvlist_destroy(nvl);
5045
5046 return (error);
5047 }
5048
5049 /*
5050 * XXX - Check for version mismatch!!!
5051 */
5052 static void
pf_clear_all_states(void)5053 pf_clear_all_states(void)
5054 {
5055 struct pf_kstate *s;
5056 u_int i;
5057
5058 for (i = 0; i <= pf_hashmask; i++) {
5059 struct pf_idhash *ih = &V_pf_idhash[i];
5060 relock:
5061 PF_HASHROW_LOCK(ih);
5062 LIST_FOREACH(s, &ih->states, entry) {
5063 s->timeout = PFTM_PURGE;
5064 /* Don't send out individual delete messages. */
5065 s->state_flags |= PFSTATE_NOSYNC;
5066 pf_unlink_state(s, PF_ENTER_LOCKED);
5067 goto relock;
5068 }
5069 PF_HASHROW_UNLOCK(ih);
5070 }
5071 }
5072
5073 static int
pf_clear_tables(void)5074 pf_clear_tables(void)
5075 {
5076 struct pfioc_table io;
5077 int error;
5078
5079 bzero(&io, sizeof(io));
5080
5081 error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel,
5082 io.pfrio_flags);
5083
5084 return (error);
5085 }
5086
5087 static void
pf_clear_srcnodes(struct pf_ksrc_node * n)5088 pf_clear_srcnodes(struct pf_ksrc_node *n)
5089 {
5090 struct pf_kstate *s;
5091 int i;
5092
5093 for (i = 0; i <= pf_hashmask; i++) {
5094 struct pf_idhash *ih = &V_pf_idhash[i];
5095
5096 PF_HASHROW_LOCK(ih);
5097 LIST_FOREACH(s, &ih->states, entry) {
5098 if (n == NULL || n == s->src_node)
5099 s->src_node = NULL;
5100 if (n == NULL || n == s->nat_src_node)
5101 s->nat_src_node = NULL;
5102 }
5103 PF_HASHROW_UNLOCK(ih);
5104 }
5105
5106 if (n == NULL) {
5107 struct pf_srchash *sh;
5108
5109 for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask;
5110 i++, sh++) {
5111 PF_HASHROW_LOCK(sh);
5112 LIST_FOREACH(n, &sh->nodes, entry) {
5113 n->expire = 1;
5114 n->states = 0;
5115 }
5116 PF_HASHROW_UNLOCK(sh);
5117 }
5118 } else {
5119 /* XXX: hash slot should already be locked here. */
5120 n->expire = 1;
5121 n->states = 0;
5122 }
5123 }
5124
5125 static void
pf_kill_srcnodes(struct pfioc_src_node_kill * psnk)5126 pf_kill_srcnodes(struct pfioc_src_node_kill *psnk)
5127 {
5128 struct pf_ksrc_node_list kill;
5129
5130 LIST_INIT(&kill);
5131 for (int i = 0; i <= pf_srchashmask; i++) {
5132 struct pf_srchash *sh = &V_pf_srchash[i];
5133 struct pf_ksrc_node *sn, *tmp;
5134
5135 PF_HASHROW_LOCK(sh);
5136 LIST_FOREACH_SAFE(sn, &sh->nodes, entry, tmp)
5137 if (PF_MATCHA(psnk->psnk_src.neg,
5138 &psnk->psnk_src.addr.v.a.addr,
5139 &psnk->psnk_src.addr.v.a.mask,
5140 &sn->addr, sn->af) &&
5141 PF_MATCHA(psnk->psnk_dst.neg,
5142 &psnk->psnk_dst.addr.v.a.addr,
5143 &psnk->psnk_dst.addr.v.a.mask,
5144 &sn->raddr, sn->af)) {
5145 pf_unlink_src_node(sn);
5146 LIST_INSERT_HEAD(&kill, sn, entry);
5147 sn->expire = 1;
5148 }
5149 PF_HASHROW_UNLOCK(sh);
5150 }
5151
5152 for (int i = 0; i <= pf_hashmask; i++) {
5153 struct pf_idhash *ih = &V_pf_idhash[i];
5154 struct pf_kstate *s;
5155
5156 PF_HASHROW_LOCK(ih);
5157 LIST_FOREACH(s, &ih->states, entry) {
5158 if (s->src_node && s->src_node->expire == 1)
5159 s->src_node = NULL;
5160 if (s->nat_src_node && s->nat_src_node->expire == 1)
5161 s->nat_src_node = NULL;
5162 }
5163 PF_HASHROW_UNLOCK(ih);
5164 }
5165
5166 psnk->psnk_killed = pf_free_src_nodes(&kill);
5167 }
5168
5169 static int
pf_keepcounters(struct pfioc_nv * nv)5170 pf_keepcounters(struct pfioc_nv *nv)
5171 {
5172 nvlist_t *nvl = NULL;
5173 void *nvlpacked = NULL;
5174 int error = 0;
5175
5176 #define ERROUT(x) ERROUT_FUNCTION(on_error, x)
5177
5178 if (nv->len > pf_ioctl_maxcount)
5179 ERROUT(ENOMEM);
5180
5181 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK);
5182 if (nvlpacked == NULL)
5183 ERROUT(ENOMEM);
5184
5185 error = copyin(nv->data, nvlpacked, nv->len);
5186 if (error)
5187 ERROUT(error);
5188
5189 nvl = nvlist_unpack(nvlpacked, nv->len, 0);
5190 if (nvl == NULL)
5191 ERROUT(EBADMSG);
5192
5193 if (! nvlist_exists_bool(nvl, "keep_counters"))
5194 ERROUT(EBADMSG);
5195
5196 V_pf_status.keep_counters = nvlist_get_bool(nvl, "keep_counters");
5197
5198 on_error:
5199 nvlist_destroy(nvl);
5200 free(nvlpacked, M_NVLIST);
5201 return (error);
5202 }
5203
5204 static unsigned int
pf_clear_states(const struct pf_kstate_kill * kill)5205 pf_clear_states(const struct pf_kstate_kill *kill)
5206 {
5207 struct pf_state_key_cmp match_key;
5208 struct pf_kstate *s;
5209 struct pfi_kkif *kif;
5210 int idx;
5211 unsigned int killed = 0, dir;
5212
5213 for (unsigned int i = 0; i <= pf_hashmask; i++) {
5214 struct pf_idhash *ih = &V_pf_idhash[i];
5215
5216 relock_DIOCCLRSTATES:
5217 PF_HASHROW_LOCK(ih);
5218 LIST_FOREACH(s, &ih->states, entry) {
5219 /* For floating states look at the original kif. */
5220 kif = s->kif == V_pfi_all ? s->orig_kif : s->kif;
5221
5222 if (kill->psk_ifname[0] &&
5223 strcmp(kill->psk_ifname,
5224 kif->pfik_name))
5225 continue;
5226
5227 if (kill->psk_kill_match) {
5228 bzero(&match_key, sizeof(match_key));
5229
5230 if (s->direction == PF_OUT) {
5231 dir = PF_IN;
5232 idx = PF_SK_STACK;
5233 } else {
5234 dir = PF_OUT;
5235 idx = PF_SK_WIRE;
5236 }
5237
5238 match_key.af = s->key[idx]->af;
5239 match_key.proto = s->key[idx]->proto;
5240 PF_ACPY(&match_key.addr[0],
5241 &s->key[idx]->addr[1], match_key.af);
5242 match_key.port[0] = s->key[idx]->port[1];
5243 PF_ACPY(&match_key.addr[1],
5244 &s->key[idx]->addr[0], match_key.af);
5245 match_key.port[1] = s->key[idx]->port[0];
5246 }
5247
5248 /*
5249 * Don't send out individual
5250 * delete messages.
5251 */
5252 s->state_flags |= PFSTATE_NOSYNC;
5253 pf_unlink_state(s, PF_ENTER_LOCKED);
5254 killed++;
5255
5256 if (kill->psk_kill_match)
5257 killed += pf_kill_matching_state(&match_key,
5258 dir);
5259
5260 goto relock_DIOCCLRSTATES;
5261 }
5262 PF_HASHROW_UNLOCK(ih);
5263 }
5264
5265 if (V_pfsync_clear_states_ptr != NULL)
5266 V_pfsync_clear_states_ptr(V_pf_status.hostid, kill->psk_ifname);
5267
5268 return (killed);
5269 }
5270
5271 static void
pf_killstates(struct pf_kstate_kill * kill,unsigned int * killed)5272 pf_killstates(struct pf_kstate_kill *kill, unsigned int *killed)
5273 {
5274 struct pf_kstate *s;
5275
5276 if (kill->psk_pfcmp.id) {
5277 if (kill->psk_pfcmp.creatorid == 0)
5278 kill->psk_pfcmp.creatorid = V_pf_status.hostid;
5279 if ((s = pf_find_state_byid(kill->psk_pfcmp.id,
5280 kill->psk_pfcmp.creatorid))) {
5281 pf_unlink_state(s, PF_ENTER_LOCKED);
5282 *killed = 1;
5283 }
5284 return;
5285 }
5286
5287 for (unsigned int i = 0; i <= pf_hashmask; i++)
5288 *killed += pf_killstates_row(kill, &V_pf_idhash[i]);
5289
5290 return;
5291 }
5292
5293 static int
pf_killstates_nv(struct pfioc_nv * nv)5294 pf_killstates_nv(struct pfioc_nv *nv)
5295 {
5296 struct pf_kstate_kill kill;
5297 nvlist_t *nvl = NULL;
5298 void *nvlpacked = NULL;
5299 int error = 0;
5300 unsigned int killed = 0;
5301
5302 #define ERROUT(x) ERROUT_FUNCTION(on_error, x)
5303
5304 if (nv->len > pf_ioctl_maxcount)
5305 ERROUT(ENOMEM);
5306
5307 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK);
5308 if (nvlpacked == NULL)
5309 ERROUT(ENOMEM);
5310
5311 error = copyin(nv->data, nvlpacked, nv->len);
5312 if (error)
5313 ERROUT(error);
5314
5315 nvl = nvlist_unpack(nvlpacked, nv->len, 0);
5316 if (nvl == NULL)
5317 ERROUT(EBADMSG);
5318
5319 error = pf_nvstate_kill_to_kstate_kill(nvl, &kill);
5320 if (error)
5321 ERROUT(error);
5322
5323 pf_killstates(&kill, &killed);
5324
5325 free(nvlpacked, M_NVLIST);
5326 nvlpacked = NULL;
5327 nvlist_destroy(nvl);
5328 nvl = nvlist_create(0);
5329 if (nvl == NULL)
5330 ERROUT(ENOMEM);
5331
5332 nvlist_add_number(nvl, "killed", killed);
5333
5334 nvlpacked = nvlist_pack(nvl, &nv->len);
5335 if (nvlpacked == NULL)
5336 ERROUT(ENOMEM);
5337
5338 if (nv->size == 0)
5339 ERROUT(0);
5340 else if (nv->size < nv->len)
5341 ERROUT(ENOSPC);
5342
5343 error = copyout(nvlpacked, nv->data, nv->len);
5344
5345 on_error:
5346 nvlist_destroy(nvl);
5347 free(nvlpacked, M_NVLIST);
5348 return (error);
5349 }
5350
5351 static int
pf_clearstates_nv(struct pfioc_nv * nv)5352 pf_clearstates_nv(struct pfioc_nv *nv)
5353 {
5354 struct pf_kstate_kill kill;
5355 nvlist_t *nvl = NULL;
5356 void *nvlpacked = NULL;
5357 int error = 0;
5358 unsigned int killed;
5359
5360 #define ERROUT(x) ERROUT_FUNCTION(on_error, x)
5361
5362 if (nv->len > pf_ioctl_maxcount)
5363 ERROUT(ENOMEM);
5364
5365 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK);
5366 if (nvlpacked == NULL)
5367 ERROUT(ENOMEM);
5368
5369 error = copyin(nv->data, nvlpacked, nv->len);
5370 if (error)
5371 ERROUT(error);
5372
5373 nvl = nvlist_unpack(nvlpacked, nv->len, 0);
5374 if (nvl == NULL)
5375 ERROUT(EBADMSG);
5376
5377 error = pf_nvstate_kill_to_kstate_kill(nvl, &kill);
5378 if (error)
5379 ERROUT(error);
5380
5381 killed = pf_clear_states(&kill);
5382
5383 free(nvlpacked, M_NVLIST);
5384 nvlpacked = NULL;
5385 nvlist_destroy(nvl);
5386 nvl = nvlist_create(0);
5387 if (nvl == NULL)
5388 ERROUT(ENOMEM);
5389
5390 nvlist_add_number(nvl, "killed", killed);
5391
5392 nvlpacked = nvlist_pack(nvl, &nv->len);
5393 if (nvlpacked == NULL)
5394 ERROUT(ENOMEM);
5395
5396 if (nv->size == 0)
5397 ERROUT(0);
5398 else if (nv->size < nv->len)
5399 ERROUT(ENOSPC);
5400
5401 error = copyout(nvlpacked, nv->data, nv->len);
5402
5403 #undef ERROUT
5404 on_error:
5405 nvlist_destroy(nvl);
5406 free(nvlpacked, M_NVLIST);
5407 return (error);
5408 }
5409
5410 static int
pf_getstate(struct pfioc_nv * nv)5411 pf_getstate(struct pfioc_nv *nv)
5412 {
5413 nvlist_t *nvl = NULL, *nvls;
5414 void *nvlpacked = NULL;
5415 struct pf_kstate *s = NULL;
5416 int error = 0;
5417 uint64_t id, creatorid;
5418
5419 #define ERROUT(x) ERROUT_FUNCTION(errout, x)
5420
5421 if (nv->len > pf_ioctl_maxcount)
5422 ERROUT(ENOMEM);
5423
5424 nvlpacked = malloc(nv->len, M_NVLIST, M_WAITOK);
5425 if (nvlpacked == NULL)
5426 ERROUT(ENOMEM);
5427
5428 error = copyin(nv->data, nvlpacked, nv->len);
5429 if (error)
5430 ERROUT(error);
5431
5432 nvl = nvlist_unpack(nvlpacked, nv->len, 0);
5433 if (nvl == NULL)
5434 ERROUT(EBADMSG);
5435
5436 PFNV_CHK(pf_nvuint64(nvl, "id", &id));
5437 PFNV_CHK(pf_nvuint64(nvl, "creatorid", &creatorid));
5438
5439 s = pf_find_state_byid(id, creatorid);
5440 if (s == NULL)
5441 ERROUT(ENOENT);
5442
5443 free(nvlpacked, M_NVLIST);
5444 nvlpacked = NULL;
5445 nvlist_destroy(nvl);
5446 nvl = nvlist_create(0);
5447 if (nvl == NULL)
5448 ERROUT(ENOMEM);
5449
5450 nvls = pf_state_to_nvstate(s);
5451 if (nvls == NULL)
5452 ERROUT(ENOMEM);
5453
5454 nvlist_add_nvlist(nvl, "state", nvls);
5455 nvlist_destroy(nvls);
5456
5457 nvlpacked = nvlist_pack(nvl, &nv->len);
5458 if (nvlpacked == NULL)
5459 ERROUT(ENOMEM);
5460
5461 if (nv->size == 0)
5462 ERROUT(0);
5463 else if (nv->size < nv->len)
5464 ERROUT(ENOSPC);
5465
5466 error = copyout(nvlpacked, nv->data, nv->len);
5467
5468 #undef ERROUT
5469 errout:
5470 if (s != NULL)
5471 PF_STATE_UNLOCK(s);
5472 free(nvlpacked, M_NVLIST);
5473 nvlist_destroy(nvl);
5474 return (error);
5475 }
5476
5477 /*
5478 * XXX - Check for version mismatch!!!
5479 */
5480
5481 /*
5482 * Duplicate pfctl -Fa operation to get rid of as much as we can.
5483 */
5484 static int
shutdown_pf(void)5485 shutdown_pf(void)
5486 {
5487 int error = 0;
5488 u_int32_t t[5];
5489 char nn = '\0';
5490
5491 do {
5492 if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn))
5493 != 0) {
5494 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n"));
5495 break;
5496 }
5497 if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn))
5498 != 0) {
5499 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n"));
5500 break; /* XXX: rollback? */
5501 }
5502 if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn))
5503 != 0) {
5504 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n"));
5505 break; /* XXX: rollback? */
5506 }
5507 if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn))
5508 != 0) {
5509 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n"));
5510 break; /* XXX: rollback? */
5511 }
5512 if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn))
5513 != 0) {
5514 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n"));
5515 break; /* XXX: rollback? */
5516 }
5517
5518 /* XXX: these should always succeed here */
5519 pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn);
5520 pf_commit_rules(t[1], PF_RULESET_FILTER, &nn);
5521 pf_commit_rules(t[2], PF_RULESET_NAT, &nn);
5522 pf_commit_rules(t[3], PF_RULESET_BINAT, &nn);
5523 pf_commit_rules(t[4], PF_RULESET_RDR, &nn);
5524
5525 if ((error = pf_clear_tables()) != 0)
5526 break;
5527
5528 #ifdef ALTQ
5529 if ((error = pf_begin_altq(&t[0])) != 0) {
5530 DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n"));
5531 break;
5532 }
5533 pf_commit_altq(t[0]);
5534 #endif
5535
5536 pf_clear_all_states();
5537
5538 pf_clear_srcnodes(NULL);
5539
5540 /* status does not use malloced mem so no need to cleanup */
5541 /* fingerprints and interfaces have their own cleanup code */
5542 } while(0);
5543
5544 return (error);
5545 }
5546
5547 #ifdef INET
5548 static int
pf_check_in(void * arg,struct mbuf ** m,struct ifnet * ifp,int dir,int flags,struct inpcb * inp)5549 pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags,
5550 struct inpcb *inp)
5551 {
5552 int chk;
5553
5554 chk = pf_test(PF_IN, flags, ifp, m, inp);
5555 if (chk && *m) {
5556 m_freem(*m);
5557 *m = NULL;
5558 }
5559
5560 if (chk != PF_PASS)
5561 return (EACCES);
5562 return (0);
5563 }
5564
5565 static int
pf_check_out(void * arg,struct mbuf ** m,struct ifnet * ifp,int dir,int flags,struct inpcb * inp)5566 pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags,
5567 struct inpcb *inp)
5568 {
5569 int chk;
5570
5571 chk = pf_test(PF_OUT, flags, ifp, m, inp);
5572 if (chk && *m) {
5573 m_freem(*m);
5574 *m = NULL;
5575 }
5576
5577 if (chk != PF_PASS)
5578 return (EACCES);
5579 return (0);
5580 }
5581 #endif
5582
5583 #ifdef INET6
5584 static int
pf_check6_in(void * arg,struct mbuf ** m,struct ifnet * ifp,int dir,int flags,struct inpcb * inp)5585 pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags,
5586 struct inpcb *inp)
5587 {
5588 int chk;
5589
5590 /*
5591 * In case of loopback traffic IPv6 uses the real interface in
5592 * order to support scoped addresses. In order to support stateful
5593 * filtering we have change this to lo0 as it is the case in IPv4.
5594 */
5595 CURVNET_SET(ifp->if_vnet);
5596 chk = pf_test6(PF_IN, flags, (*m)->m_flags & M_LOOP ? V_loif : ifp, m, inp);
5597 CURVNET_RESTORE();
5598 if (chk && *m) {
5599 m_freem(*m);
5600 *m = NULL;
5601 }
5602 if (chk != PF_PASS)
5603 return (EACCES);
5604 return (0);
5605 }
5606
5607 static int
pf_check6_out(void * arg,struct mbuf ** m,struct ifnet * ifp,int dir,int flags,struct inpcb * inp)5608 pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir, int flags,
5609 struct inpcb *inp)
5610 {
5611 int chk;
5612
5613 CURVNET_SET(ifp->if_vnet);
5614 chk = pf_test6(PF_OUT, flags, ifp, m, inp);
5615 CURVNET_RESTORE();
5616 if (chk && *m) {
5617 m_freem(*m);
5618 *m = NULL;
5619 }
5620 if (chk != PF_PASS)
5621 return (EACCES);
5622 return (0);
5623 }
5624 #endif /* INET6 */
5625
5626 static int
hook_pf(void)5627 hook_pf(void)
5628 {
5629 #ifdef INET
5630 struct pfil_head *pfh_inet;
5631 #endif
5632 #ifdef INET6
5633 struct pfil_head *pfh_inet6;
5634 #endif
5635
5636 if (V_pf_pfil_hooked)
5637 return (0);
5638
5639 #ifdef INET
5640 pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
5641 if (pfh_inet == NULL)
5642 return (ESRCH); /* XXX */
5643 pfil_add_hook_flags(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet);
5644 pfil_add_hook_flags(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet);
5645 #endif
5646 #ifdef INET6
5647 pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
5648 if (pfh_inet6 == NULL) {
5649 #ifdef INET
5650 pfil_remove_hook_flags(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK,
5651 pfh_inet);
5652 pfil_remove_hook_flags(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK,
5653 pfh_inet);
5654 #endif
5655 return (ESRCH); /* XXX */
5656 }
5657 pfil_add_hook_flags(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet6);
5658 pfil_add_hook_flags(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet6);
5659 #endif
5660
5661 V_pf_pfil_hooked = 1;
5662 return (0);
5663 }
5664
5665 static int
dehook_pf(void)5666 dehook_pf(void)
5667 {
5668 #ifdef INET
5669 struct pfil_head *pfh_inet;
5670 #endif
5671 #ifdef INET6
5672 struct pfil_head *pfh_inet6;
5673 #endif
5674
5675 if (V_pf_pfil_hooked == 0)
5676 return (0);
5677
5678 #ifdef INET
5679 pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
5680 if (pfh_inet == NULL)
5681 return (ESRCH); /* XXX */
5682 pfil_remove_hook_flags(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK,
5683 pfh_inet);
5684 pfil_remove_hook_flags(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK,
5685 pfh_inet);
5686 #endif
5687 #ifdef INET6
5688 pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
5689 if (pfh_inet6 == NULL)
5690 return (ESRCH); /* XXX */
5691 pfil_remove_hook_flags(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK,
5692 pfh_inet6);
5693 pfil_remove_hook_flags(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK,
5694 pfh_inet6);
5695 #endif
5696
5697 V_pf_pfil_hooked = 0;
5698 return (0);
5699 }
5700
5701 static void
pf_load_vnet(void)5702 pf_load_vnet(void)
5703 {
5704 V_pf_tag_z = uma_zcreate("pf tags", sizeof(struct pf_tagname),
5705 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
5706
5707 pf_init_tagset(&V_pf_tags, &pf_rule_tag_hashsize,
5708 PF_RULE_TAG_HASH_SIZE_DEFAULT);
5709 #ifdef ALTQ
5710 pf_init_tagset(&V_pf_qids, &pf_queue_tag_hashsize,
5711 PF_QUEUE_TAG_HASH_SIZE_DEFAULT);
5712 #endif
5713
5714 pfattach_vnet();
5715 V_pf_vnet_active = 1;
5716 }
5717
5718 static int
pf_load(void)5719 pf_load(void)
5720 {
5721 int error;
5722
5723 rm_init_flags(&pf_rules_lock, "pf rulesets", RM_RECURSE);
5724 sx_init(&pf_ioctl_lock, "pf ioctl");
5725 sx_init(&pf_end_lock, "pf end thread");
5726
5727 pf_mtag_initialize();
5728
5729 pf_dev = make_dev(&pf_cdevsw, 0, 0, 0, 0600, PF_NAME);
5730 if (pf_dev == NULL)
5731 return (ENOMEM);
5732
5733 pf_end_threads = 0;
5734 error = kproc_create(pf_purge_thread, NULL, &pf_purge_proc, 0, 0, "pf purge");
5735 if (error != 0)
5736 return (error);
5737
5738 pfi_initialize();
5739
5740 return (0);
5741 }
5742
5743 static void
pf_unload_vnet(void)5744 pf_unload_vnet(void)
5745 {
5746 int error, ret;
5747
5748 V_pf_vnet_active = 0;
5749 V_pf_status.running = 0;
5750 error = dehook_pf();
5751 if (error) {
5752 /*
5753 * Should not happen!
5754 * XXX Due to error code ESRCH, kldunload will show
5755 * a message like 'No such process'.
5756 */
5757 printf("%s : pfil unregisteration fail\n", __FUNCTION__);
5758 return;
5759 }
5760
5761 PF_RULES_WLOCK();
5762 pf_syncookies_cleanup();
5763 shutdown_pf();
5764 PF_RULES_WUNLOCK();
5765
5766 ret = swi_remove(V_pf_swi_cookie);
5767 MPASS(ret == 0);
5768 ret = intr_event_destroy(V_pf_swi_ie);
5769 MPASS(ret == 0);
5770
5771 pf_unload_vnet_purge();
5772
5773 pf_normalize_cleanup();
5774 PF_RULES_WLOCK();
5775 pfi_cleanup_vnet();
5776 PF_RULES_WUNLOCK();
5777 pfr_cleanup();
5778 pf_osfp_flush();
5779 pf_cleanup();
5780 if (IS_DEFAULT_VNET(curvnet))
5781 pf_mtag_cleanup();
5782
5783 pf_cleanup_tagset(&V_pf_tags);
5784 #ifdef ALTQ
5785 pf_cleanup_tagset(&V_pf_qids);
5786 #endif
5787 uma_zdestroy(V_pf_tag_z);
5788
5789 #ifdef PF_WANT_32_TO_64_COUNTER
5790 PF_RULES_WLOCK();
5791 LIST_REMOVE(V_pf_kifmarker, pfik_allkiflist);
5792
5793 MPASS(LIST_EMPTY(&V_pf_allkiflist));
5794 MPASS(V_pf_allkifcount == 0);
5795
5796 LIST_REMOVE(&V_pf_default_rule, allrulelist);
5797 V_pf_allrulecount--;
5798 LIST_REMOVE(V_pf_rulemarker, allrulelist);
5799
5800 /*
5801 * There are known pf rule leaks when running the test suite.
5802 */
5803 #ifdef notyet
5804 MPASS(LIST_EMPTY(&V_pf_allrulelist));
5805 MPASS(V_pf_allrulecount == 0);
5806 #endif
5807
5808 PF_RULES_WUNLOCK();
5809
5810 free(V_pf_kifmarker, PFI_MTYPE);
5811 free(V_pf_rulemarker, M_PFRULE);
5812 #endif
5813
5814 /* Free counters last as we updated them during shutdown. */
5815 pf_counter_u64_deinit(&V_pf_default_rule.evaluations);
5816 for (int i = 0; i < 2; i++) {
5817 pf_counter_u64_deinit(&V_pf_default_rule.packets[i]);
5818 pf_counter_u64_deinit(&V_pf_default_rule.bytes[i]);
5819 }
5820 counter_u64_free(V_pf_default_rule.states_cur);
5821 counter_u64_free(V_pf_default_rule.states_tot);
5822 counter_u64_free(V_pf_default_rule.src_nodes);
5823
5824 for (int i = 0; i < PFRES_MAX; i++)
5825 counter_u64_free(V_pf_status.counters[i]);
5826 for (int i = 0; i < KLCNT_MAX; i++)
5827 counter_u64_free(V_pf_status.lcounters[i]);
5828 for (int i = 0; i < FCNT_MAX; i++)
5829 pf_counter_u64_deinit(&V_pf_status.fcounters[i]);
5830 for (int i = 0; i < SCNT_MAX; i++)
5831 counter_u64_free(V_pf_status.scounters[i]);
5832 }
5833
5834 static void
pf_unload(void)5835 pf_unload(void)
5836 {
5837
5838 sx_xlock(&pf_end_lock);
5839 pf_end_threads = 1;
5840 while (pf_end_threads < 2) {
5841 wakeup_one(pf_purge_thread);
5842 sx_sleep(pf_purge_proc, &pf_end_lock, 0, "pftmo", 0);
5843 }
5844 sx_xunlock(&pf_end_lock);
5845
5846 if (pf_dev != NULL)
5847 destroy_dev(pf_dev);
5848
5849 pfi_cleanup();
5850
5851 rm_destroy(&pf_rules_lock);
5852 sx_destroy(&pf_ioctl_lock);
5853 sx_destroy(&pf_end_lock);
5854 }
5855
5856 static void
vnet_pf_init(void * unused __unused)5857 vnet_pf_init(void *unused __unused)
5858 {
5859
5860 pf_load_vnet();
5861 }
5862 VNET_SYSINIT(vnet_pf_init, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD,
5863 vnet_pf_init, NULL);
5864
5865 static void
vnet_pf_uninit(const void * unused __unused)5866 vnet_pf_uninit(const void *unused __unused)
5867 {
5868
5869 pf_unload_vnet();
5870 }
5871 SYSUNINIT(pf_unload, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND, pf_unload, NULL);
5872 VNET_SYSUNINIT(vnet_pf_uninit, SI_SUB_PROTO_FIREWALL, SI_ORDER_THIRD,
5873 vnet_pf_uninit, NULL);
5874
5875
5876 static int
pf_modevent(module_t mod,int type,void * data)5877 pf_modevent(module_t mod, int type, void *data)
5878 {
5879 int error = 0;
5880
5881 switch(type) {
5882 case MOD_LOAD:
5883 error = pf_load();
5884 break;
5885 case MOD_UNLOAD:
5886 /* Handled in SYSUNINIT(pf_unload) to ensure it's done after
5887 * the vnet_pf_uninit()s */
5888 break;
5889 default:
5890 error = EINVAL;
5891 break;
5892 }
5893
5894 return (error);
5895 }
5896
5897 static moduledata_t pf_mod = {
5898 "pf",
5899 pf_modevent,
5900 0
5901 };
5902
5903 DECLARE_MODULE(pf, pf_mod, SI_SUB_PROTO_FIREWALL, SI_ORDER_SECOND);
5904 MODULE_VERSION(pf, PF_MODVER);
5905