sys/contrib/pf/net/pf_if.c

   1 /*      $OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $ */
   2
   3 /*
   4  * Copyright 2005 Henning Brauer <henning@openbsd.org>
   5  * Copyright 2005 Ryan McBride <mcbride@openbsd.org>
   6  * Copyright (c) 2001 Daniel Hartmeier
   7  * Copyright (c) 2003 Cedric Berger
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  *    - Redistributions of source code must retain the above copyright
  15  *      notice, this list of conditions and the following disclaimer.
  16  *    - Redistributions in binary form must reproduce the above
  17  *      copyright notice, this list of conditions and the following
  18  *      disclaimer in the documentation and/or other materials provided
  19  *      with the distribution.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  32  * POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #if defined(__FreeBSD__)
  36 #include "opt_inet.h"
  37 #include "opt_inet6.h"
  38
  39 #include <sys/cdefs.h>
  40 __FBSDID("$FreeBSD$");
  41 #endif
  42
  43 #include <sys/param.h>
  44 #include <sys/systm.h>
  45 #ifdef __FreeBSD__
  46 #include <sys/malloc.h>
  47 #endif
  48 #include <sys/mbuf.h>
  49 #include <sys/filio.h>
  50 #include <sys/socket.h>
  51 #include <sys/socketvar.h>
  52 #include <sys/kernel.h>
  53 #ifndef __FreeBSD__
  54 #include <sys/device.h>
  55 #endif
  56 #include <sys/time.h>
  57 #ifndef __FreeBSD__
  58 #include <sys/pool.h>
  59 #endif
  60
  61 #include <net/if.h>
  62 #include <net/if_types.h>
  63 #ifdef __FreeBSD__
  64 #include <net/vnet.h>
  65 #endif
  66
  67 #include <netinet/in.h>
  68 #include <netinet/in_var.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/ip.h>
  71 #include <netinet/ip_var.h>
  72
  73 #include <net/pfvar.h>
  74
  75 #ifdef INET6
  76 #include <netinet/ip6.h>
  77 #endif /* INET6 */
  78
  79 #ifdef __FreeBSD__
  80 VNET_DEFINE(struct pfi_kif *,    pfi_all);
  81 VNET_DEFINE(uma_zone_t,          pfi_addr_pl);
  82 VNET_DEFINE(struct pfi_ifhead,   pfi_ifs);
  83 #define V_pfi_ifs                VNET(pfi_ifs)
  84 VNET_DEFINE(long,                pfi_update);
  85 #define V_pfi_update             VNET(pfi_update)
  86 VNET_DEFINE(struct pfr_addr *,   pfi_buffer);
  87 #define V_pfi_buffer             VNET(pfi_buffer)
  88 VNET_DEFINE(int,                 pfi_buffer_cnt);
  89 #define V_pfi_buffer_cnt         VNET(pfi_buffer_cnt)
  90 VNET_DEFINE(int,                 pfi_buffer_max);
  91 #define V_pfi_buffer_max         VNET(pfi_buffer_max)
  92 #else
  93 struct pfi_kif           *pfi_all = NULL;
  94 struct pool               pfi_addr_pl;
  95 struct pfi_ifhead         pfi_ifs;
  96 long                      pfi_update = 1;
  97 struct pfr_addr          *pfi_buffer;
  98 int                       pfi_buffer_cnt;
  99 int                       pfi_buffer_max;
 100 #endif
 101 #ifdef __FreeBSD__
 102 eventhandler_tag         pfi_attach_cookie;
 103 eventhandler_tag         pfi_detach_cookie;
 104 eventhandler_tag         pfi_attach_group_cookie;
 105 eventhandler_tag         pfi_change_group_cookie;
 106 eventhandler_tag         pfi_detach_group_cookie;
 107 eventhandler_tag         pfi_ifaddr_event_cookie;
 108 #endif
 109
 110 void             pfi_kif_update(struct pfi_kif *);
 111 void             pfi_dynaddr_update(struct pfi_dynaddr *dyn);
 112 void             pfi_table_update(struct pfr_ktable *, struct pfi_kif *,
 113                     int, int);
 114 void             pfi_kifaddr_update(void *);
 115 void             pfi_instance_add(struct ifnet *, int, int);
 116 void             pfi_address_add(struct sockaddr *, int, int);
 117 int              pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
 118 int              pfi_skip_if(const char *, struct pfi_kif *);
 119 int              pfi_unmask(void *);
 120 #ifdef __FreeBSD__
 121 void             pfi_attach_ifnet_event(void * __unused, struct ifnet *);
 122 void             pfi_detach_ifnet_event(void * __unused, struct ifnet *);
 123 void             pfi_attach_group_event(void *, struct ifg_group *);
 124 void             pfi_change_group_event(void *, char *);
 125 void             pfi_detach_group_event(void *, struct ifg_group *);
 126 void             pfi_ifaddr_event(void * __unused, struct ifnet *);
 127 #endif
 128
 129 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 130 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 131
 132 #define PFI_BUFFER_MAX          0x10000
 133 #define PFI_MTYPE               M_IFADDR
 134
 135 void
 136 pfi_initialize(void)
 137 {
 138 #ifdef __FreeBSD__
 139         if (V_pfi_all != NULL)  /* already initialized */
 140 #else
 141         if (pfi_all != NULL)    /* already initialized */
 142 #endif
 143                 return;
 144
 145 #ifndef __FreeBSD__
 146         pool_init(&V_pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0,
 147             "pfiaddrpl", &pool_allocator_nointr);
 148 #endif
 149 #ifdef __FreeBSD__
 150         V_pfi_buffer_max = 64;
 151         V_pfi_buffer = malloc(V_pfi_buffer_max * sizeof(*V_pfi_buffer),
 152             PFI_MTYPE, M_WAITOK);
 153
 154         if ((V_pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
 155 #else
 156         pfi_buffer_max = 64;
 157         pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer),
 158             PFI_MTYPE, M_WAITOK);
 159
 160         if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
 161 #endif
 162                 panic("pfi_kif_get for pfi_all failed");
 163 #ifdef __FreeBSD__
 164         struct ifg_group *ifg;
 165         struct ifnet *ifp;
 166
 167         IFNET_RLOCK();
 168         TAILQ_FOREACH(ifg, &V_ifg_head, ifg_next)
 169                 pfi_attach_ifgroup(ifg);
 170         TAILQ_FOREACH(ifp, &V_ifnet, if_link)
 171                 pfi_attach_ifnet(ifp);
 172         IFNET_RUNLOCK();
 173
 174         pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_arrival_event,
 175             pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
 176         pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_departure_event,
 177             pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
 178         pfi_attach_group_cookie = EVENTHANDLER_REGISTER(group_attach_event,
 179             pfi_attach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
 180         pfi_change_group_cookie = EVENTHANDLER_REGISTER(group_change_event,
 181             pfi_change_group_event, curvnet, EVENTHANDLER_PRI_ANY);
 182         pfi_detach_group_cookie = EVENTHANDLER_REGISTER(group_detach_event,
 183             pfi_detach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
 184         pfi_ifaddr_event_cookie = EVENTHANDLER_REGISTER(ifaddr_event,
 185             pfi_ifaddr_event, NULL, EVENTHANDLER_PRI_ANY);
 186 #endif
 187 }
 188
 189 #ifdef __FreeBSD__
 190 void
 191 pfi_cleanup(void)
 192 {
 193         struct pfi_kif *p;
 194
 195         PF_UNLOCK();
 196         EVENTHANDLER_DEREGISTER(ifnet_arrival_event, pfi_attach_cookie);
 197         EVENTHANDLER_DEREGISTER(ifnet_departure_event, pfi_detach_cookie);
 198         EVENTHANDLER_DEREGISTER(group_attach_event, pfi_attach_group_cookie);
 199         EVENTHANDLER_DEREGISTER(group_change_event, pfi_change_group_cookie);
 200         EVENTHANDLER_DEREGISTER(group_detach_event, pfi_detach_group_cookie);
 201         EVENTHANDLER_DEREGISTER(ifaddr_event, pfi_ifaddr_event_cookie);
 202         PF_LOCK();
 203
 204         V_pfi_all = NULL;
 205         while ((p = RB_MIN(pfi_ifhead, &V_pfi_ifs))) {
 206                 if (p->pfik_rules || p->pfik_states) {
 207                         printf("pfi_cleanup: dangling refs for %s\n",
 208                             p->pfik_name);
 209                 }
 210
 211                 RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p);
 212                 free(p, PFI_MTYPE);
 213         }
 214
 215         free(V_pfi_buffer, PFI_MTYPE);
 216 }
 217 #endif
 218
 219 struct pfi_kif *
 220 pfi_kif_get(const char *kif_name)
 221 {
 222         struct pfi_kif          *kif;
 223         struct pfi_kif_cmp       s;
 224
 225         bzero(&s, sizeof(s));
 226         strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name));
 227 #ifdef __FreeBSD__
 228         if ((kif = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&s)) != NULL)
 229 #else
 230         if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&s)) != NULL)
 231 #endif
 232                 return (kif);
 233
 234         /* create new one */
 235 #ifdef __FreeBSD__
 236         if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_NOWAIT | M_ZERO)) == NULL)
 237 #else
 238         if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_DONTWAIT|M_ZERO)) == NULL)
 239 #endif
 240                 return (NULL);
 241
 242         strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name));
 243 #ifdef __FreeBSD__
 244         /*
 245          * It seems that the value of time_second is in unintialzied state
 246          * when pf sets interface statistics clear time in boot phase if pf
 247          * was statically linked to kernel. Instead of setting the bogus
 248          * time value have pfi_get_ifaces handle this case. In
 249          * pfi_get_ifaces it uses boottime.tv_sec if it sees the time is 0.
 250          */
 251         kif->pfik_tzero = time_second > 1 ? time_second : 0;
 252 #else
 253         kif->pfik_tzero = time_second;
 254 #endif
 255         TAILQ_INIT(&kif->pfik_dynaddrs);
 256
 257 #ifdef __FreeBSD__
 258         RB_INSERT(pfi_ifhead, &V_pfi_ifs, kif);
 259 #else
 260         RB_INSERT(pfi_ifhead, &pfi_ifs, kif);
 261 #endif
 262
 263         return (kif);
 264 }
 265
 266 void
 267 pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what)
 268 {
 269         switch (what) {
 270         case PFI_KIF_REF_RULE:
 271                 kif->pfik_rules++;
 272                 break;
 273         case PFI_KIF_REF_STATE:
 274                 kif->pfik_states++;
 275                 break;
 276         default:
 277                 panic("pfi_kif_ref with unknown type");
 278         }
 279 }
 280
 281 void
 282 pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
 283 {
 284         if (kif == NULL)
 285                 return;
 286
 287         switch (what) {
 288         case PFI_KIF_REF_NONE:
 289                 break;
 290         case PFI_KIF_REF_RULE:
 291                 if (kif->pfik_rules <= 0) {
 292                         printf("pfi_kif_unref: rules refcount <= 0\n");
 293                         return;
 294                 }
 295                 kif->pfik_rules--;
 296                 break;
 297         case PFI_KIF_REF_STATE:
 298                 if (kif->pfik_states <= 0) {
 299                         printf("pfi_kif_unref: state refcount <= 0\n");
 300                         return;
 301                 }
 302                 kif->pfik_states--;
 303                 break;
 304         default:
 305                 panic("pfi_kif_unref with unknown type");
 306         }
 307
 308 #ifdef __FreeBSD__
 309         if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all)
 310 #else
 311         if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == pfi_all)
 312 #endif
 313                 return;
 314
 315         if (kif->pfik_rules || kif->pfik_states)
 316                 return;
 317
 318 #ifdef __FreeBSD__
 319         RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif);
 320 #else
 321         RB_REMOVE(pfi_ifhead, &pfi_ifs, kif);
 322 #endif
 323         free(kif, PFI_MTYPE);
 324 }
 325
 326 int
 327 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
 328 {
 329         struct ifg_list *p;
 330
 331         if (rule_kif == NULL || rule_kif == packet_kif)
 332                 return (1);
 333
 334         if (rule_kif->pfik_group != NULL)
 335                 TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next)
 336                         if (p->ifgl_group == rule_kif->pfik_group)
 337                                 return (1);
 338
 339         return (0);
 340 }
 341
 342 void
 343 pfi_attach_ifnet(struct ifnet *ifp)
 344 {
 345         struct pfi_kif          *kif;
 346         int                      s;
 347
 348         pfi_initialize();
 349         s = splsoftnet();
 350 #ifdef __FreeBSD__
 351         V_pfi_update++;
 352 #else
 353         pfi_update++;
 354 #endif
 355         if ((kif = pfi_kif_get(ifp->if_xname)) == NULL)
 356                 panic("pfi_kif_get failed");
 357
 358         kif->pfik_ifp = ifp;
 359         ifp->if_pf_kif = (caddr_t)kif;
 360
 361 #ifndef __FreeBSD__
 362         if ((kif->pfik_ah_cookie = hook_establish(ifp->if_addrhooks, 1,
 363             pfi_kifaddr_update, kif)) == NULL)
 364                 panic("pfi_attach_ifnet: cannot allocate '%s' address hook",
 365                     ifp->if_xname);
 366 #endif
 367
 368         pfi_kif_update(kif);
 369
 370         splx(s);
 371 }
 372
 373 void
 374 pfi_detach_ifnet(struct ifnet *ifp)
 375 {
 376         int                      s;
 377         struct pfi_kif          *kif;
 378
 379         if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL)
 380                 return;
 381
 382         s = splsoftnet();
 383 #ifdef __FreeBSD__
 384         V_pfi_update++;
 385 #else
 386         pfi_update++;
 387 #endif
 388 #ifndef __FreeBSD__
 389         hook_disestablish(ifp->if_addrhooks, kif->pfik_ah_cookie);
 390 #endif
 391         pfi_kif_update(kif);
 392
 393         kif->pfik_ifp = NULL;
 394         ifp->if_pf_kif = NULL;
 395         pfi_kif_unref(kif, PFI_KIF_REF_NONE);
 396         splx(s);
 397 }
 398
 399 void
 400 pfi_attach_ifgroup(struct ifg_group *ifg)
 401 {
 402         struct pfi_kif  *kif;
 403         int              s;
 404
 405         pfi_initialize();
 406         s = splsoftnet();
 407 #ifdef __FreeBSD__
 408         V_pfi_update++;
 409 #else
 410         pfi_update++;
 411 #endif
 412         if ((kif = pfi_kif_get(ifg->ifg_group)) == NULL)
 413                 panic("pfi_kif_get failed");
 414
 415         kif->pfik_group = ifg;
 416         ifg->ifg_pf_kif = (caddr_t)kif;
 417
 418         splx(s);
 419 }
 420
 421 void
 422 pfi_detach_ifgroup(struct ifg_group *ifg)
 423 {
 424         int              s;
 425         struct pfi_kif  *kif;
 426
 427         if ((kif = (struct pfi_kif *)ifg->ifg_pf_kif) == NULL)
 428                 return;
 429
 430         s = splsoftnet();
 431 #ifdef __FreeBSD__
 432         V_pfi_update++;
 433 #else
 434         pfi_update++;
 435 #endif
 436
 437         kif->pfik_group = NULL;
 438         ifg->ifg_pf_kif = NULL;
 439         pfi_kif_unref(kif, PFI_KIF_REF_NONE);
 440         splx(s);
 441 }
 442
 443 void
 444 pfi_group_change(const char *group)
 445 {
 446         struct pfi_kif          *kif;
 447         int                      s;
 448
 449         s = splsoftnet();
 450 #ifdef __FreeBSD__
 451         V_pfi_update++;
 452 #else
 453         pfi_update++;
 454 #endif
 455         if ((kif = pfi_kif_get(group)) == NULL)
 456                 panic("pfi_kif_get failed");
 457
 458         pfi_kif_update(kif);
 459
 460         splx(s);
 461 }
 462
 463 int
 464 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
 465 {
 466         switch (af) {
 467 #ifdef INET
 468         case AF_INET:
 469                 switch (dyn->pfid_acnt4) {
 470                 case 0:
 471                         return (0);
 472                 case 1:
 473                         return (PF_MATCHA(0, &dyn->pfid_addr4,
 474                             &dyn->pfid_mask4, a, AF_INET));
 475                 default:
 476                         return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
 477                 }
 478                 break;
 479 #endif /* INET */
 480 #ifdef INET6
 481         case AF_INET6:
 482                 switch (dyn->pfid_acnt6) {
 483                 case 0:
 484                         return (0);
 485                 case 1:
 486                         return (PF_MATCHA(0, &dyn->pfid_addr6,
 487                             &dyn->pfid_mask6, a, AF_INET6));
 488                 default:
 489                         return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
 490                 }
 491                 break;
 492 #endif /* INET6 */
 493         default:
 494                 return (0);
 495         }
 496 }
 497
 498 int
 499 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
 500 {
 501         struct pfi_dynaddr      *dyn;
 502         char                     tblname[PF_TABLE_NAME_SIZE];
 503         struct pf_ruleset       *ruleset = NULL;
 504         int                      s, rv = 0;
 505
 506         if (aw->type != PF_ADDR_DYNIFTL)
 507                 return (0);
 508 #ifdef __FreeBSD__
 509         /* XXX: revisit! */
 510         if ((dyn = pool_get(&V_pfi_addr_pl, PR_WAITOK | PR_ZERO))
 511 #else
 512         if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK | PR_LIMITFAIL | PR_ZERO))
 513 #endif
 514             == NULL)
 515                 return (1);
 516
 517         s = splsoftnet();
 518         if (!strcmp(aw->v.ifname, "self"))
 519                 dyn->pfid_kif = pfi_kif_get(IFG_ALL);
 520         else
 521                 dyn->pfid_kif = pfi_kif_get(aw->v.ifname);
 522         if (dyn->pfid_kif == NULL) {
 523                 rv = 1;
 524                 goto _bad;
 525         }
 526         pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE);
 527
 528         dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
 529         if (af == AF_INET && dyn->pfid_net == 32)
 530                 dyn->pfid_net = 128;
 531         strlcpy(tblname, aw->v.ifname, sizeof(tblname));
 532         if (aw->iflags & PFI_AFLAG_NETWORK)
 533                 strlcat(tblname, ":network", sizeof(tblname));
 534         if (aw->iflags & PFI_AFLAG_BROADCAST)
 535                 strlcat(tblname, ":broadcast", sizeof(tblname));
 536         if (aw->iflags & PFI_AFLAG_PEER)
 537                 strlcat(tblname, ":peer", sizeof(tblname));
 538         if (aw->iflags & PFI_AFLAG_NOALIAS)
 539                 strlcat(tblname, ":0", sizeof(tblname));
 540         if (dyn->pfid_net != 128)
 541                 snprintf(tblname + strlen(tblname),
 542                     sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
 543         if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
 544                 rv = 1;
 545                 goto _bad;
 546         }
 547
 548         if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname, 1)) == NULL) {
 549                 rv = 1;
 550                 goto _bad;
 551         }
 552
 553         dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE;
 554         dyn->pfid_iflags = aw->iflags;
 555         dyn->pfid_af = af;
 556
 557         TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
 558         aw->p.dyn = dyn;
 559         pfi_kif_update(dyn->pfid_kif);
 560         splx(s);
 561         return (0);
 562
 563 _bad:
 564         if (dyn->pfid_kt != NULL)
 565                 pfr_detach_table(dyn->pfid_kt);
 566         if (ruleset != NULL)
 567                 pf_remove_if_empty_ruleset(ruleset);
 568         if (dyn->pfid_kif != NULL)
 569                 pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE);
 570 #ifdef __FreeBSD__
 571         pool_put(&V_pfi_addr_pl, dyn);
 572 #else
 573         pool_put(&pfi_addr_pl, dyn);
 574 #endif
 575         splx(s);
 576         return (rv);
 577 }
 578
 579 void
 580 pfi_kif_update(struct pfi_kif *kif)
 581 {
 582         struct ifg_list         *ifgl;
 583         struct pfi_dynaddr      *p;
 584
 585         /* update all dynaddr */
 586         TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
 587                 pfi_dynaddr_update(p);
 588
 589         /* again for all groups kif is member of */
 590         if (kif->pfik_ifp != NULL)
 591                 TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)
 592                         pfi_kif_update((struct pfi_kif *)
 593                             ifgl->ifgl_group->ifg_pf_kif);
 594 }
 595
 596 void
 597 pfi_dynaddr_update(struct pfi_dynaddr *dyn)
 598 {
 599         struct pfi_kif          *kif;
 600         struct pfr_ktable       *kt;
 601
 602         if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL)
 603                 panic("pfi_dynaddr_update");
 604
 605         kif = dyn->pfid_kif;
 606         kt = dyn->pfid_kt;
 607
 608 #ifdef __FreeBSD__
 609         if (kt->pfrkt_larg != V_pfi_update) {
 610 #else
 611         if (kt->pfrkt_larg != pfi_update) {
 612 #endif
 613                 /* this table needs to be brought up-to-date */
 614                 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags);
 615 #ifdef __FreeBSD__
 616                 kt->pfrkt_larg = V_pfi_update;
 617 #else
 618                 kt->pfrkt_larg = pfi_update;
 619 #endif
 620         }
 621         pfr_dynaddr_update(kt, dyn);
 622 }
 623
 624 void
 625 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
 626 {
 627         int                      e, size2 = 0;
 628         struct ifg_member       *ifgm;
 629
 630 #ifdef __FreeBSD__
 631         V_pfi_buffer_cnt = 0;
 632 #else
 633         pfi_buffer_cnt = 0;
 634 #endif
 635
 636         if (kif->pfik_ifp != NULL)
 637                 pfi_instance_add(kif->pfik_ifp, net, flags);
 638         else if (kif->pfik_group != NULL)
 639                 TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next)
 640                         pfi_instance_add(ifgm->ifgm_ifp, net, flags);
 641
 642 #ifdef __FreeBSD__
 643         if ((e = pfr_set_addrs(&kt->pfrkt_t, V_pfi_buffer, V_pfi_buffer_cnt, &size2,
 644             NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
 645                 printf("pfi_table_update: cannot set %d new addresses "
 646                     "into table %s: %d\n", V_pfi_buffer_cnt, kt->pfrkt_name, e);
 647 #else
 648         if ((e = pfr_set_addrs(&kt->pfrkt_t, pfi_buffer, pfi_buffer_cnt, &size2,
 649             NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
 650                 printf("pfi_table_update: cannot set %d new addresses "
 651                     "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);
 652 #endif
 653 }
 654
 655 void
 656 pfi_instance_add(struct ifnet *ifp, int net, int flags)
 657 {
 658         struct ifaddr   *ia;
 659         int              got4 = 0, got6 = 0;
 660         int              net2, af;
 661
 662         if (ifp == NULL)
 663                 return;
 664         TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) {
 665                 if (ia->ifa_addr == NULL)
 666                         continue;
 667                 af = ia->ifa_addr->sa_family;
 668                 if (af != AF_INET && af != AF_INET6)
 669                         continue;
 670 #ifdef __FreeBSD__
 671                 /*
 672                  * XXX: For point-to-point interfaces, (ifname:0) and IPv4,
 673                  *      jump over addresses without a proper route to work
 674                  *      around a problem with ppp not fully removing the
 675                  *      address used during IPCP.
 676                  */
 677                 if ((ifp->if_flags & IFF_POINTOPOINT) &&
 678                     !(ia->ifa_flags & IFA_ROUTE) &&
 679                     (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET))
 680                         continue;
 681 #endif
 682                 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6)
 683                         continue;
 684                 if ((flags & PFI_AFLAG_BROADCAST) &&
 685                     !(ifp->if_flags & IFF_BROADCAST))
 686                         continue;
 687                 if ((flags & PFI_AFLAG_PEER) &&
 688                     !(ifp->if_flags & IFF_POINTOPOINT))
 689                         continue;
 690                 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
 691                     IN6_IS_ADDR_LINKLOCAL(
 692                     &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
 693                         continue;
 694                 if (flags & PFI_AFLAG_NOALIAS) {
 695                         if (af == AF_INET && got4)
 696                                 continue;
 697                         if (af == AF_INET6 && got6)
 698                                 continue;
 699                 }
 700                 if (af == AF_INET)
 701                         got4 = 1;
 702                 else if (af == AF_INET6)
 703                         got6 = 1;
 704                 net2 = net;
 705                 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
 706                         if (af == AF_INET)
 707                                 net2 = pfi_unmask(&((struct sockaddr_in *)
 708                                     ia->ifa_netmask)->sin_addr);
 709                         else if (af == AF_INET6)
 710                                 net2 = pfi_unmask(&((struct sockaddr_in6 *)
 711                                     ia->ifa_netmask)->sin6_addr);
 712                 }
 713                 if (af == AF_INET && net2 > 32)
 714                         net2 = 32;
 715                 if (flags & PFI_AFLAG_BROADCAST)
 716                         pfi_address_add(ia->ifa_broadaddr, af, net2);
 717                 else if (flags & PFI_AFLAG_PEER)
 718                         pfi_address_add(ia->ifa_dstaddr, af, net2);
 719                 else
 720                         pfi_address_add(ia->ifa_addr, af, net2);
 721         }
 722 }
 723
 724 void
 725 pfi_address_add(struct sockaddr *sa, int af, int net)
 726 {
 727         struct pfr_addr *p;
 728         int              i;
 729
 730 #ifdef __FreeBSD__
 731         if (V_pfi_buffer_cnt >= V_pfi_buffer_max) {
 732                 int              new_max = V_pfi_buffer_max * 2;
 733 #else
 734         if (pfi_buffer_cnt >= pfi_buffer_max) {
 735                 int              new_max = pfi_buffer_max * 2;
 736 #endif
 737
 738                 if (new_max > PFI_BUFFER_MAX) {
 739                         printf("pfi_address_add: address buffer full (%d/%d)\n",
 740 #ifdef __FreeBSD__
 741                             V_pfi_buffer_cnt, PFI_BUFFER_MAX);
 742 #else
 743                             pfi_buffer_cnt, PFI_BUFFER_MAX);
 744 #endif
 745                         return;
 746                 }
 747                 p = malloc(new_max * sizeof(*V_pfi_buffer), PFI_MTYPE,
 748 #ifdef __FreeBSD__
 749                     M_NOWAIT);
 750 #else
 751                     M_DONTWAIT);
 752 #endif
 753                 if (p == NULL) {
 754                         printf("pfi_address_add: no memory to grow buffer "
 755 #ifdef __FreeBSD__
 756                             "(%d/%d)\n", V_pfi_buffer_cnt, PFI_BUFFER_MAX);
 757 #else
 758                             "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
 759 #endif
 760                         return;
 761                 }
 762 #ifdef __FreeBSD__
 763                 memcpy(V_pfi_buffer, p, V_pfi_buffer_cnt * sizeof(*V_pfi_buffer));
 764                 /* no need to zero buffer */
 765                 free(V_pfi_buffer, PFI_MTYPE);
 766                 V_pfi_buffer = p;
 767                 V_pfi_buffer_max = new_max;
 768 #else
 769                 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer));
 770                 /* no need to zero buffer */
 771                 free(pfi_buffer, PFI_MTYPE);
 772                 pfi_buffer = p;
 773                 pfi_buffer_max = new_max;
 774 #endif
 775         }
 776         if (af == AF_INET && net > 32)
 777                 net = 128;
 778 #ifdef __FreeBSD__
 779         p = V_pfi_buffer + V_pfi_buffer_cnt++;
 780 #else
 781         p = pfi_buffer + pfi_buffer_cnt++;
 782 #endif
 783         bzero(p, sizeof(*p));
 784         p->pfra_af = af;
 785         p->pfra_net = net;
 786         if (af == AF_INET)
 787                 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr;
 788         else if (af == AF_INET6) {
 789                 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr;
 790                 if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr))
 791                         p->pfra_ip6addr.s6_addr16[1] = 0;
 792         }
 793         /* mask network address bits */
 794         if (net < 128)
 795                 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
 796         for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++)
 797                 ((caddr_t)p)[i] = 0;
 798 }
 799
 800 void
 801 pfi_dynaddr_remove(struct pf_addr_wrap *aw)
 802 {
 803         int     s;
 804
 805         if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 806             aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL)
 807                 return;
 808
 809         s = splsoftnet();
 810         TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry);
 811         pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE);
 812         aw->p.dyn->pfid_kif = NULL;
 813         pfr_detach_table(aw->p.dyn->pfid_kt);
 814         aw->p.dyn->pfid_kt = NULL;
 815 #ifdef __FreeBSD__
 816         pool_put(&V_pfi_addr_pl, aw->p.dyn);
 817 #else
 818         pool_put(&pfi_addr_pl, aw->p.dyn);
 819 #endif
 820         aw->p.dyn = NULL;
 821         splx(s);
 822 }
 823
 824 void
 825 pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
 826 {
 827         if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 828             aw->p.dyn->pfid_kif == NULL)
 829                 return;
 830         aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
 831 }
 832
 833 void
 834 pfi_kifaddr_update(void *v)
 835 {
 836         int                      s;
 837         struct pfi_kif          *kif = (struct pfi_kif *)v;
 838
 839         s = splsoftnet();
 840 #ifdef __FreeBSD__
 841         V_pfi_update++;
 842 #else
 843         pfi_update++;
 844 #endif
 845         pfi_kif_update(kif);
 846         splx(s);
 847 }
 848
 849 int
 850 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
 851 {
 852         return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
 853 }
 854
 855 void
 856 pfi_update_status(const char *name, struct pf_status *pfs)
 857 {
 858         struct pfi_kif          *p;
 859         struct pfi_kif_cmp       key;
 860         struct ifg_member        p_member, *ifgm;
 861         TAILQ_HEAD(, ifg_member) ifg_members;
 862         int                      i, j, k, s;
 863
 864         strlcpy(key.pfik_name, name, sizeof(key.pfik_name));
 865         s = splsoftnet();
 866 #ifdef __FreeBSD__
 867         p = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&key);
 868 #else
 869         p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&key);
 870 #endif
 871         if (p == NULL) {
 872                 splx(s);
 873                 return;
 874         }
 875         if (p->pfik_group != NULL) {
 876                 bcopy(&p->pfik_group->ifg_members, &ifg_members,
 877                     sizeof(ifg_members));
 878         } else {
 879                 /* build a temporary list for p only */
 880                 bzero(&p_member, sizeof(p_member));
 881                 p_member.ifgm_ifp = p->pfik_ifp;
 882                 TAILQ_INIT(&ifg_members);
 883                 TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next);
 884         }
 885         if (pfs) {
 886                 bzero(pfs->pcounters, sizeof(pfs->pcounters));
 887                 bzero(pfs->bcounters, sizeof(pfs->bcounters));
 888         }
 889         TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) {
 890                 if (ifgm->ifgm_ifp == NULL)
 891                         continue;
 892                 p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif;
 893
 894                 /* just clear statistics */
 895                 if (pfs == NULL) {
 896                         bzero(p->pfik_packets, sizeof(p->pfik_packets));
 897                         bzero(p->pfik_bytes, sizeof(p->pfik_bytes));
 898                         p->pfik_tzero = time_second;
 899                         continue;
 900                 }
 901                 for (i = 0; i < 2; i++)
 902                         for (j = 0; j < 2; j++)
 903                                 for (k = 0; k < 2; k++) {
 904                                         pfs->pcounters[i][j][k] +=
 905                                                 p->pfik_packets[i][j][k];
 906                                         pfs->bcounters[i][j] +=
 907                                                 p->pfik_bytes[i][j][k];
 908                                 }
 909         }
 910         splx(s);
 911 }
 912
 913 int
 914 pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size)
 915 {
 916         struct pfi_kif  *p, *nextp;
 917         int              s, n = 0;
 918 #ifdef __FreeBSD__
 919         int              error;
 920 #endif
 921
 922         s = splsoftnet();
 923 #ifdef __FreeBSD__
 924         for (p = RB_MIN(pfi_ifhead, &V_pfi_ifs); p; p = nextp) {
 925                 nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
 926 #else
 927         for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) {
 928                 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
 929 #endif
 930                 if (pfi_skip_if(name, p))
 931                         continue;
 932                 if (*size > n++) {
 933                         if (!p->pfik_tzero)
 934                                 p->pfik_tzero = time_second;
 935                         pfi_kif_ref(p, PFI_KIF_REF_RULE);
 936 #ifdef __FreeBSD__
 937                         PF_COPYOUT(p, buf++, sizeof(*buf), error);
 938                         if (error) {
 939 #else
 940                         if (copyout(p, buf++, sizeof(*buf))) {
 941 #endif
 942                                 pfi_kif_unref(p, PFI_KIF_REF_RULE);
 943                                 splx(s);
 944                                 return (EFAULT);
 945                         }
 946 #ifdef __FreeBSD__
 947                         nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
 948 #else
 949                         nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
 950 #endif
 951                         pfi_kif_unref(p, PFI_KIF_REF_RULE);
 952                 }
 953         }
 954         splx(s);
 955         *size = n;
 956         return (0);
 957 }
 958
 959 int
 960 pfi_skip_if(const char *filter, struct pfi_kif *p)
 961 {
 962         int     n;
 963
 964         if (filter == NULL || !*filter)
 965                 return (0);
 966         if (!strcmp(p->pfik_name, filter))
 967                 return (0);     /* exact match */
 968         n = strlen(filter);
 969         if (n < 1 || n >= IFNAMSIZ)
 970                 return (1);     /* sanity check */
 971         if (filter[n-1] >= '0' && filter[n-1] <= '9')
 972                 return (1);     /* only do exact match in that case */
 973         if (strncmp(p->pfik_name, filter, n))
 974                 return (1);     /* prefix doesn't match */
 975         return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
 976 }
 977
 978 int
 979 pfi_set_flags(const char *name, int flags)
 980 {
 981         struct pfi_kif  *p;
 982         int              s;
 983
 984         s = splsoftnet();
 985 #ifdef __FreeBSD__
 986         RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
 987 #else
 988         RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
 989 #endif
 990                 if (pfi_skip_if(name, p))
 991                         continue;
 992                 p->pfik_flags |= flags;
 993         }
 994         splx(s);
 995         return (0);
 996 }
 997
 998 int
 999 pfi_clear_flags(const char *name, int flags)
1000 {
1001         struct pfi_kif  *p;
1002         int              s;
1003
1004         s = splsoftnet();
1005 #ifdef __FreeBSD__
1006         RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
1007 #else
1008         RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
1009 #endif
1010                 if (pfi_skip_if(name, p))
1011                         continue;
1012                 p->pfik_flags &= ~flags;
1013         }
1014         splx(s);
1015         return (0);
1016 }
1017
1018 /* from pf_print_state.c */
1019 int
1020 pfi_unmask(void *addr)
1021 {
1022         struct pf_addr *m = addr;
1023         int i = 31, j = 0, b = 0;
1024         u_int32_t tmp;
1025
1026         while (j < 4 && m->addr32[j] == 0xffffffff) {
1027                 b += 32;
1028                 j++;
1029         }
1030         if (j < 4) {
1031                 tmp = ntohl(m->addr32[j]);
1032                 for (i = 31; tmp & (1 << i); --i)
1033                         b++;
1034         }
1035         return (b);
1036 }
1037
1038 #ifdef __FreeBSD__
1039 void
1040 pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp)
1041 {
1042
1043         CURVNET_SET(ifp->if_vnet);
1044         PF_LOCK();
1045         pfi_attach_ifnet(ifp);
1046 #ifdef ALTQ
1047         pf_altq_ifnet_event(ifp, 0);
1048 #endif
1049         PF_UNLOCK();
1050         CURVNET_RESTORE();
1051 }
1052
1053 void
1054 pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp)
1055 {
1056
1057         CURVNET_SET(ifp->if_vnet);
1058         PF_LOCK();
1059         pfi_detach_ifnet(ifp);
1060 #ifdef ALTQ
1061         pf_altq_ifnet_event(ifp, 1);
1062 #endif
1063         PF_UNLOCK();
1064         CURVNET_RESTORE();
1065 }
1066
1067 void
1068 pfi_attach_group_event(void *arg , struct ifg_group *ifg)
1069 {
1070
1071         CURVNET_SET((struct vnet *)arg);
1072         PF_LOCK();
1073         pfi_attach_ifgroup(ifg);
1074         PF_UNLOCK();
1075         CURVNET_RESTORE();
1076 }
1077
1078 void
1079 pfi_change_group_event(void *arg, char *gname)
1080 {
1081
1082         CURVNET_SET((struct vnet *)arg);
1083         PF_LOCK();
1084         pfi_group_change(gname);
1085         PF_UNLOCK();
1086         CURVNET_RESTORE();
1087 }
1088
1089 void
1090 pfi_detach_group_event(void *arg, struct ifg_group *ifg)
1091 {
1092
1093         CURVNET_SET((struct vnet *)arg);
1094         PF_LOCK();
1095         pfi_detach_ifgroup(ifg);
1096         PF_UNLOCK();
1097         CURVNET_RESTORE();
1098 }
1099
1100 void
1101 pfi_ifaddr_event(void *arg __unused, struct ifnet *ifp)
1102 {
1103
1104         CURVNET_SET(ifp->if_vnet);
1105         PF_LOCK();
1106         if (ifp && ifp->if_pf_kif)
1107                 pfi_kifaddr_update(ifp->if_pf_kif);
1108         PF_UNLOCK();
1109         CURVNET_RESTORE();
1110 }
1111 #endif /* __FreeBSD__ */