sys/contrib/pf/net/pf_if.c

   1 /*      $OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $ */
   2
   3 /*
   4  * Copyright 2005 Henning Brauer <henning@openbsd.org>
   5  * Copyright 2005 Ryan McBride <mcbride@openbsd.org>
   6  * Copyright (c) 2001 Daniel Hartmeier
   7  * Copyright (c) 2003 Cedric Berger
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  *    - Redistributions of source code must retain the above copyright
  15  *      notice, this list of conditions and the following disclaimer.
  16  *    - Redistributions in binary form must reproduce the above
  17  *      copyright notice, this list of conditions and the following
  18  *      disclaimer in the documentation and/or other materials provided
  19  *      with the distribution.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  29  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  31  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  32  * POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #if defined(__FreeBSD__)
  36 #include "opt_inet.h"
  37 #include "opt_inet6.h"
  38
  39 #include <sys/cdefs.h>
  40 __FBSDID("$FreeBSD$");
  41 #endif
  42
  43 #include <sys/param.h>
  44 #include <sys/systm.h>
  45 #ifdef __FreeBSD__
  46 #include <sys/malloc.h>
  47 #endif
  48 #include <sys/mbuf.h>
  49 #include <sys/filio.h>
  50 #include <sys/socket.h>
  51 #include <sys/socketvar.h>
  52 #include <sys/kernel.h>
  53 #ifndef __FreeBSD__
  54 #include <sys/device.h>
  55 #endif
  56 #include <sys/time.h>
  57 #ifndef __FreeBSD__
  58 #include <sys/pool.h>
  59 #endif
  60
  61 #include <net/if.h>
  62 #include <net/if_types.h>
  63 #ifdef __FreeBSD__
  64 #include <net/vnet.h>
  65 #endif
  66
  67 #include <netinet/in.h>
  68 #include <netinet/in_var.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/ip.h>
  71 #include <netinet/ip_var.h>
  72
  73 #include <net/pfvar.h>
  74
  75 #ifdef INET6
  76 #include <netinet/ip6.h>
  77 #endif /* INET6 */
  78
  79 #ifdef __FreeBSD__
  80 VNET_DEFINE(struct pfi_kif *,    pfi_all);
  81 VNET_DEFINE(uma_zone_t,          pfi_addr_pl);
  82 VNET_DEFINE(struct pfi_ifhead,   pfi_ifs);
  83 #define V_pfi_ifs                VNET(pfi_ifs)
  84 VNET_DEFINE(long,                pfi_update);
  85 #define V_pfi_update             VNET(pfi_update)
  86 VNET_DEFINE(struct pfr_addr *,   pfi_buffer);
  87 #define V_pfi_buffer             VNET(pfi_buffer)
  88 VNET_DEFINE(int,                 pfi_buffer_cnt);
  89 #define V_pfi_buffer_cnt         VNET(pfi_buffer_cnt)
  90 VNET_DEFINE(int,                 pfi_buffer_max);
  91 #define V_pfi_buffer_max         VNET(pfi_buffer_max)
  92 #else
  93 struct pfi_kif           *pfi_all = NULL;
  94 struct pool               pfi_addr_pl;
  95 struct pfi_ifhead         pfi_ifs;
  96 long                      pfi_update = 1;
  97 struct pfr_addr          *pfi_buffer;
  98 int                       pfi_buffer_cnt;
  99 int                       pfi_buffer_max;
 100 #endif
 101 #ifdef __FreeBSD__
 102 eventhandler_tag         pfi_attach_cookie;
 103 eventhandler_tag         pfi_detach_cookie;
 104 eventhandler_tag         pfi_attach_group_cookie;
 105 eventhandler_tag         pfi_change_group_cookie;
 106 eventhandler_tag         pfi_detach_group_cookie;
 107 eventhandler_tag         pfi_ifaddr_event_cookie;
 108 #endif
 109
 110 void             pfi_kif_update(struct pfi_kif *);
 111 void             pfi_dynaddr_update(struct pfi_dynaddr *dyn);
 112 void             pfi_table_update(struct pfr_ktable *, struct pfi_kif *,
 113                     int, int);
 114 void             pfi_kifaddr_update(void *);
 115 void             pfi_instance_add(struct ifnet *, int, int);
 116 void             pfi_address_add(struct sockaddr *, int, int);
 117 int              pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
 118 int              pfi_skip_if(const char *, struct pfi_kif *);
 119 int              pfi_unmask(void *);
 120 #ifdef __FreeBSD__
 121 void             pfi_attach_ifnet_event(void * __unused, struct ifnet *);
 122 void             pfi_detach_ifnet_event(void * __unused, struct ifnet *);
 123 void             pfi_attach_group_event(void *, struct ifg_group *);
 124 void             pfi_change_group_event(void *, char *);
 125 void             pfi_detach_group_event(void *, struct ifg_group *);
 126 void             pfi_ifaddr_event(void * __unused, struct ifnet *);
 127 #endif
 128
 129 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 130 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 131
 132 #define PFI_BUFFER_MAX          0x10000
 133 #define PFI_MTYPE               M_IFADDR
 134
 135 void
 136 pfi_initialize(void)
 137 {
 138 #ifdef __FreeBSD__
 139         if (V_pfi_all != NULL)  /* already initialized */
 140 #else
 141         if (pfi_all != NULL)    /* already initialized */
 142 #endif
 143                 return;
 144
 145 #ifndef __FreeBSD__
 146         pool_init(&V_pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0,
 147             "pfiaddrpl", &pool_allocator_nointr);
 148 #endif
 149 #ifdef __FreeBSD__
 150         V_pfi_buffer_max = 64;
 151         V_pfi_buffer = malloc(V_pfi_buffer_max * sizeof(*V_pfi_buffer),
 152             PFI_MTYPE, M_WAITOK);
 153
 154         if ((V_pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
 155 #else
 156         pfi_buffer_max = 64;
 157         pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer),
 158             PFI_MTYPE, M_WAITOK);
 159
 160         if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
 161 #endif
 162                 panic("pfi_kif_get for pfi_all failed");
 163 #ifdef __FreeBSD__
 164         struct ifg_group *ifg;
 165         struct ifnet *ifp;
 166
 167         IFNET_RLOCK();
 168         TAILQ_FOREACH(ifg, &V_ifg_head, ifg_next)
 169                 pfi_attach_ifgroup(ifg);
 170         TAILQ_FOREACH(ifp, &V_ifnet, if_link)
 171                 pfi_attach_ifnet(ifp);
 172         IFNET_RUNLOCK();
 173
 174         pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_arrival_event,
 175             pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
 176         pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_departure_event,
 177             pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
 178         pfi_attach_group_cookie = EVENTHANDLER_REGISTER(group_attach_event,
 179             pfi_attach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
 180         pfi_change_group_cookie = EVENTHANDLER_REGISTER(group_change_event,
 181             pfi_change_group_event, curvnet, EVENTHANDLER_PRI_ANY);
 182         pfi_detach_group_cookie = EVENTHANDLER_REGISTER(group_detach_event,
 183             pfi_detach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
 184         pfi_ifaddr_event_cookie = EVENTHANDLER_REGISTER(ifaddr_event,
 185             pfi_ifaddr_event, NULL, EVENTHANDLER_PRI_ANY);
 186 #endif
 187 }
 188
 189 #ifdef __FreeBSD__
 190 void
 191 pfi_cleanup(void)
 192 {
 193         struct pfi_kif *p;
 194
 195         PF_UNLOCK();
 196         EVENTHANDLER_DEREGISTER(ifnet_arrival_event, pfi_attach_cookie);
 197         EVENTHANDLER_DEREGISTER(ifnet_departure_event, pfi_detach_cookie);
 198         EVENTHANDLER_DEREGISTER(group_attach_event, pfi_attach_group_cookie);
 199         EVENTHANDLER_DEREGISTER(group_change_event, pfi_change_group_cookie);
 200         EVENTHANDLER_DEREGISTER(group_detach_event, pfi_detach_group_cookie);
 201         EVENTHANDLER_DEREGISTER(ifaddr_event, pfi_ifaddr_event_cookie);
 202         PF_LOCK();
 203
 204         V_pfi_all = NULL;
 205         while ((p = RB_MIN(pfi_ifhead, &V_pfi_ifs))) {
 206                 if (p->pfik_rules || p->pfik_states) {
 207                         printf("pfi_cleanup: dangling refs for %s\n",
 208                             p->pfik_name);
 209                 }
 210
 211                 RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p);
 212                 free(p, PFI_MTYPE);
 213         }
 214
 215         free(V_pfi_buffer, PFI_MTYPE);
 216 }
 217 #endif
 218
 219 struct pfi_kif *
 220 pfi_kif_get(const char *kif_name)
 221 {
 222         struct pfi_kif          *kif;
 223         struct pfi_kif_cmp       s;
 224
 225         bzero(&s, sizeof(s));
 226         strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name));
 227 #ifdef __FreeBSD__
 228         if ((kif = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&s)) != NULL)
 229 #else
 230         if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&s)) != NULL)
 231 #endif
 232                 return (kif);
 233
 234         /* create new one */
 235 #ifdef __FreeBSD__
 236         if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_NOWAIT | M_ZERO)) == NULL)
 237 #else
 238         if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_DONTWAIT|M_ZERO)) == NULL)
 239 #endif
 240                 return (NULL);
 241
 242         strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name));
 243 #ifdef __FreeBSD__
 244         /*
 245          * It seems that the value of time_second is in unintialzied state
 246          * when pf sets interface statistics clear time in boot phase if pf
 247          * was statically linked to kernel. Instead of setting the bogus
 248          * time value have pfi_get_ifaces handle this case. In
 249          * pfi_get_ifaces it uses boottime.tv_sec if it sees the time is 0.
 250          */
 251         kif->pfik_tzero = time_second > 1 ? time_second : 0;
 252 #else
 253         kif->pfik_tzero = time_second;
 254 #endif
 255         TAILQ_INIT(&kif->pfik_dynaddrs);
 256
 257 #ifdef __FreeBSD__
 258         RB_INSERT(pfi_ifhead, &V_pfi_ifs, kif);
 259 #else
 260         RB_INSERT(pfi_ifhead, &pfi_ifs, kif);
 261 #endif
 262
 263         return (kif);
 264 }
 265
 266 void
 267 pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what)
 268 {
 269         switch (what) {
 270         case PFI_KIF_REF_RULE:
 271                 kif->pfik_rules++;
 272                 break;
 273         case PFI_KIF_REF_STATE:
 274                 kif->pfik_states++;
 275                 break;
 276         default:
 277                 panic("pfi_kif_ref with unknown type");
 278         }
 279 }
 280
 281 void
 282 pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
 283 {
 284         if (kif == NULL)
 285                 return;
 286
 287         switch (what) {
 288         case PFI_KIF_REF_NONE:
 289                 break;
 290         case PFI_KIF_REF_RULE:
 291                 if (kif->pfik_rules <= 0) {
 292                         printf("pfi_kif_unref: rules refcount <= 0\n");
 293                         return;
 294                 }
 295                 kif->pfik_rules--;
 296                 break;
 297         case PFI_KIF_REF_STATE:
 298                 if (kif->pfik_states <= 0) {
 299                         printf("pfi_kif_unref: state refcount <= 0\n");
 300                         return;
 301                 }
 302                 kif->pfik_states--;
 303                 break;
 304         default:
 305                 panic("pfi_kif_unref with unknown type");
 306         }
 307
 308 #ifdef __FreeBSD__
 309         if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all)
 310 #else
 311         if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == pfi_all)
 312 #endif
 313                 return;
 314
 315         if (kif->pfik_rules || kif->pfik_states)
 316                 return;
 317
 318 #ifdef __FreeBSD__
 319         RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif);
 320 #else
 321         RB_REMOVE(pfi_ifhead, &pfi_ifs, kif);
 322 #endif
 323         free(kif, PFI_MTYPE);
 324 }
 325
 326 int
 327 pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
 328 {
 329         struct ifg_list *p;
 330
 331         if (rule_kif == NULL || rule_kif == packet_kif)
 332                 return (1);
 333
 334         if (rule_kif->pfik_group != NULL)
 335                 TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next)
 336                         if (p->ifgl_group == rule_kif->pfik_group)
 337                                 return (1);
 338
 339         return (0);
 340 }
 341
 342 void
 343 pfi_attach_ifnet(struct ifnet *ifp)
 344 {
 345         struct pfi_kif          *kif;
 346         int                      s;
 347
 348         pfi_initialize();
 349         s = splsoftnet();
 350 #ifdef __FreeBSD__
 351         V_pfi_update++;
 352 #else
 353         pfi_update++;
 354 #endif
 355         if ((kif = pfi_kif_get(ifp->if_xname)) == NULL)
 356                 panic("pfi_kif_get failed");
 357
 358         kif->pfik_ifp = ifp;
 359         ifp->if_pf_kif = (caddr_t)kif;
 360
 361 #ifndef __FreeBSD__
 362         if ((kif->pfik_ah_cookie = hook_establish(ifp->if_addrhooks, 1,
 363             pfi_kifaddr_update, kif)) == NULL)
 364                 panic("pfi_attach_ifnet: cannot allocate '%s' address hook",
 365                     ifp->if_xname);
 366 #endif
 367
 368         pfi_kif_update(kif);
 369
 370         splx(s);
 371 }
 372
 373 void
 374 pfi_detach_ifnet(struct ifnet *ifp)
 375 {
 376         int                      s;
 377         struct pfi_kif          *kif;
 378
 379         if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL)
 380                 return;
 381
 382         s = splsoftnet();
 383 #ifdef __FreeBSD__
 384         V_pfi_update++;
 385 #else
 386         pfi_update++;
 387 #endif
 388 #ifndef __FreeBSD__
 389         hook_disestablish(ifp->if_addrhooks, kif->pfik_ah_cookie);
 390 #endif
 391         pfi_kif_update(kif);
 392
 393         kif->pfik_ifp = NULL;
 394         ifp->if_pf_kif = NULL;
 395         pfi_kif_unref(kif, PFI_KIF_REF_NONE);
 396         splx(s);
 397 }
 398
 399 void
 400 pfi_attach_ifgroup(struct ifg_group *ifg)
 401 {
 402         struct pfi_kif  *kif;
 403         int              s;
 404
 405         pfi_initialize();
 406         s = splsoftnet();
 407 #ifdef __FreeBSD__
 408         V_pfi_update++;
 409 #else
 410         pfi_update++;
 411 #endif
 412         if ((kif = pfi_kif_get(ifg->ifg_group)) == NULL)
 413                 panic("pfi_kif_get failed");
 414
 415         kif->pfik_group = ifg;
 416         ifg->ifg_pf_kif = (caddr_t)kif;
 417
 418         splx(s);
 419 }
 420
 421 void
 422 pfi_detach_ifgroup(struct ifg_group *ifg)
 423 {
 424         int              s;
 425         struct pfi_kif  *kif;
 426
 427         if ((kif = (struct pfi_kif *)ifg->ifg_pf_kif) == NULL)
 428                 return;
 429
 430         s = splsoftnet();
 431 #ifdef __FreeBSD__
 432         V_pfi_update++;
 433 #else
 434         pfi_update++;
 435 #endif
 436
 437         kif->pfik_group = NULL;
 438         ifg->ifg_pf_kif = NULL;
 439         pfi_kif_unref(kif, PFI_KIF_REF_NONE);
 440         splx(s);
 441 }
 442
 443 void
 444 pfi_group_change(const char *group)
 445 {
 446         struct pfi_kif          *kif;
 447         int                      s;
 448
 449         s = splsoftnet();
 450 #ifdef __FreeBSD__
 451         V_pfi_update++;
 452 #else
 453         pfi_update++;
 454 #endif
 455         if ((kif = pfi_kif_get(group)) == NULL)
 456                 panic("pfi_kif_get failed");
 457
 458         pfi_kif_update(kif);
 459
 460         splx(s);
 461 }
 462
 463 int
 464 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
 465 {
 466         switch (af) {
 467 #ifdef INET
 468         case AF_INET:
 469                 switch (dyn->pfid_acnt4) {
 470                 case 0:
 471                         return (0);
 472                 case 1:
 473                         return (PF_MATCHA(0, &dyn->pfid_addr4,
 474                             &dyn->pfid_mask4, a, AF_INET));
 475                 default:
 476                         return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
 477                 }
 478                 break;
 479 #endif /* INET */
 480 #ifdef INET6
 481         case AF_INET6:
 482                 switch (dyn->pfid_acnt6) {
 483                 case 0:
 484                         return (0);
 485                 case 1:
 486                         return (PF_MATCHA(0, &dyn->pfid_addr6,
 487                             &dyn->pfid_mask6, a, AF_INET6));
 488                 default:
 489                         return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
 490                 }
 491                 break;
 492 #endif /* INET6 */
 493         default:
 494                 return (0);
 495         }
 496 }
 497
 498 int
 499 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
 500 {
 501         struct pfi_dynaddr      *dyn;
 502         char                     tblname[PF_TABLE_NAME_SIZE];
 503         struct pf_ruleset       *ruleset = NULL;
 504         int                      s, rv = 0;
 505
 506         if (aw->type != PF_ADDR_DYNIFTL)
 507                 return (0);
 508 #ifdef __FreeBSD__
 509         if ((dyn = pool_get(&V_pfi_addr_pl, PR_NOWAIT | PR_ZERO))
 510 #else
 511         if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK | PR_LIMITFAIL | PR_ZERO))
 512 #endif
 513             == NULL)
 514                 return (1);
 515
 516         s = splsoftnet();
 517         if (!strcmp(aw->v.ifname, "self"))
 518                 dyn->pfid_kif = pfi_kif_get(IFG_ALL);
 519         else
 520                 dyn->pfid_kif = pfi_kif_get(aw->v.ifname);
 521         if (dyn->pfid_kif == NULL) {
 522                 rv = 1;
 523                 goto _bad;
 524         }
 525         pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE);
 526
 527         dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
 528         if (af == AF_INET && dyn->pfid_net == 32)
 529                 dyn->pfid_net = 128;
 530         strlcpy(tblname, aw->v.ifname, sizeof(tblname));
 531         if (aw->iflags & PFI_AFLAG_NETWORK)
 532                 strlcat(tblname, ":network", sizeof(tblname));
 533         if (aw->iflags & PFI_AFLAG_BROADCAST)
 534                 strlcat(tblname, ":broadcast", sizeof(tblname));
 535         if (aw->iflags & PFI_AFLAG_PEER)
 536                 strlcat(tblname, ":peer", sizeof(tblname));
 537         if (aw->iflags & PFI_AFLAG_NOALIAS)
 538                 strlcat(tblname, ":0", sizeof(tblname));
 539         if (dyn->pfid_net != 128)
 540                 snprintf(tblname + strlen(tblname),
 541                     sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
 542         if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
 543                 rv = 1;
 544                 goto _bad;
 545         }
 546
 547         if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname, 1)) == NULL) {
 548                 rv = 1;
 549                 goto _bad;
 550         }
 551
 552         dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE;
 553         dyn->pfid_iflags = aw->iflags;
 554         dyn->pfid_af = af;
 555
 556         TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
 557         aw->p.dyn = dyn;
 558         pfi_kif_update(dyn->pfid_kif);
 559         splx(s);
 560         return (0);
 561
 562 _bad:
 563         if (dyn->pfid_kt != NULL)
 564                 pfr_detach_table(dyn->pfid_kt);
 565         if (ruleset != NULL)
 566                 pf_remove_if_empty_ruleset(ruleset);
 567         if (dyn->pfid_kif != NULL)
 568                 pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE);
 569 #ifdef __FreeBSD__
 570         pool_put(&V_pfi_addr_pl, dyn);
 571 #else
 572         pool_put(&pfi_addr_pl, dyn);
 573 #endif
 574         splx(s);
 575         return (rv);
 576 }
 577
 578 void
 579 pfi_kif_update(struct pfi_kif *kif)
 580 {
 581         struct ifg_list         *ifgl;
 582         struct pfi_dynaddr      *p;
 583
 584         /* update all dynaddr */
 585         TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
 586                 pfi_dynaddr_update(p);
 587
 588         /* again for all groups kif is member of */
 589         if (kif->pfik_ifp != NULL)
 590                 TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)
 591                         pfi_kif_update((struct pfi_kif *)
 592                             ifgl->ifgl_group->ifg_pf_kif);
 593 }
 594
 595 void
 596 pfi_dynaddr_update(struct pfi_dynaddr *dyn)
 597 {
 598         struct pfi_kif          *kif;
 599         struct pfr_ktable       *kt;
 600
 601         if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL)
 602                 panic("pfi_dynaddr_update");
 603
 604         kif = dyn->pfid_kif;
 605         kt = dyn->pfid_kt;
 606
 607 #ifdef __FreeBSD__
 608         if (kt->pfrkt_larg != V_pfi_update) {
 609 #else
 610         if (kt->pfrkt_larg != pfi_update) {
 611 #endif
 612                 /* this table needs to be brought up-to-date */
 613                 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags);
 614 #ifdef __FreeBSD__
 615                 kt->pfrkt_larg = V_pfi_update;
 616 #else
 617                 kt->pfrkt_larg = pfi_update;
 618 #endif
 619         }
 620         pfr_dynaddr_update(kt, dyn);
 621 }
 622
 623 void
 624 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
 625 {
 626         int                      e, size2 = 0;
 627         struct ifg_member       *ifgm;
 628
 629 #ifdef __FreeBSD__
 630         V_pfi_buffer_cnt = 0;
 631 #else
 632         pfi_buffer_cnt = 0;
 633 #endif
 634
 635         if (kif->pfik_ifp != NULL)
 636                 pfi_instance_add(kif->pfik_ifp, net, flags);
 637         else if (kif->pfik_group != NULL)
 638                 TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next)
 639                         pfi_instance_add(ifgm->ifgm_ifp, net, flags);
 640
 641 #ifdef __FreeBSD__
 642         if ((e = pfr_set_addrs(&kt->pfrkt_t, V_pfi_buffer, V_pfi_buffer_cnt, &size2,
 643             NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
 644                 printf("pfi_table_update: cannot set %d new addresses "
 645                     "into table %s: %d\n", V_pfi_buffer_cnt, kt->pfrkt_name, e);
 646 #else
 647         if ((e = pfr_set_addrs(&kt->pfrkt_t, pfi_buffer, pfi_buffer_cnt, &size2,
 648             NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
 649                 printf("pfi_table_update: cannot set %d new addresses "
 650                     "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);
 651 #endif
 652 }
 653
 654 void
 655 pfi_instance_add(struct ifnet *ifp, int net, int flags)
 656 {
 657         struct ifaddr   *ia;
 658         int              got4 = 0, got6 = 0;
 659         int              net2, af;
 660
 661         if (ifp == NULL)
 662                 return;
 663         TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) {
 664                 if (ia->ifa_addr == NULL)
 665                         continue;
 666                 af = ia->ifa_addr->sa_family;
 667                 if (af != AF_INET && af != AF_INET6)
 668                         continue;
 669 #ifdef __FreeBSD__
 670                 /*
 671                  * XXX: For point-to-point interfaces, (ifname:0) and IPv4,
 672                  *      jump over addresses without a proper route to work
 673                  *      around a problem with ppp not fully removing the
 674                  *      address used during IPCP.
 675                  */
 676                 if ((ifp->if_flags & IFF_POINTOPOINT) &&
 677                     !(ia->ifa_flags & IFA_ROUTE) &&
 678                     (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET))
 679                         continue;
 680 #endif
 681                 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6)
 682                         continue;
 683                 if ((flags & PFI_AFLAG_BROADCAST) &&
 684                     !(ifp->if_flags & IFF_BROADCAST))
 685                         continue;
 686                 if ((flags & PFI_AFLAG_PEER) &&
 687                     !(ifp->if_flags & IFF_POINTOPOINT))
 688                         continue;
 689                 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
 690                     IN6_IS_ADDR_LINKLOCAL(
 691                     &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
 692                         continue;
 693                 if (flags & PFI_AFLAG_NOALIAS) {
 694                         if (af == AF_INET && got4)
 695                                 continue;
 696                         if (af == AF_INET6 && got6)
 697                                 continue;
 698                 }
 699                 if (af == AF_INET)
 700                         got4 = 1;
 701                 else if (af == AF_INET6)
 702                         got6 = 1;
 703                 net2 = net;
 704                 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
 705                         if (af == AF_INET)
 706                                 net2 = pfi_unmask(&((struct sockaddr_in *)
 707                                     ia->ifa_netmask)->sin_addr);
 708                         else if (af == AF_INET6)
 709                                 net2 = pfi_unmask(&((struct sockaddr_in6 *)
 710                                     ia->ifa_netmask)->sin6_addr);
 711                 }
 712                 if (af == AF_INET && net2 > 32)
 713                         net2 = 32;
 714                 if (flags & PFI_AFLAG_BROADCAST)
 715                         pfi_address_add(ia->ifa_broadaddr, af, net2);
 716                 else if (flags & PFI_AFLAG_PEER)
 717                         pfi_address_add(ia->ifa_dstaddr, af, net2);
 718                 else
 719                         pfi_address_add(ia->ifa_addr, af, net2);
 720         }
 721 }
 722
 723 void
 724 pfi_address_add(struct sockaddr *sa, int af, int net)
 725 {
 726         struct pfr_addr *p;
 727         int              i;
 728
 729 #ifdef __FreeBSD__
 730         if (V_pfi_buffer_cnt >= V_pfi_buffer_max) {
 731                 int              new_max = V_pfi_buffer_max * 2;
 732 #else
 733         if (pfi_buffer_cnt >= pfi_buffer_max) {
 734                 int              new_max = pfi_buffer_max * 2;
 735 #endif
 736
 737                 if (new_max > PFI_BUFFER_MAX) {
 738                         printf("pfi_address_add: address buffer full (%d/%d)\n",
 739 #ifdef __FreeBSD__
 740                             V_pfi_buffer_cnt, PFI_BUFFER_MAX);
 741 #else
 742                             pfi_buffer_cnt, PFI_BUFFER_MAX);
 743 #endif
 744                         return;
 745                 }
 746                 p = malloc(new_max * sizeof(*V_pfi_buffer), PFI_MTYPE,
 747 #ifdef __FreeBSD__
 748                     M_NOWAIT);
 749 #else
 750                     M_DONTWAIT);
 751 #endif
 752                 if (p == NULL) {
 753                         printf("pfi_address_add: no memory to grow buffer "
 754 #ifdef __FreeBSD__
 755                             "(%d/%d)\n", V_pfi_buffer_cnt, PFI_BUFFER_MAX);
 756 #else
 757                             "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
 758 #endif
 759                         return;
 760                 }
 761 #ifdef __FreeBSD__
 762                 memcpy(V_pfi_buffer, p, V_pfi_buffer_cnt * sizeof(*V_pfi_buffer));
 763                 /* no need to zero buffer */
 764                 free(V_pfi_buffer, PFI_MTYPE);
 765                 V_pfi_buffer = p;
 766                 V_pfi_buffer_max = new_max;
 767 #else
 768                 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer));
 769                 /* no need to zero buffer */
 770                 free(pfi_buffer, PFI_MTYPE);
 771                 pfi_buffer = p;
 772                 pfi_buffer_max = new_max;
 773 #endif
 774         }
 775         if (af == AF_INET && net > 32)
 776                 net = 128;
 777 #ifdef __FreeBSD__
 778         p = V_pfi_buffer + V_pfi_buffer_cnt++;
 779 #else
 780         p = pfi_buffer + pfi_buffer_cnt++;
 781 #endif
 782         bzero(p, sizeof(*p));
 783         p->pfra_af = af;
 784         p->pfra_net = net;
 785         if (af == AF_INET)
 786                 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr;
 787         else if (af == AF_INET6) {
 788                 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr;
 789                 if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr))
 790                         p->pfra_ip6addr.s6_addr16[1] = 0;
 791         }
 792         /* mask network address bits */
 793         if (net < 128)
 794                 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
 795         for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++)
 796                 ((caddr_t)p)[i] = 0;
 797 }
 798
 799 void
 800 pfi_dynaddr_remove(struct pf_addr_wrap *aw)
 801 {
 802         int     s;
 803
 804         if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 805             aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL)
 806                 return;
 807
 808         s = splsoftnet();
 809         TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry);
 810         pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE);
 811         aw->p.dyn->pfid_kif = NULL;
 812         pfr_detach_table(aw->p.dyn->pfid_kt);
 813         aw->p.dyn->pfid_kt = NULL;
 814 #ifdef __FreeBSD__
 815         pool_put(&V_pfi_addr_pl, aw->p.dyn);
 816 #else
 817         pool_put(&pfi_addr_pl, aw->p.dyn);
 818 #endif
 819         aw->p.dyn = NULL;
 820         splx(s);
 821 }
 822
 823 void
 824 pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
 825 {
 826         if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 827             aw->p.dyn->pfid_kif == NULL)
 828                 return;
 829         aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
 830 }
 831
 832 void
 833 pfi_kifaddr_update(void *v)
 834 {
 835         int                      s;
 836         struct pfi_kif          *kif = (struct pfi_kif *)v;
 837
 838         s = splsoftnet();
 839 #ifdef __FreeBSD__
 840         V_pfi_update++;
 841 #else
 842         pfi_update++;
 843 #endif
 844         pfi_kif_update(kif);
 845         splx(s);
 846 }
 847
 848 int
 849 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
 850 {
 851         return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
 852 }
 853
 854 void
 855 pfi_update_status(const char *name, struct pf_status *pfs)
 856 {
 857         struct pfi_kif          *p;
 858         struct pfi_kif_cmp       key;
 859         struct ifg_member        p_member, *ifgm;
 860         TAILQ_HEAD(, ifg_member) ifg_members;
 861         int                      i, j, k, s;
 862
 863         strlcpy(key.pfik_name, name, sizeof(key.pfik_name));
 864         s = splsoftnet();
 865 #ifdef __FreeBSD__
 866         p = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&key);
 867 #else
 868         p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&key);
 869 #endif
 870         if (p == NULL) {
 871                 splx(s);
 872                 return;
 873         }
 874         if (p->pfik_group != NULL) {
 875                 bcopy(&p->pfik_group->ifg_members, &ifg_members,
 876                     sizeof(ifg_members));
 877         } else {
 878                 /* build a temporary list for p only */
 879                 bzero(&p_member, sizeof(p_member));
 880                 p_member.ifgm_ifp = p->pfik_ifp;
 881                 TAILQ_INIT(&ifg_members);
 882                 TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next);
 883         }
 884         if (pfs) {
 885                 bzero(pfs->pcounters, sizeof(pfs->pcounters));
 886                 bzero(pfs->bcounters, sizeof(pfs->bcounters));
 887         }
 888         TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) {
 889                 if (ifgm->ifgm_ifp == NULL)
 890                         continue;
 891                 p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif;
 892
 893                 /* just clear statistics */
 894                 if (pfs == NULL) {
 895                         bzero(p->pfik_packets, sizeof(p->pfik_packets));
 896                         bzero(p->pfik_bytes, sizeof(p->pfik_bytes));
 897                         p->pfik_tzero = time_second;
 898                         continue;
 899                 }
 900                 for (i = 0; i < 2; i++)
 901                         for (j = 0; j < 2; j++)
 902                                 for (k = 0; k < 2; k++) {
 903                                         pfs->pcounters[i][j][k] +=
 904                                                 p->pfik_packets[i][j][k];
 905                                         pfs->bcounters[i][j] +=
 906                                                 p->pfik_bytes[i][j][k];
 907                                 }
 908         }
 909         splx(s);
 910 }
 911
 912 int
 913 pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size)
 914 {
 915         struct pfi_kif  *p, *nextp;
 916         int              s, n = 0;
 917 #ifdef __FreeBSD__
 918         int              error;
 919 #endif
 920
 921         s = splsoftnet();
 922 #ifdef __FreeBSD__
 923         for (p = RB_MIN(pfi_ifhead, &V_pfi_ifs); p; p = nextp) {
 924                 nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
 925 #else
 926         for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) {
 927                 nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
 928 #endif
 929                 if (pfi_skip_if(name, p))
 930                         continue;
 931                 if (*size > n++) {
 932                         if (!p->pfik_tzero)
 933                                 p->pfik_tzero = time_second;
 934                         pfi_kif_ref(p, PFI_KIF_REF_RULE);
 935 #ifdef __FreeBSD__
 936                         PF_COPYOUT(p, buf++, sizeof(*buf), error);
 937                         if (error) {
 938 #else
 939                         if (copyout(p, buf++, sizeof(*buf))) {
 940 #endif
 941                                 pfi_kif_unref(p, PFI_KIF_REF_RULE);
 942                                 splx(s);
 943                                 return (EFAULT);
 944                         }
 945 #ifdef __FreeBSD__
 946                         nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
 947 #else
 948                         nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
 949 #endif
 950                         pfi_kif_unref(p, PFI_KIF_REF_RULE);
 951                 }
 952         }
 953         splx(s);
 954         *size = n;
 955         return (0);
 956 }
 957
 958 int
 959 pfi_skip_if(const char *filter, struct pfi_kif *p)
 960 {
 961         int     n;
 962
 963         if (filter == NULL || !*filter)
 964                 return (0);
 965         if (!strcmp(p->pfik_name, filter))
 966                 return (0);     /* exact match */
 967         n = strlen(filter);
 968         if (n < 1 || n >= IFNAMSIZ)
 969                 return (1);     /* sanity check */
 970         if (filter[n-1] >= '0' && filter[n-1] <= '9')
 971                 return (1);     /* only do exact match in that case */
 972         if (strncmp(p->pfik_name, filter, n))
 973                 return (1);     /* prefix doesn't match */
 974         return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
 975 }
 976
 977 int
 978 pfi_set_flags(const char *name, int flags)
 979 {
 980         struct pfi_kif  *p;
 981         int              s;
 982
 983         s = splsoftnet();
 984 #ifdef __FreeBSD__
 985         RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
 986 #else
 987         RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
 988 #endif
 989                 if (pfi_skip_if(name, p))
 990                         continue;
 991                 p->pfik_flags |= flags;
 992         }
 993         splx(s);
 994         return (0);
 995 }
 996
 997 int
 998 pfi_clear_flags(const char *name, int flags)
 999 {
1000         struct pfi_kif  *p;
1001         int              s;
1002
1003         s = splsoftnet();
1004 #ifdef __FreeBSD__
1005         RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
1006 #else
1007         RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
1008 #endif
1009                 if (pfi_skip_if(name, p))
1010                         continue;
1011                 p->pfik_flags &= ~flags;
1012         }
1013         splx(s);
1014         return (0);
1015 }
1016
1017 /* from pf_print_state.c */
1018 int
1019 pfi_unmask(void *addr)
1020 {
1021         struct pf_addr *m = addr;
1022         int i = 31, j = 0, b = 0;
1023         u_int32_t tmp;
1024
1025         while (j < 4 && m->addr32[j] == 0xffffffff) {
1026                 b += 32;
1027                 j++;
1028         }
1029         if (j < 4) {
1030                 tmp = ntohl(m->addr32[j]);
1031                 for (i = 31; tmp & (1 << i); --i)
1032                         b++;
1033         }
1034         return (b);
1035 }
1036
1037 #ifdef __FreeBSD__
1038 void
1039 pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp)
1040 {
1041
1042         CURVNET_SET(ifp->if_vnet);
1043         PF_LOCK();
1044         pfi_attach_ifnet(ifp);
1045 #ifdef ALTQ
1046         pf_altq_ifnet_event(ifp, 0);
1047 #endif
1048         PF_UNLOCK();
1049         CURVNET_RESTORE();
1050 }
1051
1052 void
1053 pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp)
1054 {
1055
1056         CURVNET_SET(ifp->if_vnet);
1057         PF_LOCK();
1058         pfi_detach_ifnet(ifp);
1059 #ifdef ALTQ
1060         pf_altq_ifnet_event(ifp, 1);
1061 #endif
1062         PF_UNLOCK();
1063         CURVNET_RESTORE();
1064 }
1065
1066 void
1067 pfi_attach_group_event(void *arg , struct ifg_group *ifg)
1068 {
1069
1070         CURVNET_SET((struct vnet *)arg);
1071         PF_LOCK();
1072         pfi_attach_ifgroup(ifg);
1073         PF_UNLOCK();
1074         CURVNET_RESTORE();
1075 }
1076
1077 void
1078 pfi_change_group_event(void *arg, char *gname)
1079 {
1080
1081         CURVNET_SET((struct vnet *)arg);
1082         PF_LOCK();
1083         pfi_group_change(gname);
1084         PF_UNLOCK();
1085         CURVNET_RESTORE();
1086 }
1087
1088 void
1089 pfi_detach_group_event(void *arg, struct ifg_group *ifg)
1090 {
1091
1092         CURVNET_SET((struct vnet *)arg);
1093         PF_LOCK();
1094         pfi_detach_ifgroup(ifg);
1095         PF_UNLOCK();
1096         CURVNET_RESTORE();
1097 }
1098
1099 void
1100 pfi_ifaddr_event(void *arg __unused, struct ifnet *ifp)
1101 {
1102
1103         CURVNET_SET(ifp->if_vnet);
1104         PF_LOCK();
1105         if (ifp && ifp->if_pf_kif)
1106                 pfi_kifaddr_update(ifp->if_pf_kif);
1107         PF_UNLOCK();
1108         CURVNET_RESTORE();
1109 }
1110 #endif /* __FreeBSD__ */