![[BACK]](/icons/back.gif){kind=icon}
Return to pf_ioctl.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net|
Return to pf_ioctl.c CVS log | Up to [local] / sys / net |
1.1 ! nbrk 1: /* $OpenBSD: pf_ioctl.c,v 1.182 2007/06/24 11:17:13 mcbride Exp $ */
! 2:
! 3: /*
! 4: * Copyright (c) 2001 Daniel Hartmeier
! 5: * Copyright (c) 2002,2003 Henning Brauer
! 6: * All rights reserved.
! 7: *
! 8: * Redistribution and use in source and binary forms, with or without
! 9: * modification, are permitted provided that the following conditions
! 10: * are met:
! 11: *
! 12: * - Redistributions of source code must retain the above copyright
! 13: * notice, this list of conditions and the following disclaimer.
! 14: * - Redistributions in binary form must reproduce the above
! 15: * copyright notice, this list of conditions and the following
! 16: * disclaimer in the documentation and/or other materials provided
! 17: * with the distribution.
! 18: *
! 19: * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
! 20: * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
! 21: * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
! 22: * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
! 23: * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
! 24: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
! 25: * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
! 26: * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
! 27: * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
! 28: * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
! 29: * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
! 30: * POSSIBILITY OF SUCH DAMAGE.
! 31: *
! 32: * Effort sponsored in part by the Defense Advanced Research Projects
! 33: * Agency (DARPA) and Air Force Research Laboratory, Air Force
! 34: * Materiel Command, USAF, under agreement number F30602-01-2-0537.
! 35: *
! 36: */
! 37:
! 38: #include "pfsync.h"
! 39:
! 40: #include <sys/param.h>
! 41: #include <sys/systm.h>
! 42: #include <sys/mbuf.h>
! 43: #include <sys/filio.h>
! 44: #include <sys/fcntl.h>
! 45: #include <sys/socket.h>
! 46: #include <sys/socketvar.h>
! 47: #include <sys/kernel.h>
! 48: #include <sys/time.h>
! 49: #include <sys/timeout.h>
! 50: #include <sys/pool.h>
! 51: #include <sys/proc.h>
! 52: #include <sys/malloc.h>
! 53: #include <sys/kthread.h>
! 54: #include <sys/rwlock.h>
! 55: #include <uvm/uvm_extern.h>
! 56:
! 57: #include <net/if.h>
! 58: #include <net/if_types.h>
! 59: #include <net/route.h>
! 60:
! 61: #include <netinet/in.h>
! 62: #include <netinet/in_var.h>
! 63: #include <netinet/in_systm.h>
! 64: #include <netinet/ip.h>
! 65: #include <netinet/ip_var.h>
! 66: #include <netinet/ip_icmp.h>
! 67:
! 68: #include <dev/rndvar.h>
! 69: #include <crypto/md5.h>
! 70: #include <net/pfvar.h>
! 71:
! 72: #if NPFSYNC > 0
! 73: #include <net/if_pfsync.h>
! 74: #endif /* NPFSYNC > 0 */
! 75:
! 76: #if NPFLOG > 0
! 77: #include <net/if_pflog.h>
! 78: #endif /* NPFLOG > 0 */
! 79:
! 80: #ifdef INET6
! 81: #include <netinet/ip6.h>
! 82: #include <netinet/in_pcb.h>
! 83: #endif /* INET6 */
! 84:
! 85: #ifdef ALTQ
! 86: #include <altq/altq.h>
! 87: #endif
! 88:
! 89: void pfattach(int);
! 90: void pf_thread_create(void *);
! 91: int pfopen(dev_t, int, int, struct proc *);
! 92: int pfclose(dev_t, int, int, struct proc *);
! 93: struct pf_pool *pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
! 94: u_int8_t, u_int8_t, u_int8_t);
! 95:
! 96: void pf_mv_pool(struct pf_palist *, struct pf_palist *);
! 97: void pf_empty_pool(struct pf_palist *);
! 98: int pfioctl(dev_t, u_long, caddr_t, int, struct proc *);
! 99: #ifdef ALTQ
! 100: int pf_begin_altq(u_int32_t *);
! 101: int pf_rollback_altq(u_int32_t);
! 102: int pf_commit_altq(u_int32_t);
! 103: int pf_enable_altq(struct pf_altq *);
! 104: int pf_disable_altq(struct pf_altq *);
! 105: #endif /* ALTQ */
! 106: int pf_begin_rules(u_int32_t *, int, const char *);
! 107: int pf_rollback_rules(u_int32_t, int, char *);
! 108: int pf_setup_pfsync_matching(struct pf_ruleset *);
! 109: void pf_hash_rule(MD5_CTX *, struct pf_rule *);
! 110: void pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
! 111: int pf_commit_rules(u_int32_t, int, char *);
! 112: void pf_state_export(struct pfsync_state *,
! 113: struct pf_state_key *, struct pf_state *);
! 114: void pf_state_import(struct pfsync_state *,
! 115: struct pf_state_key *, struct pf_state *);
! 116:
! 117: struct pf_rule pf_default_rule;
! 118: struct rwlock pf_consistency_lock = RWLOCK_INITIALIZER("pfcnslk");
! 119: #ifdef ALTQ
! 120: static int pf_altq_running;
! 121: #endif
! 122:
! 123: #define TAGID_MAX 50000
! 124: TAILQ_HEAD(pf_tags, pf_tagname) pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags),
! 125: pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids);
! 126:
! 127: #if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
! 128: #error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
! 129: #endif
! 130: u_int16_t tagname2tag(struct pf_tags *, char *);
! 131: void tag2tagname(struct pf_tags *, u_int16_t, char *);
! 132: void tag_unref(struct pf_tags *, u_int16_t);
! 133: int pf_rtlabel_add(struct pf_addr_wrap *);
! 134: void pf_rtlabel_remove(struct pf_addr_wrap *);
! 135: void pf_rtlabel_copyout(struct pf_addr_wrap *);
! 136:
! 137: #define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x
! 138:
! 139: void
! 140: pfattach(int num)
! 141: {
! 142: u_int32_t *timeout = pf_default_rule.timeout;
! 143:
! 144: pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl",
! 145: &pool_allocator_nointr);
! 146: pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0,
! 147: "pfsrctrpl", NULL);
! 148: pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl",
! 149: NULL);
! 150: pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0,
! 151: "pfstatekeypl", NULL);
! 152: pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl",
! 153: &pool_allocator_nointr);
! 154: pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0,
! 155: "pfpooladdrpl", &pool_allocator_nointr);
! 156: pfr_initialize();
! 157: pfi_initialize();
! 158: pf_osfp_initialize();
! 159:
! 160: pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp,
! 161: pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0);
! 162:
! 163: if (ctob(physmem) <= 100*1024*1024)
! 164: pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit =
! 165: PFR_KENTRY_HIWAT_SMALL;
! 166:
! 167: RB_INIT(&tree_src_tracking);
! 168: RB_INIT(&pf_anchors);
! 169: pf_init_ruleset(&pf_main_ruleset);
! 170: TAILQ_INIT(&pf_altqs[0]);
! 171: TAILQ_INIT(&pf_altqs[1]);
! 172: TAILQ_INIT(&pf_pabuf);
! 173: pf_altqs_active = &pf_altqs[0];
! 174: pf_altqs_inactive = &pf_altqs[1];
! 175: TAILQ_INIT(&state_list);
! 176:
! 177: /* default rule should never be garbage collected */
! 178: pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next;
! 179: pf_default_rule.action = PF_PASS;
! 180: pf_default_rule.nr = -1;
! 181: pf_default_rule.rtableid = -1;
! 182:
! 183: /* initialize default timeouts */
! 184: timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
! 185: timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
! 186: timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
! 187: timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
! 188: timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
! 189: timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
! 190: timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
! 191: timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
! 192: timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
! 193: timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
! 194: timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
! 195: timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
! 196: timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
! 197: timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
! 198: timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
! 199: timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
! 200: timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
! 201: timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
! 202: timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
! 203: timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
! 204:
! 205: pf_normalize_init();
! 206: bzero(&pf_status, sizeof(pf_status));
! 207: pf_status.debug = PF_DEBUG_URGENT;
! 208:
! 209: /* XXX do our best to avoid a conflict */
! 210: pf_status.hostid = arc4random();
! 211:
! 212: /* require process context to purge states, so perform in a thread */
! 213: kthread_create_deferred(pf_thread_create, NULL);
! 214: }
! 215:
! 216: void
! 217: pf_thread_create(void *v)
! 218: {
! 219: if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge"))
! 220: panic("pfpurge thread");
! 221: }
! 222:
! 223: int
! 224: pfopen(dev_t dev, int flags, int fmt, struct proc *p)
! 225: {
! 226: if (minor(dev) >= 1)
! 227: return (ENXIO);
! 228: return (0);
! 229: }
! 230:
! 231: int
! 232: pfclose(dev_t dev, int flags, int fmt, struct proc *p)
! 233: {
! 234: if (minor(dev) >= 1)
! 235: return (ENXIO);
! 236: return (0);
! 237: }
! 238:
! 239: struct pf_pool *
! 240: pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
! 241: u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
! 242: u_int8_t check_ticket)
! 243: {
! 244: struct pf_ruleset *ruleset;
! 245: struct pf_rule *rule;
! 246: int rs_num;
! 247:
! 248: ruleset = pf_find_ruleset(anchor);
! 249: if (ruleset == NULL)
! 250: return (NULL);
! 251: rs_num = pf_get_ruleset_number(rule_action);
! 252: if (rs_num >= PF_RULESET_MAX)
! 253: return (NULL);
! 254: if (active) {
! 255: if (check_ticket && ticket !=
! 256: ruleset->rules[rs_num].active.ticket)
! 257: return (NULL);
! 258: if (r_last)
! 259: rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
! 260: pf_rulequeue);
! 261: else
! 262: rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
! 263: } else {
! 264: if (check_ticket && ticket !=
! 265: ruleset->rules[rs_num].inactive.ticket)
! 266: return (NULL);
! 267: if (r_last)
! 268: rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
! 269: pf_rulequeue);
! 270: else
! 271: rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
! 272: }
! 273: if (!r_last) {
! 274: while ((rule != NULL) && (rule->nr != rule_number))
! 275: rule = TAILQ_NEXT(rule, entries);
! 276: }
! 277: if (rule == NULL)
! 278: return (NULL);
! 279:
! 280: return (&rule->rpool);
! 281: }
! 282:
! 283: void
! 284: pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb)
! 285: {
! 286: struct pf_pooladdr *mv_pool_pa;
! 287:
! 288: while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
! 289: TAILQ_REMOVE(poola, mv_pool_pa, entries);
! 290: TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
! 291: }
! 292: }
! 293:
! 294: void
! 295: pf_empty_pool(struct pf_palist *poola)
! 296: {
! 297: struct pf_pooladdr *empty_pool_pa;
! 298:
! 299: while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) {
! 300: pfi_dynaddr_remove(&empty_pool_pa->addr);
! 301: pf_tbladdr_remove(&empty_pool_pa->addr);
! 302: pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE);
! 303: TAILQ_REMOVE(poola, empty_pool_pa, entries);
! 304: pool_put(&pf_pooladdr_pl, empty_pool_pa);
! 305: }
! 306: }
! 307:
! 308: void
! 309: pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
! 310: {
! 311: if (rulequeue != NULL) {
! 312: if (rule->states <= 0) {
! 313: /*
! 314: * XXX - we need to remove the table *before* detaching
! 315: * the rule to make sure the table code does not delete
! 316: * the anchor under our feet.
! 317: */
! 318: pf_tbladdr_remove(&rule->src.addr);
! 319: pf_tbladdr_remove(&rule->dst.addr);
! 320: if (rule->overload_tbl)
! 321: pfr_detach_table(rule->overload_tbl);
! 322: }
! 323: TAILQ_REMOVE(rulequeue, rule, entries);
! 324: rule->entries.tqe_prev = NULL;
! 325: rule->nr = -1;
! 326: }
! 327:
! 328: if (rule->states > 0 || rule->src_nodes > 0 ||
! 329: rule->entries.tqe_prev != NULL)
! 330: return;
! 331: pf_tag_unref(rule->tag);
! 332: pf_tag_unref(rule->match_tag);
! 333: #ifdef ALTQ
! 334: if (rule->pqid != rule->qid)
! 335: pf_qid_unref(rule->pqid);
! 336: pf_qid_unref(rule->qid);
! 337: #endif
! 338: pf_rtlabel_remove(&rule->src.addr);
! 339: pf_rtlabel_remove(&rule->dst.addr);
! 340: pfi_dynaddr_remove(&rule->src.addr);
! 341: pfi_dynaddr_remove(&rule->dst.addr);
! 342: if (rulequeue == NULL) {
! 343: pf_tbladdr_remove(&rule->src.addr);
! 344: pf_tbladdr_remove(&rule->dst.addr);
! 345: if (rule->overload_tbl)
! 346: pfr_detach_table(rule->overload_tbl);
! 347: }
! 348: pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE);
! 349: pf_anchor_remove(rule);
! 350: pf_empty_pool(&rule->rpool.list);
! 351: pool_put(&pf_rule_pl, rule);
! 352: }
! 353:
! 354: u_int16_t
! 355: tagname2tag(struct pf_tags *head, char *tagname)
! 356: {
! 357: struct pf_tagname *tag, *p = NULL;
! 358: u_int16_t new_tagid = 1;
! 359:
! 360: TAILQ_FOREACH(tag, head, entries)
! 361: if (strcmp(tagname, tag->name) == 0) {
! 362: tag->ref++;
! 363: return (tag->tag);
! 364: }
! 365:
! 366: /*
! 367: * to avoid fragmentation, we do a linear search from the beginning
! 368: * and take the first free slot we find. if there is none or the list
! 369: * is empty, append a new entry at the end.
! 370: */
! 371:
! 372: /* new entry */
! 373: if (!TAILQ_EMPTY(head))
! 374: for (p = TAILQ_FIRST(head); p != NULL &&
! 375: p->tag == new_tagid; p = TAILQ_NEXT(p, entries))
! 376: new_tagid = p->tag + 1;
! 377:
! 378: if (new_tagid > TAGID_MAX)
! 379: return (0);
! 380:
! 381: /* allocate and fill new struct pf_tagname */
! 382: tag = (struct pf_tagname *)malloc(sizeof(struct pf_tagname),
! 383: M_TEMP, M_NOWAIT);
! 384: if (tag == NULL)
! 385: return (0);
! 386: bzero(tag, sizeof(struct pf_tagname));
! 387: strlcpy(tag->name, tagname, sizeof(tag->name));
! 388: tag->tag = new_tagid;
! 389: tag->ref++;
! 390:
! 391: if (p != NULL) /* insert new entry before p */
! 392: TAILQ_INSERT_BEFORE(p, tag, entries);
! 393: else /* either list empty or no free slot in between */
! 394: TAILQ_INSERT_TAIL(head, tag, entries);
! 395:
! 396: return (tag->tag);
! 397: }
! 398:
! 399: void
! 400: tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p)
! 401: {
! 402: struct pf_tagname *tag;
! 403:
! 404: TAILQ_FOREACH(tag, head, entries)
! 405: if (tag->tag == tagid) {
! 406: strlcpy(p, tag->name, PF_TAG_NAME_SIZE);
! 407: return;
! 408: }
! 409: }
! 410:
! 411: void
! 412: tag_unref(struct pf_tags *head, u_int16_t tag)
! 413: {
! 414: struct pf_tagname *p, *next;
! 415:
! 416: if (tag == 0)
! 417: return;
! 418:
! 419: for (p = TAILQ_FIRST(head); p != NULL; p = next) {
! 420: next = TAILQ_NEXT(p, entries);
! 421: if (tag == p->tag) {
! 422: if (--p->ref == 0) {
! 423: TAILQ_REMOVE(head, p, entries);
! 424: free(p, M_TEMP);
! 425: }
! 426: break;
! 427: }
! 428: }
! 429: }
! 430:
! 431: u_int16_t
! 432: pf_tagname2tag(char *tagname)
! 433: {
! 434: return (tagname2tag(&pf_tags, tagname));
! 435: }
! 436:
! 437: void
! 438: pf_tag2tagname(u_int16_t tagid, char *p)
! 439: {
! 440: tag2tagname(&pf_tags, tagid, p);
! 441: }
! 442:
! 443: void
! 444: pf_tag_ref(u_int16_t tag)
! 445: {
! 446: struct pf_tagname *t;
! 447:
! 448: TAILQ_FOREACH(t, &pf_tags, entries)
! 449: if (t->tag == tag)
! 450: break;
! 451: if (t != NULL)
! 452: t->ref++;
! 453: }
! 454:
! 455: void
! 456: pf_tag_unref(u_int16_t tag)
! 457: {
! 458: tag_unref(&pf_tags, tag);
! 459: }
! 460:
! 461: int
! 462: pf_rtlabel_add(struct pf_addr_wrap *a)
! 463: {
! 464: if (a->type == PF_ADDR_RTLABEL &&
! 465: (a->v.rtlabel = rtlabel_name2id(a->v.rtlabelname)) == 0)
! 466: return (-1);
! 467: return (0);
! 468: }
! 469:
! 470: void
! 471: pf_rtlabel_remove(struct pf_addr_wrap *a)
! 472: {
! 473: if (a->type == PF_ADDR_RTLABEL)
! 474: rtlabel_unref(a->v.rtlabel);
! 475: }
! 476:
! 477: void
! 478: pf_rtlabel_copyout(struct pf_addr_wrap *a)
! 479: {
! 480: const char *name;
! 481:
! 482: if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel) {
! 483: if ((name = rtlabel_id2name(a->v.rtlabel)) == NULL)
! 484: strlcpy(a->v.rtlabelname, "?",
! 485: sizeof(a->v.rtlabelname));
! 486: else
! 487: strlcpy(a->v.rtlabelname, name,
! 488: sizeof(a->v.rtlabelname));
! 489: }
! 490: }
! 491:
! 492: #ifdef ALTQ
! 493: u_int32_t
! 494: pf_qname2qid(char *qname)
! 495: {
! 496: return ((u_int32_t)tagname2tag(&pf_qids, qname));
! 497: }
! 498:
! 499: void
! 500: pf_qid2qname(u_int32_t qid, char *p)
! 501: {
! 502: tag2tagname(&pf_qids, (u_int16_t)qid, p);
! 503: }
! 504:
! 505: void
! 506: pf_qid_unref(u_int32_t qid)
! 507: {
! 508: tag_unref(&pf_qids, (u_int16_t)qid);
! 509: }
! 510:
! 511: int
! 512: pf_begin_altq(u_int32_t *ticket)
! 513: {
! 514: struct pf_altq *altq;
! 515: int error = 0;
! 516:
! 517: /* Purge the old altq list */
! 518: while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
! 519: TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
! 520: if (altq->qname[0] == 0) {
! 521: /* detach and destroy the discipline */
! 522: error = altq_remove(altq);
! 523: } else
! 524: pf_qid_unref(altq->qid);
! 525: pool_put(&pf_altq_pl, altq);
! 526: }
! 527: if (error)
! 528: return (error);
! 529: *ticket = ++ticket_altqs_inactive;
! 530: altqs_inactive_open = 1;
! 531: return (0);
! 532: }
! 533:
! 534: int
! 535: pf_rollback_altq(u_int32_t ticket)
! 536: {
! 537: struct pf_altq *altq;
! 538: int error = 0;
! 539:
! 540: if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
! 541: return (0);
! 542: /* Purge the old altq list */
! 543: while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
! 544: TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
! 545: if (altq->qname[0] == 0) {
! 546: /* detach and destroy the discipline */
! 547: error = altq_remove(altq);
! 548: } else
! 549: pf_qid_unref(altq->qid);
! 550: pool_put(&pf_altq_pl, altq);
! 551: }
! 552: altqs_inactive_open = 0;
! 553: return (error);
! 554: }
! 555:
! 556: int
! 557: pf_commit_altq(u_int32_t ticket)
! 558: {
! 559: struct pf_altqqueue *old_altqs;
! 560: struct pf_altq *altq;
! 561: int s, err, error = 0;
! 562:
! 563: if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
! 564: return (EBUSY);
! 565:
! 566: /* swap altqs, keep the old. */
! 567: s = splsoftnet();
! 568: old_altqs = pf_altqs_active;
! 569: pf_altqs_active = pf_altqs_inactive;
! 570: pf_altqs_inactive = old_altqs;
! 571: ticket_altqs_active = ticket_altqs_inactive;
! 572:
! 573: /* Attach new disciplines */
! 574: TAILQ_FOREACH(altq, pf_altqs_active, entries) {
! 575: if (altq->qname[0] == 0) {
! 576: /* attach the discipline */
! 577: error = altq_pfattach(altq);
! 578: if (error == 0 && pf_altq_running)
! 579: error = pf_enable_altq(altq);
! 580: if (error != 0) {
! 581: splx(s);
! 582: return (error);
! 583: }
! 584: }
! 585: }
! 586:
! 587: /* Purge the old altq list */
! 588: while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
! 589: TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
! 590: if (altq->qname[0] == 0) {
! 591: /* detach and destroy the discipline */
! 592: if (pf_altq_running)
! 593: error = pf_disable_altq(altq);
! 594: err = altq_pfdetach(altq);
! 595: if (err != 0 && error == 0)
! 596: error = err;
! 597: err = altq_remove(altq);
! 598: if (err != 0 && error == 0)
! 599: error = err;
! 600: } else
! 601: pf_qid_unref(altq->qid);
! 602: pool_put(&pf_altq_pl, altq);
! 603: }
! 604: splx(s);
! 605:
! 606: altqs_inactive_open = 0;
! 607: return (error);
! 608: }
! 609:
! 610: int
! 611: pf_enable_altq(struct pf_altq *altq)
! 612: {
! 613: struct ifnet *ifp;
! 614: struct tb_profile tb;
! 615: int s, error = 0;
! 616:
! 617: if ((ifp = ifunit(altq->ifname)) == NULL)
! 618: return (EINVAL);
! 619:
! 620: if (ifp->if_snd.altq_type != ALTQT_NONE)
! 621: error = altq_enable(&ifp->if_snd);
! 622:
! 623: /* set tokenbucket regulator */
! 624: if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
! 625: tb.rate = altq->ifbandwidth;
! 626: tb.depth = altq->tbrsize;
! 627: s = splnet();
! 628: error = tbr_set(&ifp->if_snd, &tb);
! 629: splx(s);
! 630: }
! 631:
! 632: return (error);
! 633: }
! 634:
! 635: int
! 636: pf_disable_altq(struct pf_altq *altq)
! 637: {
! 638: struct ifnet *ifp;
! 639: struct tb_profile tb;
! 640: int s, error;
! 641:
! 642: if ((ifp = ifunit(altq->ifname)) == NULL)
! 643: return (EINVAL);
! 644:
! 645: /*
! 646: * when the discipline is no longer referenced, it was overridden
! 647: * by a new one. if so, just return.
! 648: */
! 649: if (altq->altq_disc != ifp->if_snd.altq_disc)
! 650: return (0);
! 651:
! 652: error = altq_disable(&ifp->if_snd);
! 653:
! 654: if (error == 0) {
! 655: /* clear tokenbucket regulator */
! 656: tb.rate = 0;
! 657: s = splnet();
! 658: error = tbr_set(&ifp->if_snd, &tb);
! 659: splx(s);
! 660: }
! 661:
! 662: return (error);
! 663: }
! 664: #endif /* ALTQ */
! 665:
! 666: int
! 667: pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
! 668: {
! 669: struct pf_ruleset *rs;
! 670: struct pf_rule *rule;
! 671:
! 672: if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
! 673: return (EINVAL);
! 674: rs = pf_find_or_create_ruleset(anchor);
! 675: if (rs == NULL)
! 676: return (EINVAL);
! 677: while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
! 678: pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
! 679: rs->rules[rs_num].inactive.rcount--;
! 680: }
! 681: *ticket = ++rs->rules[rs_num].inactive.ticket;
! 682: rs->rules[rs_num].inactive.open = 1;
! 683: return (0);
! 684: }
! 685:
! 686: int
! 687: pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
! 688: {
! 689: struct pf_ruleset *rs;
! 690: struct pf_rule *rule;
! 691:
! 692: if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
! 693: return (EINVAL);
! 694: rs = pf_find_ruleset(anchor);
! 695: if (rs == NULL || !rs->rules[rs_num].inactive.open ||
! 696: rs->rules[rs_num].inactive.ticket != ticket)
! 697: return (0);
! 698: while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
! 699: pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
! 700: rs->rules[rs_num].inactive.rcount--;
! 701: }
! 702: rs->rules[rs_num].inactive.open = 0;
! 703: return (0);
! 704: }
! 705:
! 706: #define PF_MD5_UPD(st, elm) \
! 707: MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm))
! 708:
! 709: #define PF_MD5_UPD_STR(st, elm) \
! 710: MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm))
! 711:
! 712: #define PF_MD5_UPD_HTONL(st, elm, stor) do { \
! 713: (stor) = htonl((st)->elm); \
! 714: MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\
! 715: } while (0)
! 716:
! 717: #define PF_MD5_UPD_HTONS(st, elm, stor) do { \
! 718: (stor) = htons((st)->elm); \
! 719: MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\
! 720: } while (0)
! 721:
! 722: void
! 723: pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
! 724: {
! 725: PF_MD5_UPD(pfr, addr.type);
! 726: switch (pfr->addr.type) {
! 727: case PF_ADDR_DYNIFTL:
! 728: PF_MD5_UPD(pfr, addr.v.ifname);
! 729: PF_MD5_UPD(pfr, addr.iflags);
! 730: break;
! 731: case PF_ADDR_TABLE:
! 732: PF_MD5_UPD(pfr, addr.v.tblname);
! 733: break;
! 734: case PF_ADDR_ADDRMASK:
! 735: /* XXX ignore af? */
! 736: PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
! 737: PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
! 738: break;
! 739: case PF_ADDR_RTLABEL:
! 740: PF_MD5_UPD(pfr, addr.v.rtlabelname);
! 741: break;
! 742: }
! 743:
! 744: PF_MD5_UPD(pfr, port[0]);
! 745: PF_MD5_UPD(pfr, port[1]);
! 746: PF_MD5_UPD(pfr, neg);
! 747: PF_MD5_UPD(pfr, port_op);
! 748: }
! 749:
! 750: void
! 751: pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule)
! 752: {
! 753: u_int16_t x;
! 754: u_int32_t y;
! 755:
! 756: pf_hash_rule_addr(ctx, &rule->src);
! 757: pf_hash_rule_addr(ctx, &rule->dst);
! 758: PF_MD5_UPD_STR(rule, label);
! 759: PF_MD5_UPD_STR(rule, ifname);
! 760: PF_MD5_UPD_STR(rule, match_tagname);
! 761: PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
! 762: PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
! 763: PF_MD5_UPD_HTONL(rule, prob, y);
! 764: PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
! 765: PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
! 766: PF_MD5_UPD(rule, uid.op);
! 767: PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
! 768: PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
! 769: PF_MD5_UPD(rule, gid.op);
! 770: PF_MD5_UPD_HTONL(rule, rule_flag, y);
! 771: PF_MD5_UPD(rule, action);
! 772: PF_MD5_UPD(rule, direction);
! 773: PF_MD5_UPD(rule, af);
! 774: PF_MD5_UPD(rule, quick);
! 775: PF_MD5_UPD(rule, ifnot);
! 776: PF_MD5_UPD(rule, match_tag_not);
! 777: PF_MD5_UPD(rule, natpass);
! 778: PF_MD5_UPD(rule, keep_state);
! 779: PF_MD5_UPD(rule, proto);
! 780: PF_MD5_UPD(rule, type);
! 781: PF_MD5_UPD(rule, code);
! 782: PF_MD5_UPD(rule, flags);
! 783: PF_MD5_UPD(rule, flagset);
! 784: PF_MD5_UPD(rule, allow_opts);
! 785: PF_MD5_UPD(rule, rt);
! 786: PF_MD5_UPD(rule, tos);
! 787: }
! 788:
! 789: int
! 790: pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
! 791: {
! 792: struct pf_ruleset *rs;
! 793: struct pf_rule *rule, **old_array;
! 794: struct pf_rulequeue *old_rules;
! 795: int s, error;
! 796: u_int32_t old_rcount;
! 797:
! 798: if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
! 799: return (EINVAL);
! 800: rs = pf_find_ruleset(anchor);
! 801: if (rs == NULL || !rs->rules[rs_num].inactive.open ||
! 802: ticket != rs->rules[rs_num].inactive.ticket)
! 803: return (EBUSY);
! 804:
! 805: /* Calculate checksum for the main ruleset */
! 806: if (rs == &pf_main_ruleset) {
! 807: error = pf_setup_pfsync_matching(rs);
! 808: if (error != 0)
! 809: return (error);
! 810: }
! 811:
! 812: /* Swap rules, keep the old. */
! 813: s = splsoftnet();
! 814: old_rules = rs->rules[rs_num].active.ptr;
! 815: old_rcount = rs->rules[rs_num].active.rcount;
! 816: old_array = rs->rules[rs_num].active.ptr_array;
! 817:
! 818: rs->rules[rs_num].active.ptr =
! 819: rs->rules[rs_num].inactive.ptr;
! 820: rs->rules[rs_num].active.ptr_array =
! 821: rs->rules[rs_num].inactive.ptr_array;
! 822: rs->rules[rs_num].active.rcount =
! 823: rs->rules[rs_num].inactive.rcount;
! 824: rs->rules[rs_num].inactive.ptr = old_rules;
! 825: rs->rules[rs_num].inactive.ptr_array = old_array;
! 826: rs->rules[rs_num].inactive.rcount = old_rcount;
! 827:
! 828: rs->rules[rs_num].active.ticket =
! 829: rs->rules[rs_num].inactive.ticket;
! 830: pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
! 831:
! 832:
! 833: /* Purge the old rule list. */
! 834: while ((rule = TAILQ_FIRST(old_rules)) != NULL)
! 835: pf_rm_rule(old_rules, rule);
! 836: if (rs->rules[rs_num].inactive.ptr_array)
! 837: free(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
! 838: rs->rules[rs_num].inactive.ptr_array = NULL;
! 839: rs->rules[rs_num].inactive.rcount = 0;
! 840: rs->rules[rs_num].inactive.open = 0;
! 841: pf_remove_if_empty_ruleset(rs);
! 842: splx(s);
! 843: return (0);
! 844: }
! 845:
! 846: void
! 847: pf_state_export(struct pfsync_state *sp, struct pf_state_key *sk,
! 848: struct pf_state *s)
! 849: {
! 850: int secs = time_second;
! 851: bzero(sp, sizeof(struct pfsync_state));
! 852:
! 853: /* copy from state key */
! 854: sp->lan.addr = sk->lan.addr;
! 855: sp->lan.port = sk->lan.port;
! 856: sp->gwy.addr = sk->gwy.addr;
! 857: sp->gwy.port = sk->gwy.port;
! 858: sp->ext.addr = sk->ext.addr;
! 859: sp->ext.port = sk->ext.port;
! 860: sp->proto = sk->proto;
! 861: sp->af = sk->af;
! 862: sp->direction = sk->direction;
! 863:
! 864: /* copy from state */
! 865: memcpy(&sp->id, &s->id, sizeof(sp->id));
! 866: sp->creatorid = s->creatorid;
! 867: strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname));
! 868: pf_state_peer_to_pfsync(&s->src, &sp->src);
! 869: pf_state_peer_to_pfsync(&s->dst, &sp->dst);
! 870:
! 871: sp->rule = s->rule.ptr->nr;
! 872: sp->nat_rule = (s->nat_rule.ptr == NULL) ? -1 : s->nat_rule.ptr->nr;
! 873: sp->anchor = (s->anchor.ptr == NULL) ? -1 : s->anchor.ptr->nr;
! 874:
! 875: pf_state_counter_to_pfsync(s->bytes[0], sp->bytes[0]);
! 876: pf_state_counter_to_pfsync(s->bytes[1], sp->bytes[1]);
! 877: pf_state_counter_to_pfsync(s->packets[0], sp->packets[0]);
! 878: pf_state_counter_to_pfsync(s->packets[1], sp->packets[1]);
! 879: sp->creation = secs - s->creation;
! 880: sp->expire = pf_state_expires(s);
! 881: sp->log = s->log;
! 882: sp->allow_opts = s->allow_opts;
! 883: sp->timeout = s->timeout;
! 884:
! 885: if (s->src_node)
! 886: sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
! 887: if (s->nat_src_node)
! 888: sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
! 889:
! 890: if (sp->expire > secs)
! 891: sp->expire -= secs;
! 892: else
! 893: sp->expire = 0;
! 894:
! 895: }
! 896:
! 897: void
! 898: pf_state_import(struct pfsync_state *sp, struct pf_state_key *sk,
! 899: struct pf_state *s)
! 900: {
! 901: /* copy to state key */
! 902: sk->lan.addr = sp->lan.addr;
! 903: sk->lan.port = sp->lan.port;
! 904: sk->gwy.addr = sp->gwy.addr;
! 905: sk->gwy.port = sp->gwy.port;
! 906: sk->ext.addr = sp->ext.addr;
! 907: sk->ext.port = sp->ext.port;
! 908: sk->proto = sp->proto;
! 909: sk->af = sp->af;
! 910: sk->direction = sp->direction;
! 911:
! 912: /* copy to state */
! 913: memcpy(&s->id, &sp->id, sizeof(sp->id));
! 914: s->creatorid = sp->creatorid;
! 915: strlcpy(sp->ifname, s->kif->pfik_name, sizeof(sp->ifname));
! 916: pf_state_peer_from_pfsync(&sp->src, &s->src);
! 917: pf_state_peer_from_pfsync(&sp->dst, &s->dst);
! 918:
! 919: s->rule.ptr = &pf_default_rule;
! 920: s->nat_rule.ptr = NULL;
! 921: s->anchor.ptr = NULL;
! 922: s->rt_kif = NULL;
! 923: s->creation = time_second;
! 924: s->pfsync_time = 0;
! 925: s->packets[0] = s->packets[1] = 0;
! 926: s->bytes[0] = s->bytes[1] = 0;
! 927: }
! 928:
! 929: int
! 930: pf_setup_pfsync_matching(struct pf_ruleset *rs)
! 931: {
! 932: MD5_CTX ctx;
! 933: struct pf_rule *rule;
! 934: int rs_cnt;
! 935: u_int8_t digest[PF_MD5_DIGEST_LENGTH];
! 936:
! 937: MD5Init(&ctx);
! 938: for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
! 939: /* XXX PF_RULESET_SCRUB as well? */
! 940: if (rs_cnt == PF_RULESET_SCRUB)
! 941: continue;
! 942:
! 943: if (rs->rules[rs_cnt].inactive.ptr_array)
! 944: free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
! 945: rs->rules[rs_cnt].inactive.ptr_array = NULL;
! 946:
! 947: if (rs->rules[rs_cnt].inactive.rcount) {
! 948: rs->rules[rs_cnt].inactive.ptr_array =
! 949: malloc(sizeof(caddr_t) *
! 950: rs->rules[rs_cnt].inactive.rcount,
! 951: M_TEMP, M_NOWAIT);
! 952:
! 953: if (!rs->rules[rs_cnt].inactive.ptr_array)
! 954: return (ENOMEM);
! 955: }
! 956:
! 957: TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
! 958: entries) {
! 959: pf_hash_rule(&ctx, rule);
! 960: (rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
! 961: }
! 962: }
! 963:
! 964: MD5Final(digest, &ctx);
! 965: memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum));
! 966: return (0);
! 967: }
! 968:
! 969: int
! 970: pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
! 971: {
! 972: struct pf_pooladdr *pa = NULL;
! 973: struct pf_pool *pool = NULL;
! 974: int s;
! 975: int error = 0;
! 976:
! 977: /* XXX keep in sync with switch() below */
! 978: if (securelevel > 1)
! 979: switch (cmd) {
! 980: case DIOCGETRULES:
! 981: case DIOCGETRULE:
! 982: case DIOCGETADDRS:
! 983: case DIOCGETADDR:
! 984: case DIOCGETSTATE:
! 985: case DIOCSETSTATUSIF:
! 986: case DIOCGETSTATUS:
! 987: case DIOCCLRSTATUS:
! 988: case DIOCNATLOOK:
! 989: case DIOCSETDEBUG:
! 990: case DIOCGETSTATES:
! 991: case DIOCGETTIMEOUT:
! 992: case DIOCCLRRULECTRS:
! 993: case DIOCGETLIMIT:
! 994: case DIOCGETALTQS:
! 995: case DIOCGETALTQ:
! 996: case DIOCGETQSTATS:
! 997: case DIOCGETRULESETS:
! 998: case DIOCGETRULESET:
! 999: case DIOCRGETTABLES:
! 1000: case DIOCRGETTSTATS:
! 1001: case DIOCRCLRTSTATS:
! 1002: case DIOCRCLRADDRS:
! 1003: case DIOCRADDADDRS:
! 1004: case DIOCRDELADDRS:
! 1005: case DIOCRSETADDRS:
! 1006: case DIOCRGETADDRS:
! 1007: case DIOCRGETASTATS:
! 1008: case DIOCRCLRASTATS:
! 1009: case DIOCRTSTADDRS:
! 1010: case DIOCOSFPGET:
! 1011: case DIOCGETSRCNODES:
! 1012: case DIOCCLRSRCNODES:
! 1013: case DIOCIGETIFACES:
! 1014: case DIOCSETIFFLAG:
! 1015: case DIOCCLRIFFLAG:
! 1016: break;
! 1017: case DIOCRCLRTABLES:
! 1018: case DIOCRADDTABLES:
! 1019: case DIOCRDELTABLES:
! 1020: case DIOCRSETTFLAGS:
! 1021: if (((struct pfioc_table *)addr)->pfrio_flags &
! 1022: PFR_FLAG_DUMMY)
! 1023: break; /* dummy operation ok */
! 1024: return (EPERM);
! 1025: default:
! 1026: return (EPERM);
! 1027: }
! 1028:
! 1029: if (!(flags & FWRITE))
! 1030: switch (cmd) {
! 1031: case DIOCGETRULES:
! 1032: case DIOCGETADDRS:
! 1033: case DIOCGETADDR:
! 1034: case DIOCGETSTATE:
! 1035: case DIOCGETSTATUS:
! 1036: case DIOCGETSTATES:
! 1037: case DIOCGETTIMEOUT:
! 1038: case DIOCGETLIMIT:
! 1039: case DIOCGETALTQS:
! 1040: case DIOCGETALTQ:
! 1041: case DIOCGETQSTATS:
! 1042: case DIOCGETRULESETS:
! 1043: case DIOCGETRULESET:
! 1044: case DIOCNATLOOK:
! 1045: case DIOCRGETTABLES:
! 1046: case DIOCRGETTSTATS:
! 1047: case DIOCRGETADDRS:
! 1048: case DIOCRGETASTATS:
! 1049: case DIOCRTSTADDRS:
! 1050: case DIOCOSFPGET:
! 1051: case DIOCGETSRCNODES:
! 1052: case DIOCIGETIFACES:
! 1053: break;
! 1054: case DIOCRCLRTABLES:
! 1055: case DIOCRADDTABLES:
! 1056: case DIOCRDELTABLES:
! 1057: case DIOCRCLRTSTATS:
! 1058: case DIOCRCLRADDRS:
! 1059: case DIOCRADDADDRS:
! 1060: case DIOCRDELADDRS:
! 1061: case DIOCRSETADDRS:
! 1062: case DIOCRSETTFLAGS:
! 1063: if (((struct pfioc_table *)addr)->pfrio_flags &
! 1064: PFR_FLAG_DUMMY) {
! 1065: flags |= FWRITE; /* need write lock for dummy */
! 1066: break; /* dummy operation ok */
! 1067: }
! 1068: return (EACCES);
! 1069: case DIOCGETRULE:
! 1070: if (((struct pfioc_rule *)addr)->action == PF_GET_CLR_CNTR)
! 1071: return (EACCES);
! 1072: break;
! 1073: default:
! 1074: return (EACCES);
! 1075: }
! 1076:
! 1077: if (flags & FWRITE)
! 1078: rw_enter_write(&pf_consistency_lock);
! 1079: else
! 1080: rw_enter_read(&pf_consistency_lock);
! 1081:
! 1082: s = splsoftnet();
! 1083: switch (cmd) {
! 1084:
! 1085: case DIOCSTART:
! 1086: if (pf_status.running)
! 1087: error = EEXIST;
! 1088: else {
! 1089: pf_status.running = 1;
! 1090: pf_status.since = time_second;
! 1091: if (pf_status.stateid == 0) {
! 1092: pf_status.stateid = time_second;
! 1093: pf_status.stateid = pf_status.stateid << 32;
! 1094: }
! 1095: DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
! 1096: }
! 1097: break;
! 1098:
! 1099: case DIOCSTOP:
! 1100: if (!pf_status.running)
! 1101: error = ENOENT;
! 1102: else {
! 1103: pf_status.running = 0;
! 1104: pf_status.since = time_second;
! 1105: DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
! 1106: }
! 1107: break;
! 1108:
! 1109: case DIOCADDRULE: {
! 1110: struct pfioc_rule *pr = (struct pfioc_rule *)addr;
! 1111: struct pf_ruleset *ruleset;
! 1112: struct pf_rule *rule, *tail;
! 1113: struct pf_pooladdr *pa;
! 1114: int rs_num;
! 1115:
! 1116: pr->anchor[sizeof(pr->anchor) - 1] = 0;
! 1117: ruleset = pf_find_ruleset(pr->anchor);
! 1118: if (ruleset == NULL) {
! 1119: error = EINVAL;
! 1120: break;
! 1121: }
! 1122: rs_num = pf_get_ruleset_number(pr->rule.action);
! 1123: if (rs_num >= PF_RULESET_MAX) {
! 1124: error = EINVAL;
! 1125: break;
! 1126: }
! 1127: if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
! 1128: error = EINVAL;
! 1129: break;
! 1130: }
! 1131: if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) {
! 1132: error = EBUSY;
! 1133: break;
! 1134: }
! 1135: if (pr->pool_ticket != ticket_pabuf) {
! 1136: error = EBUSY;
! 1137: break;
! 1138: }
! 1139: rule = pool_get(&pf_rule_pl, PR_NOWAIT);
! 1140: if (rule == NULL) {
! 1141: error = ENOMEM;
! 1142: break;
! 1143: }
! 1144: bcopy(&pr->rule, rule, sizeof(struct pf_rule));
! 1145: rule->cuid = p->p_cred->p_ruid;
! 1146: rule->cpid = p->p_pid;
! 1147: rule->anchor = NULL;
! 1148: rule->kif = NULL;
! 1149: TAILQ_INIT(&rule->rpool.list);
! 1150: /* initialize refcounting */
! 1151: rule->states = 0;
! 1152: rule->src_nodes = 0;
! 1153: rule->entries.tqe_prev = NULL;
! 1154: #ifndef INET
! 1155: if (rule->af == AF_INET) {
! 1156: pool_put(&pf_rule_pl, rule);
! 1157: error = EAFNOSUPPORT;
! 1158: break;
! 1159: }
! 1160: #endif /* INET */
! 1161: #ifndef INET6
! 1162: if (rule->af == AF_INET6) {
! 1163: pool_put(&pf_rule_pl, rule);
! 1164: error = EAFNOSUPPORT;
! 1165: break;
! 1166: }
! 1167: #endif /* INET6 */
! 1168: tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
! 1169: pf_rulequeue);
! 1170: if (tail)
! 1171: rule->nr = tail->nr + 1;
! 1172: else
! 1173: rule->nr = 0;
! 1174: if (rule->ifname[0]) {
! 1175: rule->kif = pfi_kif_get(rule->ifname);
! 1176: if (rule->kif == NULL) {
! 1177: pool_put(&pf_rule_pl, rule);
! 1178: error = EINVAL;
! 1179: break;
! 1180: }
! 1181: pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE);
! 1182: }
! 1183:
! 1184: if (rule->rtableid > 0 && !rtable_exists(rule->rtableid))
! 1185: error = EBUSY;
! 1186:
! 1187: #ifdef ALTQ
! 1188: /* set queue IDs */
! 1189: if (rule->qname[0] != 0) {
! 1190: if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
! 1191: error = EBUSY;
! 1192: else if (rule->pqname[0] != 0) {
! 1193: if ((rule->pqid =
! 1194: pf_qname2qid(rule->pqname)) == 0)
! 1195: error = EBUSY;
! 1196: } else
! 1197: rule->pqid = rule->qid;
! 1198: }
! 1199: #endif
! 1200: if (rule->tagname[0])
! 1201: if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
! 1202: error = EBUSY;
! 1203: if (rule->match_tagname[0])
! 1204: if ((rule->match_tag =
! 1205: pf_tagname2tag(rule->match_tagname)) == 0)
! 1206: error = EBUSY;
! 1207: if (rule->rt && !rule->direction)
! 1208: error = EINVAL;
! 1209: #if NPFLOG > 0
! 1210: if (!rule->log)
! 1211: rule->logif = 0;
! 1212: if (rule->logif >= PFLOGIFS_MAX)
! 1213: error = EINVAL;
! 1214: #endif
! 1215: if (pf_rtlabel_add(&rule->src.addr) ||
! 1216: pf_rtlabel_add(&rule->dst.addr))
! 1217: error = EBUSY;
! 1218: if (pfi_dynaddr_setup(&rule->src.addr, rule->af))
! 1219: error = EINVAL;
! 1220: if (pfi_dynaddr_setup(&rule->dst.addr, rule->af))
! 1221: error = EINVAL;
! 1222: if (pf_tbladdr_setup(ruleset, &rule->src.addr))
! 1223: error = EINVAL;
! 1224: if (pf_tbladdr_setup(ruleset, &rule->dst.addr))
! 1225: error = EINVAL;
! 1226: if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
! 1227: error = EINVAL;
! 1228: TAILQ_FOREACH(pa, &pf_pabuf, entries)
! 1229: if (pf_tbladdr_setup(ruleset, &pa->addr))
! 1230: error = EINVAL;
! 1231:
! 1232: if (rule->overload_tblname[0]) {
! 1233: if ((rule->overload_tbl = pfr_attach_table(ruleset,
! 1234: rule->overload_tblname)) == NULL)
! 1235: error = EINVAL;
! 1236: else
! 1237: rule->overload_tbl->pfrkt_flags |=
! 1238: PFR_TFLAG_ACTIVE;
! 1239: }
! 1240:
! 1241: pf_mv_pool(&pf_pabuf, &rule->rpool.list);
! 1242: if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
! 1243: (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
! 1244: (rule->rt > PF_FASTROUTE)) &&
! 1245: (TAILQ_FIRST(&rule->rpool.list) == NULL))
! 1246: error = EINVAL;
! 1247:
! 1248: if (error) {
! 1249: pf_rm_rule(NULL, rule);
! 1250: break;
! 1251: }
! 1252: rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
! 1253: rule->evaluations = rule->packets[0] = rule->packets[1] =
! 1254: rule->bytes[0] = rule->bytes[1] = 0;
! 1255: TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
! 1256: rule, entries);
! 1257: ruleset->rules[rs_num].inactive.rcount++;
! 1258: break;
! 1259: }
! 1260:
! 1261: case DIOCGETRULES: {
! 1262: struct pfioc_rule *pr = (struct pfioc_rule *)addr;
! 1263: struct pf_ruleset *ruleset;
! 1264: struct pf_rule *tail;
! 1265: int rs_num;
! 1266:
! 1267: pr->anchor[sizeof(pr->anchor) - 1] = 0;
! 1268: ruleset = pf_find_ruleset(pr->anchor);
! 1269: if (ruleset == NULL) {
! 1270: error = EINVAL;
! 1271: break;
! 1272: }
! 1273: rs_num = pf_get_ruleset_number(pr->rule.action);
! 1274: if (rs_num >= PF_RULESET_MAX) {
! 1275: error = EINVAL;
! 1276: break;
! 1277: }
! 1278: tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
! 1279: pf_rulequeue);
! 1280: if (tail)
! 1281: pr->nr = tail->nr + 1;
! 1282: else
! 1283: pr->nr = 0;
! 1284: pr->ticket = ruleset->rules[rs_num].active.ticket;
! 1285: break;
! 1286: }
! 1287:
! 1288: case DIOCGETRULE: {
! 1289: struct pfioc_rule *pr = (struct pfioc_rule *)addr;
! 1290: struct pf_ruleset *ruleset;
! 1291: struct pf_rule *rule;
! 1292: int rs_num, i;
! 1293:
! 1294: pr->anchor[sizeof(pr->anchor) - 1] = 0;
! 1295: ruleset = pf_find_ruleset(pr->anchor);
! 1296: if (ruleset == NULL) {
! 1297: error = EINVAL;
! 1298: break;
! 1299: }
! 1300: rs_num = pf_get_ruleset_number(pr->rule.action);
! 1301: if (rs_num >= PF_RULESET_MAX) {
! 1302: error = EINVAL;
! 1303: break;
! 1304: }
! 1305: if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
! 1306: error = EBUSY;
! 1307: break;
! 1308: }
! 1309: rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
! 1310: while ((rule != NULL) && (rule->nr != pr->nr))
! 1311: rule = TAILQ_NEXT(rule, entries);
! 1312: if (rule == NULL) {
! 1313: error = EBUSY;
! 1314: break;
! 1315: }
! 1316: bcopy(rule, &pr->rule, sizeof(struct pf_rule));
! 1317: if (pf_anchor_copyout(ruleset, rule, pr)) {
! 1318: error = EBUSY;
! 1319: break;
! 1320: }
! 1321: pfi_dynaddr_copyout(&pr->rule.src.addr);
! 1322: pfi_dynaddr_copyout(&pr->rule.dst.addr);
! 1323: pf_tbladdr_copyout(&pr->rule.src.addr);
! 1324: pf_tbladdr_copyout(&pr->rule.dst.addr);
! 1325: pf_rtlabel_copyout(&pr->rule.src.addr);
! 1326: pf_rtlabel_copyout(&pr->rule.dst.addr);
! 1327: for (i = 0; i < PF_SKIP_COUNT; ++i)
! 1328: if (rule->skip[i].ptr == NULL)
! 1329: pr->rule.skip[i].nr = -1;
! 1330: else
! 1331: pr->rule.skip[i].nr =
! 1332: rule->skip[i].ptr->nr;
! 1333:
! 1334: if (pr->action == PF_GET_CLR_CNTR) {
! 1335: rule->evaluations = 0;
! 1336: rule->packets[0] = rule->packets[1] = 0;
! 1337: rule->bytes[0] = rule->bytes[1] = 0;
! 1338: }
! 1339: break;
! 1340: }
! 1341:
! 1342: case DIOCCHANGERULE: {
! 1343: struct pfioc_rule *pcr = (struct pfioc_rule *)addr;
! 1344: struct pf_ruleset *ruleset;
! 1345: struct pf_rule *oldrule = NULL, *newrule = NULL;
! 1346: u_int32_t nr = 0;
! 1347: int rs_num;
! 1348:
! 1349: if (!(pcr->action == PF_CHANGE_REMOVE ||
! 1350: pcr->action == PF_CHANGE_GET_TICKET) &&
! 1351: pcr->pool_ticket != ticket_pabuf) {
! 1352: error = EBUSY;
! 1353: break;
! 1354: }
! 1355:
! 1356: if (pcr->action < PF_CHANGE_ADD_HEAD ||
! 1357: pcr->action > PF_CHANGE_GET_TICKET) {
! 1358: error = EINVAL;
! 1359: break;
! 1360: }
! 1361: ruleset = pf_find_ruleset(pcr->anchor);
! 1362: if (ruleset == NULL) {
! 1363: error = EINVAL;
! 1364: break;
! 1365: }
! 1366: rs_num = pf_get_ruleset_number(pcr->rule.action);
! 1367: if (rs_num >= PF_RULESET_MAX) {
! 1368: error = EINVAL;
! 1369: break;
! 1370: }
! 1371:
! 1372: if (pcr->action == PF_CHANGE_GET_TICKET) {
! 1373: pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
! 1374: break;
! 1375: } else {
! 1376: if (pcr->ticket !=
! 1377: ruleset->rules[rs_num].active.ticket) {
! 1378: error = EINVAL;
! 1379: break;
! 1380: }
! 1381: if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
! 1382: error = EINVAL;
! 1383: break;
! 1384: }
! 1385: }
! 1386:
! 1387: if (pcr->action != PF_CHANGE_REMOVE) {
! 1388: newrule = pool_get(&pf_rule_pl, PR_NOWAIT);
! 1389: if (newrule == NULL) {
! 1390: error = ENOMEM;
! 1391: break;
! 1392: }
! 1393: bcopy(&pcr->rule, newrule, sizeof(struct pf_rule));
! 1394: newrule->cuid = p->p_cred->p_ruid;
! 1395: newrule->cpid = p->p_pid;
! 1396: TAILQ_INIT(&newrule->rpool.list);
! 1397: /* initialize refcounting */
! 1398: newrule->states = 0;
! 1399: newrule->entries.tqe_prev = NULL;
! 1400: #ifndef INET
! 1401: if (newrule->af == AF_INET) {
! 1402: pool_put(&pf_rule_pl, newrule);
! 1403: error = EAFNOSUPPORT;
! 1404: break;
! 1405: }
! 1406: #endif /* INET */
! 1407: #ifndef INET6
! 1408: if (newrule->af == AF_INET6) {
! 1409: pool_put(&pf_rule_pl, newrule);
! 1410: error = EAFNOSUPPORT;
! 1411: break;
! 1412: }
! 1413: #endif /* INET6 */
! 1414: if (newrule->ifname[0]) {
! 1415: newrule->kif = pfi_kif_get(newrule->ifname);
! 1416: if (newrule->kif == NULL) {
! 1417: pool_put(&pf_rule_pl, newrule);
! 1418: error = EINVAL;
! 1419: break;
! 1420: }
! 1421: pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE);
! 1422: } else
! 1423: newrule->kif = NULL;
! 1424:
! 1425: if (newrule->rtableid > 0 &&
! 1426: !rtable_exists(newrule->rtableid))
! 1427: error = EBUSY;
! 1428:
! 1429: #ifdef ALTQ
! 1430: /* set queue IDs */
! 1431: if (newrule->qname[0] != 0) {
! 1432: if ((newrule->qid =
! 1433: pf_qname2qid(newrule->qname)) == 0)
! 1434: error = EBUSY;
! 1435: else if (newrule->pqname[0] != 0) {
! 1436: if ((newrule->pqid =
! 1437: pf_qname2qid(newrule->pqname)) == 0)
! 1438: error = EBUSY;
! 1439: } else
! 1440: newrule->pqid = newrule->qid;
! 1441: }
! 1442: #endif /* ALTQ */
! 1443: if (newrule->tagname[0])
! 1444: if ((newrule->tag =
! 1445: pf_tagname2tag(newrule->tagname)) == 0)
! 1446: error = EBUSY;
! 1447: if (newrule->match_tagname[0])
! 1448: if ((newrule->match_tag = pf_tagname2tag(
! 1449: newrule->match_tagname)) == 0)
! 1450: error = EBUSY;
! 1451: if (newrule->rt && !newrule->direction)
! 1452: error = EINVAL;
! 1453: #if NPFLOG > 0
! 1454: if (!newrule->log)
! 1455: newrule->logif = 0;
! 1456: if (newrule->logif >= PFLOGIFS_MAX)
! 1457: error = EINVAL;
! 1458: #endif
! 1459: if (pf_rtlabel_add(&newrule->src.addr) ||
! 1460: pf_rtlabel_add(&newrule->dst.addr))
! 1461: error = EBUSY;
! 1462: if (pfi_dynaddr_setup(&newrule->src.addr, newrule->af))
! 1463: error = EINVAL;
! 1464: if (pfi_dynaddr_setup(&newrule->dst.addr, newrule->af))
! 1465: error = EINVAL;
! 1466: if (pf_tbladdr_setup(ruleset, &newrule->src.addr))
! 1467: error = EINVAL;
! 1468: if (pf_tbladdr_setup(ruleset, &newrule->dst.addr))
! 1469: error = EINVAL;
! 1470: if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
! 1471: error = EINVAL;
! 1472: TAILQ_FOREACH(pa, &pf_pabuf, entries)
! 1473: if (pf_tbladdr_setup(ruleset, &pa->addr))
! 1474: error = EINVAL;
! 1475:
! 1476: if (newrule->overload_tblname[0]) {
! 1477: if ((newrule->overload_tbl = pfr_attach_table(
! 1478: ruleset, newrule->overload_tblname)) ==
! 1479: NULL)
! 1480: error = EINVAL;
! 1481: else
! 1482: newrule->overload_tbl->pfrkt_flags |=
! 1483: PFR_TFLAG_ACTIVE;
! 1484: }
! 1485:
! 1486: pf_mv_pool(&pf_pabuf, &newrule->rpool.list);
! 1487: if (((((newrule->action == PF_NAT) ||
! 1488: (newrule->action == PF_RDR) ||
! 1489: (newrule->action == PF_BINAT) ||
! 1490: (newrule->rt > PF_FASTROUTE)) &&
! 1491: !newrule->anchor)) &&
! 1492: (TAILQ_FIRST(&newrule->rpool.list) == NULL))
! 1493: error = EINVAL;
! 1494:
! 1495: if (error) {
! 1496: pf_rm_rule(NULL, newrule);
! 1497: break;
! 1498: }
! 1499: newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
! 1500: newrule->evaluations = 0;
! 1501: newrule->packets[0] = newrule->packets[1] = 0;
! 1502: newrule->bytes[0] = newrule->bytes[1] = 0;
! 1503: }
! 1504: pf_empty_pool(&pf_pabuf);
! 1505:
! 1506: if (pcr->action == PF_CHANGE_ADD_HEAD)
! 1507: oldrule = TAILQ_FIRST(
! 1508: ruleset->rules[rs_num].active.ptr);
! 1509: else if (pcr->action == PF_CHANGE_ADD_TAIL)
! 1510: oldrule = TAILQ_LAST(
! 1511: ruleset->rules[rs_num].active.ptr, pf_rulequeue);
! 1512: else {
! 1513: oldrule = TAILQ_FIRST(
! 1514: ruleset->rules[rs_num].active.ptr);
! 1515: while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
! 1516: oldrule = TAILQ_NEXT(oldrule, entries);
! 1517: if (oldrule == NULL) {
! 1518: if (newrule != NULL)
! 1519: pf_rm_rule(NULL, newrule);
! 1520: error = EINVAL;
! 1521: break;
! 1522: }
! 1523: }
! 1524:
! 1525: if (pcr->action == PF_CHANGE_REMOVE) {
! 1526: pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule);
! 1527: ruleset->rules[rs_num].active.rcount--;
! 1528: } else {
! 1529: if (oldrule == NULL)
! 1530: TAILQ_INSERT_TAIL(
! 1531: ruleset->rules[rs_num].active.ptr,
! 1532: newrule, entries);
! 1533: else if (pcr->action == PF_CHANGE_ADD_HEAD ||
! 1534: pcr->action == PF_CHANGE_ADD_BEFORE)
! 1535: TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
! 1536: else
! 1537: TAILQ_INSERT_AFTER(
! 1538: ruleset->rules[rs_num].active.ptr,
! 1539: oldrule, newrule, entries);
! 1540: ruleset->rules[rs_num].active.rcount++;
! 1541: }
! 1542:
! 1543: nr = 0;
! 1544: TAILQ_FOREACH(oldrule,
! 1545: ruleset->rules[rs_num].active.ptr, entries)
! 1546: oldrule->nr = nr++;
! 1547:
! 1548: ruleset->rules[rs_num].active.ticket++;
! 1549:
! 1550: pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
! 1551: pf_remove_if_empty_ruleset(ruleset);
! 1552:
! 1553: break;
! 1554: }
! 1555:
! 1556: case DIOCCLRSTATES: {
! 1557: struct pf_state *s, *nexts;
! 1558: struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
! 1559: int killed = 0;
! 1560:
! 1561: for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) {
! 1562: nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
! 1563:
! 1564: if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
! 1565: s->kif->pfik_name)) {
! 1566: #if NPFSYNC
! 1567: /* don't send out individual delete messages */
! 1568: s->sync_flags = PFSTATE_NOSYNC;
! 1569: #endif
! 1570: pf_unlink_state(s);
! 1571: killed++;
! 1572: }
! 1573: }
! 1574: psk->psk_af = killed;
! 1575: #if NPFSYNC
! 1576: pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
! 1577: #endif
! 1578: break;
! 1579: }
! 1580:
! 1581: case DIOCKILLSTATES: {
! 1582: struct pf_state *s, *nexts;
! 1583: struct pf_state_key *sk;
! 1584: struct pf_state_host *src, *dst;
! 1585: struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
! 1586: int killed = 0;
! 1587:
! 1588: for (s = RB_MIN(pf_state_tree_id, &tree_id); s;
! 1589: s = nexts) {
! 1590: nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
! 1591: sk = s->state_key;
! 1592:
! 1593: if (sk->direction == PF_OUT) {
! 1594: src = &sk->lan;
! 1595: dst = &sk->ext;
! 1596: } else {
! 1597: src = &sk->ext;
! 1598: dst = &sk->lan;
! 1599: }
! 1600: if ((!psk->psk_af || sk->af == psk->psk_af)
! 1601: && (!psk->psk_proto || psk->psk_proto ==
! 1602: sk->proto) &&
! 1603: PF_MATCHA(psk->psk_src.neg,
! 1604: &psk->psk_src.addr.v.a.addr,
! 1605: &psk->psk_src.addr.v.a.mask,
! 1606: &src->addr, sk->af) &&
! 1607: PF_MATCHA(psk->psk_dst.neg,
! 1608: &psk->psk_dst.addr.v.a.addr,
! 1609: &psk->psk_dst.addr.v.a.mask,
! 1610: &dst->addr, sk->af) &&
! 1611: (psk->psk_src.port_op == 0 ||
! 1612: pf_match_port(psk->psk_src.port_op,
! 1613: psk->psk_src.port[0], psk->psk_src.port[1],
! 1614: src->port)) &&
! 1615: (psk->psk_dst.port_op == 0 ||
! 1616: pf_match_port(psk->psk_dst.port_op,
! 1617: psk->psk_dst.port[0], psk->psk_dst.port[1],
! 1618: dst->port)) &&
! 1619: (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
! 1620: s->kif->pfik_name))) {
! 1621: #if NPFSYNC > 0
! 1622: /* send immediate delete of state */
! 1623: pfsync_delete_state(s);
! 1624: s->sync_flags |= PFSTATE_NOSYNC;
! 1625: #endif
! 1626: pf_unlink_state(s);
! 1627: killed++;
! 1628: }
! 1629: }
! 1630: psk->psk_af = killed;
! 1631: break;
! 1632: }
! 1633:
! 1634: case DIOCADDSTATE: {
! 1635: struct pfioc_state *ps = (struct pfioc_state *)addr;
! 1636: struct pfsync_state *sp = (struct pfsync_state *)ps->state;
! 1637: struct pf_state *s;
! 1638: struct pf_state_key *sk;
! 1639: struct pfi_kif *kif;
! 1640:
! 1641: if (sp->timeout >= PFTM_MAX &&
! 1642: sp->timeout != PFTM_UNTIL_PACKET) {
! 1643: error = EINVAL;
! 1644: break;
! 1645: }
! 1646: s = pool_get(&pf_state_pl, PR_NOWAIT);
! 1647: if (s == NULL) {
! 1648: error = ENOMEM;
! 1649: break;
! 1650: }
! 1651: bzero(s, sizeof(struct pf_state));
! 1652: if ((sk = pf_alloc_state_key(s)) == NULL) {
! 1653: error = ENOMEM;
! 1654: break;
! 1655: }
! 1656: pf_state_import(sp, sk, s);
! 1657: kif = pfi_kif_get(sp->ifname);
! 1658: if (kif == NULL) {
! 1659: pool_put(&pf_state_pl, s);
! 1660: pool_put(&pf_state_key_pl, sk);
! 1661: error = ENOENT;
! 1662: break;
! 1663: }
! 1664: if (pf_insert_state(kif, s)) {
! 1665: pfi_kif_unref(kif, PFI_KIF_REF_NONE);
! 1666: pool_put(&pf_state_pl, s);
! 1667: pool_put(&pf_state_key_pl, sk);
! 1668: error = ENOMEM;
! 1669: }
! 1670: break;
! 1671: }
! 1672:
! 1673: case DIOCGETSTATE: {
! 1674: struct pfioc_state *ps = (struct pfioc_state *)addr;
! 1675: struct pf_state *s;
! 1676: u_int32_t nr;
! 1677:
! 1678: nr = 0;
! 1679: RB_FOREACH(s, pf_state_tree_id, &tree_id) {
! 1680: if (nr >= ps->nr)
! 1681: break;
! 1682: nr++;
! 1683: }
! 1684: if (s == NULL) {
! 1685: error = EBUSY;
! 1686: break;
! 1687: }
! 1688:
! 1689: pf_state_export((struct pfsync_state *)&ps->state,
! 1690: s->state_key, s);
! 1691: break;
! 1692: }
! 1693:
! 1694: case DIOCGETSTATES: {
! 1695: struct pfioc_states *ps = (struct pfioc_states *)addr;
! 1696: struct pf_state *state;
! 1697: struct pfsync_state *p, *pstore;
! 1698: u_int32_t nr = 0;
! 1699:
! 1700: if (ps->ps_len == 0) {
! 1701: nr = pf_status.states;
! 1702: ps->ps_len = sizeof(struct pfsync_state) * nr;
! 1703: break;
! 1704: }
! 1705:
! 1706: pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK);
! 1707:
! 1708: p = ps->ps_states;
! 1709:
! 1710: state = TAILQ_FIRST(&state_list);
! 1711: while (state) {
! 1712: if (state->timeout != PFTM_UNLINKED) {
! 1713: if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len)
! 1714: break;
! 1715:
! 1716: pf_state_export(pstore,
! 1717: state->state_key, state);
! 1718: error = copyout(pstore, p, sizeof(*p));
! 1719: if (error) {
! 1720: free(pstore, M_TEMP);
! 1721: goto fail;
! 1722: }
! 1723: p++;
! 1724: nr++;
! 1725: }
! 1726: state = TAILQ_NEXT(state, entry_list);
! 1727: }
! 1728:
! 1729: ps->ps_len = sizeof(struct pfsync_state) * nr;
! 1730:
! 1731: free(pstore, M_TEMP);
! 1732: break;
! 1733: }
! 1734:
! 1735: case DIOCGETSTATUS: {
! 1736: struct pf_status *s = (struct pf_status *)addr;
! 1737: bcopy(&pf_status, s, sizeof(struct pf_status));
! 1738: pfi_fill_oldstatus(s);
! 1739: break;
! 1740: }
! 1741:
! 1742: case DIOCSETSTATUSIF: {
! 1743: struct pfioc_if *pi = (struct pfioc_if *)addr;
! 1744:
! 1745: if (pi->ifname[0] == 0) {
! 1746: bzero(pf_status.ifname, IFNAMSIZ);
! 1747: break;
! 1748: }
! 1749: if (ifunit(pi->ifname) == NULL) {
! 1750: error = EINVAL;
! 1751: break;
! 1752: }
! 1753: strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ);
! 1754: break;
! 1755: }
! 1756:
! 1757: case DIOCCLRSTATUS: {
! 1758: bzero(pf_status.counters, sizeof(pf_status.counters));
! 1759: bzero(pf_status.fcounters, sizeof(pf_status.fcounters));
! 1760: bzero(pf_status.scounters, sizeof(pf_status.scounters));
! 1761: pf_status.since = time_second;
! 1762: if (*pf_status.ifname)
! 1763: pfi_clr_istats(pf_status.ifname);
! 1764: break;
! 1765: }
! 1766:
! 1767: case DIOCNATLOOK: {
! 1768: struct pfioc_natlook *pnl = (struct pfioc_natlook *)addr;
! 1769: struct pf_state_key *sk;
! 1770: struct pf_state *state;
! 1771: struct pf_state_key_cmp key;
! 1772: int m = 0, direction = pnl->direction;
! 1773:
! 1774: key.af = pnl->af;
! 1775: key.proto = pnl->proto;
! 1776:
! 1777: if (!pnl->proto ||
! 1778: PF_AZERO(&pnl->saddr, pnl->af) ||
! 1779: PF_AZERO(&pnl->daddr, pnl->af) ||
! 1780: ((pnl->proto == IPPROTO_TCP ||
! 1781: pnl->proto == IPPROTO_UDP) &&
! 1782: (!pnl->dport || !pnl->sport)))
! 1783: error = EINVAL;
! 1784: else {
! 1785: /*
! 1786: * userland gives us source and dest of connection,
! 1787: * reverse the lookup so we ask for what happens with
! 1788: * the return traffic, enabling us to find it in the
! 1789: * state tree.
! 1790: */
! 1791: if (direction == PF_IN) {
! 1792: PF_ACPY(&key.ext.addr, &pnl->daddr, pnl->af);
! 1793: key.ext.port = pnl->dport;
! 1794: PF_ACPY(&key.gwy.addr, &pnl->saddr, pnl->af);
! 1795: key.gwy.port = pnl->sport;
! 1796: state = pf_find_state_all(&key, PF_EXT_GWY, &m);
! 1797: } else {
! 1798: PF_ACPY(&key.lan.addr, &pnl->daddr, pnl->af);
! 1799: key.lan.port = pnl->dport;
! 1800: PF_ACPY(&key.ext.addr, &pnl->saddr, pnl->af);
! 1801: key.ext.port = pnl->sport;
! 1802: state = pf_find_state_all(&key, PF_LAN_EXT, &m);
! 1803: }
! 1804: if (m > 1)
! 1805: error = E2BIG; /* more than one state */
! 1806: else if (state != NULL) {
! 1807: sk = state->state_key;
! 1808: if (direction == PF_IN) {
! 1809: PF_ACPY(&pnl->rsaddr, &sk->lan.addr,
! 1810: sk->af);
! 1811: pnl->rsport = sk->lan.port;
! 1812: PF_ACPY(&pnl->rdaddr, &pnl->daddr,
! 1813: pnl->af);
! 1814: pnl->rdport = pnl->dport;
! 1815: } else {
! 1816: PF_ACPY(&pnl->rdaddr, &sk->gwy.addr,
! 1817: sk->af);
! 1818: pnl->rdport = sk->gwy.port;
! 1819: PF_ACPY(&pnl->rsaddr, &pnl->saddr,
! 1820: pnl->af);
! 1821: pnl->rsport = pnl->sport;
! 1822: }
! 1823: } else
! 1824: error = ENOENT;
! 1825: }
! 1826: break;
! 1827: }
! 1828:
! 1829: case DIOCSETTIMEOUT: {
! 1830: struct pfioc_tm *pt = (struct pfioc_tm *)addr;
! 1831: int old;
! 1832:
! 1833: if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
! 1834: pt->seconds < 0) {
! 1835: error = EINVAL;
! 1836: goto fail;
! 1837: }
! 1838: old = pf_default_rule.timeout[pt->timeout];
! 1839: if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
! 1840: pt->seconds = 1;
! 1841: pf_default_rule.timeout[pt->timeout] = pt->seconds;
! 1842: if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
! 1843: wakeup(pf_purge_thread);
! 1844: pt->seconds = old;
! 1845: break;
! 1846: }
! 1847:
! 1848: case DIOCGETTIMEOUT: {
! 1849: struct pfioc_tm *pt = (struct pfioc_tm *)addr;
! 1850:
! 1851: if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
! 1852: error = EINVAL;
! 1853: goto fail;
! 1854: }
! 1855: pt->seconds = pf_default_rule.timeout[pt->timeout];
! 1856: break;
! 1857: }
! 1858:
! 1859: case DIOCGETLIMIT: {
! 1860: struct pfioc_limit *pl = (struct pfioc_limit *)addr;
! 1861:
! 1862: if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
! 1863: error = EINVAL;
! 1864: goto fail;
! 1865: }
! 1866: pl->limit = pf_pool_limits[pl->index].limit;
! 1867: break;
! 1868: }
! 1869:
! 1870: case DIOCSETLIMIT: {
! 1871: struct pfioc_limit *pl = (struct pfioc_limit *)addr;
! 1872: int old_limit;
! 1873:
! 1874: if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
! 1875: pf_pool_limits[pl->index].pp == NULL) {
! 1876: error = EINVAL;
! 1877: goto fail;
! 1878: }
! 1879: if (pool_sethardlimit(pf_pool_limits[pl->index].pp,
! 1880: pl->limit, NULL, 0) != 0) {
! 1881: error = EBUSY;
! 1882: goto fail;
! 1883: }
! 1884: old_limit = pf_pool_limits[pl->index].limit;
! 1885: pf_pool_limits[pl->index].limit = pl->limit;
! 1886: pl->limit = old_limit;
! 1887: break;
! 1888: }
! 1889:
! 1890: case DIOCSETDEBUG: {
! 1891: u_int32_t *level = (u_int32_t *)addr;
! 1892:
! 1893: pf_status.debug = *level;
! 1894: break;
! 1895: }
! 1896:
! 1897: case DIOCCLRRULECTRS: {
! 1898: /* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
! 1899: struct pf_ruleset *ruleset = &pf_main_ruleset;
! 1900: struct pf_rule *rule;
! 1901:
! 1902: TAILQ_FOREACH(rule,
! 1903: ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
! 1904: rule->evaluations = 0;
! 1905: rule->packets[0] = rule->packets[1] = 0;
! 1906: rule->bytes[0] = rule->bytes[1] = 0;
! 1907: }
! 1908: break;
! 1909: }
! 1910:
! 1911: #ifdef ALTQ
! 1912: case DIOCSTARTALTQ: {
! 1913: struct pf_altq *altq;
! 1914:
! 1915: /* enable all altq interfaces on active list */
! 1916: TAILQ_FOREACH(altq, pf_altqs_active, entries) {
! 1917: if (altq->qname[0] == 0) {
! 1918: error = pf_enable_altq(altq);
! 1919: if (error != 0)
! 1920: break;
! 1921: }
! 1922: }
! 1923: if (error == 0)
! 1924: pf_altq_running = 1;
! 1925: DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
! 1926: break;
! 1927: }
! 1928:
! 1929: case DIOCSTOPALTQ: {
! 1930: struct pf_altq *altq;
! 1931:
! 1932: /* disable all altq interfaces on active list */
! 1933: TAILQ_FOREACH(altq, pf_altqs_active, entries) {
! 1934: if (altq->qname[0] == 0) {
! 1935: error = pf_disable_altq(altq);
! 1936: if (error != 0)
! 1937: break;
! 1938: }
! 1939: }
! 1940: if (error == 0)
! 1941: pf_altq_running = 0;
! 1942: DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
! 1943: break;
! 1944: }
! 1945:
! 1946: case DIOCADDALTQ: {
! 1947: struct pfioc_altq *pa = (struct pfioc_altq *)addr;
! 1948: struct pf_altq *altq, *a;
! 1949:
! 1950: if (pa->ticket != ticket_altqs_inactive) {
! 1951: error = EBUSY;
! 1952: break;
! 1953: }
! 1954: altq = pool_get(&pf_altq_pl, PR_NOWAIT);
! 1955: if (altq == NULL) {
! 1956: error = ENOMEM;
! 1957: break;
! 1958: }
! 1959: bcopy(&pa->altq, altq, sizeof(struct pf_altq));
! 1960:
! 1961: /*
! 1962: * if this is for a queue, find the discipline and
! 1963: * copy the necessary fields
! 1964: */
! 1965: if (altq->qname[0] != 0) {
! 1966: if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
! 1967: error = EBUSY;
! 1968: pool_put(&pf_altq_pl, altq);
! 1969: break;
! 1970: }
! 1971: TAILQ_FOREACH(a, pf_altqs_inactive, entries) {
! 1972: if (strncmp(a->ifname, altq->ifname,
! 1973: IFNAMSIZ) == 0 && a->qname[0] == 0) {
! 1974: altq->altq_disc = a->altq_disc;
! 1975: break;
! 1976: }
! 1977: }
! 1978: }
! 1979:
! 1980: error = altq_add(altq);
! 1981: if (error) {
! 1982: pool_put(&pf_altq_pl, altq);
! 1983: break;
! 1984: }
! 1985:
! 1986: TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries);
! 1987: bcopy(altq, &pa->altq, sizeof(struct pf_altq));
! 1988: break;
! 1989: }
! 1990:
! 1991: case DIOCGETALTQS: {
! 1992: struct pfioc_altq *pa = (struct pfioc_altq *)addr;
! 1993: struct pf_altq *altq;
! 1994:
! 1995: pa->nr = 0;
! 1996: TAILQ_FOREACH(altq, pf_altqs_active, entries)
! 1997: pa->nr++;
! 1998: pa->ticket = ticket_altqs_active;
! 1999: break;
! 2000: }
! 2001:
! 2002: case DIOCGETALTQ: {
! 2003: struct pfioc_altq *pa = (struct pfioc_altq *)addr;
! 2004: struct pf_altq *altq;
! 2005: u_int32_t nr;
! 2006:
! 2007: if (pa->ticket != ticket_altqs_active) {
! 2008: error = EBUSY;
! 2009: break;
! 2010: }
! 2011: nr = 0;
! 2012: altq = TAILQ_FIRST(pf_altqs_active);
! 2013: while ((altq != NULL) && (nr < pa->nr)) {
! 2014: altq = TAILQ_NEXT(altq, entries);
! 2015: nr++;
! 2016: }
! 2017: if (altq == NULL) {
! 2018: error = EBUSY;
! 2019: break;
! 2020: }
! 2021: bcopy(altq, &pa->altq, sizeof(struct pf_altq));
! 2022: break;
! 2023: }
! 2024:
! 2025: case DIOCCHANGEALTQ:
! 2026: /* CHANGEALTQ not supported yet! */
! 2027: error = ENODEV;
! 2028: break;
! 2029:
! 2030: case DIOCGETQSTATS: {
! 2031: struct pfioc_qstats *pq = (struct pfioc_qstats *)addr;
! 2032: struct pf_altq *altq;
! 2033: u_int32_t nr;
! 2034: int nbytes;
! 2035:
! 2036: if (pq->ticket != ticket_altqs_active) {
! 2037: error = EBUSY;
! 2038: break;
! 2039: }
! 2040: nbytes = pq->nbytes;
! 2041: nr = 0;
! 2042: altq = TAILQ_FIRST(pf_altqs_active);
! 2043: while ((altq != NULL) && (nr < pq->nr)) {
! 2044: altq = TAILQ_NEXT(altq, entries);
! 2045: nr++;
! 2046: }
! 2047: if (altq == NULL) {
! 2048: error = EBUSY;
! 2049: break;
! 2050: }
! 2051: error = altq_getqstats(altq, pq->buf, &nbytes);
! 2052: if (error == 0) {
! 2053: pq->scheduler = altq->scheduler;
! 2054: pq->nbytes = nbytes;
! 2055: }
! 2056: break;
! 2057: }
! 2058: #endif /* ALTQ */
! 2059:
! 2060: case DIOCBEGINADDRS: {
! 2061: struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
! 2062:
! 2063: pf_empty_pool(&pf_pabuf);
! 2064: pp->ticket = ++ticket_pabuf;
! 2065: break;
! 2066: }
! 2067:
! 2068: case DIOCADDADDR: {
! 2069: struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
! 2070:
! 2071: if (pp->ticket != ticket_pabuf) {
! 2072: error = EBUSY;
! 2073: break;
! 2074: }
! 2075: #ifndef INET
! 2076: if (pp->af == AF_INET) {
! 2077: error = EAFNOSUPPORT;
! 2078: break;
! 2079: }
! 2080: #endif /* INET */
! 2081: #ifndef INET6
! 2082: if (pp->af == AF_INET6) {
! 2083: error = EAFNOSUPPORT;
! 2084: break;
! 2085: }
! 2086: #endif /* INET6 */
! 2087: if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
! 2088: pp->addr.addr.type != PF_ADDR_DYNIFTL &&
! 2089: pp->addr.addr.type != PF_ADDR_TABLE) {
! 2090: error = EINVAL;
! 2091: break;
! 2092: }
! 2093: pa = pool_get(&pf_pooladdr_pl, PR_NOWAIT);
! 2094: if (pa == NULL) {
! 2095: error = ENOMEM;
! 2096: break;
! 2097: }
! 2098: bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr));
! 2099: if (pa->ifname[0]) {
! 2100: pa->kif = pfi_kif_get(pa->ifname);
! 2101: if (pa->kif == NULL) {
! 2102: pool_put(&pf_pooladdr_pl, pa);
! 2103: error = EINVAL;
! 2104: break;
! 2105: }
! 2106: pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE);
! 2107: }
! 2108: if (pfi_dynaddr_setup(&pa->addr, pp->af)) {
! 2109: pfi_dynaddr_remove(&pa->addr);
! 2110: pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE);
! 2111: pool_put(&pf_pooladdr_pl, pa);
! 2112: error = EINVAL;
! 2113: break;
! 2114: }
! 2115: TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries);
! 2116: break;
! 2117: }
! 2118:
! 2119: case DIOCGETADDRS: {
! 2120: struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
! 2121:
! 2122: pp->nr = 0;
! 2123: pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
! 2124: pp->r_num, 0, 1, 0);
! 2125: if (pool == NULL) {
! 2126: error = EBUSY;
! 2127: break;
! 2128: }
! 2129: TAILQ_FOREACH(pa, &pool->list, entries)
! 2130: pp->nr++;
! 2131: break;
! 2132: }
! 2133:
! 2134: case DIOCGETADDR: {
! 2135: struct pfioc_pooladdr *pp = (struct pfioc_pooladdr *)addr;
! 2136: u_int32_t nr = 0;
! 2137:
! 2138: pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
! 2139: pp->r_num, 0, 1, 1);
! 2140: if (pool == NULL) {
! 2141: error = EBUSY;
! 2142: break;
! 2143: }
! 2144: pa = TAILQ_FIRST(&pool->list);
! 2145: while ((pa != NULL) && (nr < pp->nr)) {
! 2146: pa = TAILQ_NEXT(pa, entries);
! 2147: nr++;
! 2148: }
! 2149: if (pa == NULL) {
! 2150: error = EBUSY;
! 2151: break;
! 2152: }
! 2153: bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr));
! 2154: pfi_dynaddr_copyout(&pp->addr.addr);
! 2155: pf_tbladdr_copyout(&pp->addr.addr);
! 2156: pf_rtlabel_copyout(&pp->addr.addr);
! 2157: break;
! 2158: }
! 2159:
! 2160: case DIOCCHANGEADDR: {
! 2161: struct pfioc_pooladdr *pca = (struct pfioc_pooladdr *)addr;
! 2162: struct pf_pooladdr *oldpa = NULL, *newpa = NULL;
! 2163: struct pf_ruleset *ruleset;
! 2164:
! 2165: if (pca->action < PF_CHANGE_ADD_HEAD ||
! 2166: pca->action > PF_CHANGE_REMOVE) {
! 2167: error = EINVAL;
! 2168: break;
! 2169: }
! 2170: if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
! 2171: pca->addr.addr.type != PF_ADDR_DYNIFTL &&
! 2172: pca->addr.addr.type != PF_ADDR_TABLE) {
! 2173: error = EINVAL;
! 2174: break;
! 2175: }
! 2176:
! 2177: ruleset = pf_find_ruleset(pca->anchor);
! 2178: if (ruleset == NULL) {
! 2179: error = EBUSY;
! 2180: break;
! 2181: }
! 2182: pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action,
! 2183: pca->r_num, pca->r_last, 1, 1);
! 2184: if (pool == NULL) {
! 2185: error = EBUSY;
! 2186: break;
! 2187: }
! 2188: if (pca->action != PF_CHANGE_REMOVE) {
! 2189: newpa = pool_get(&pf_pooladdr_pl, PR_NOWAIT);
! 2190: if (newpa == NULL) {
! 2191: error = ENOMEM;
! 2192: break;
! 2193: }
! 2194: bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr));
! 2195: #ifndef INET
! 2196: if (pca->af == AF_INET) {
! 2197: pool_put(&pf_pooladdr_pl, newpa);
! 2198: error = EAFNOSUPPORT;
! 2199: break;
! 2200: }
! 2201: #endif /* INET */
! 2202: #ifndef INET6
! 2203: if (pca->af == AF_INET6) {
! 2204: pool_put(&pf_pooladdr_pl, newpa);
! 2205: error = EAFNOSUPPORT;
! 2206: break;
! 2207: }
! 2208: #endif /* INET6 */
! 2209: if (newpa->ifname[0]) {
! 2210: newpa->kif = pfi_kif_get(newpa->ifname);
! 2211: if (newpa->kif == NULL) {
! 2212: pool_put(&pf_pooladdr_pl, newpa);
! 2213: error = EINVAL;
! 2214: break;
! 2215: }
! 2216: pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE);
! 2217: } else
! 2218: newpa->kif = NULL;
! 2219: if (pfi_dynaddr_setup(&newpa->addr, pca->af) ||
! 2220: pf_tbladdr_setup(ruleset, &newpa->addr)) {
! 2221: pfi_dynaddr_remove(&newpa->addr);
! 2222: pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE);
! 2223: pool_put(&pf_pooladdr_pl, newpa);
! 2224: error = EINVAL;
! 2225: break;
! 2226: }
! 2227: }
! 2228:
! 2229: if (pca->action == PF_CHANGE_ADD_HEAD)
! 2230: oldpa = TAILQ_FIRST(&pool->list);
! 2231: else if (pca->action == PF_CHANGE_ADD_TAIL)
! 2232: oldpa = TAILQ_LAST(&pool->list, pf_palist);
! 2233: else {
! 2234: int i = 0;
! 2235:
! 2236: oldpa = TAILQ_FIRST(&pool->list);
! 2237: while ((oldpa != NULL) && (i < pca->nr)) {
! 2238: oldpa = TAILQ_NEXT(oldpa, entries);
! 2239: i++;
! 2240: }
! 2241: if (oldpa == NULL) {
! 2242: error = EINVAL;
! 2243: break;
! 2244: }
! 2245: }
! 2246:
! 2247: if (pca->action == PF_CHANGE_REMOVE) {
! 2248: TAILQ_REMOVE(&pool->list, oldpa, entries);
! 2249: pfi_dynaddr_remove(&oldpa->addr);
! 2250: pf_tbladdr_remove(&oldpa->addr);
! 2251: pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE);
! 2252: pool_put(&pf_pooladdr_pl, oldpa);
! 2253: } else {
! 2254: if (oldpa == NULL)
! 2255: TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
! 2256: else if (pca->action == PF_CHANGE_ADD_HEAD ||
! 2257: pca->action == PF_CHANGE_ADD_BEFORE)
! 2258: TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
! 2259: else
! 2260: TAILQ_INSERT_AFTER(&pool->list, oldpa,
! 2261: newpa, entries);
! 2262: }
! 2263:
! 2264: pool->cur = TAILQ_FIRST(&pool->list);
! 2265: PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr,
! 2266: pca->af);
! 2267: break;
! 2268: }
! 2269:
! 2270: case DIOCGETRULESETS: {
! 2271: struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
! 2272: struct pf_ruleset *ruleset;
! 2273: struct pf_anchor *anchor;
! 2274:
! 2275: pr->path[sizeof(pr->path) - 1] = 0;
! 2276: if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
! 2277: error = EINVAL;
! 2278: break;
! 2279: }
! 2280: pr->nr = 0;
! 2281: if (ruleset->anchor == NULL) {
! 2282: /* XXX kludge for pf_main_ruleset */
! 2283: RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
! 2284: if (anchor->parent == NULL)
! 2285: pr->nr++;
! 2286: } else {
! 2287: RB_FOREACH(anchor, pf_anchor_node,
! 2288: &ruleset->anchor->children)
! 2289: pr->nr++;
! 2290: }
! 2291: break;
! 2292: }
! 2293:
! 2294: case DIOCGETRULESET: {
! 2295: struct pfioc_ruleset *pr = (struct pfioc_ruleset *)addr;
! 2296: struct pf_ruleset *ruleset;
! 2297: struct pf_anchor *anchor;
! 2298: u_int32_t nr = 0;
! 2299:
! 2300: pr->path[sizeof(pr->path) - 1] = 0;
! 2301: if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
! 2302: error = EINVAL;
! 2303: break;
! 2304: }
! 2305: pr->name[0] = 0;
! 2306: if (ruleset->anchor == NULL) {
! 2307: /* XXX kludge for pf_main_ruleset */
! 2308: RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
! 2309: if (anchor->parent == NULL && nr++ == pr->nr) {
! 2310: strlcpy(pr->name, anchor->name,
! 2311: sizeof(pr->name));
! 2312: break;
! 2313: }
! 2314: } else {
! 2315: RB_FOREACH(anchor, pf_anchor_node,
! 2316: &ruleset->anchor->children)
! 2317: if (nr++ == pr->nr) {
! 2318: strlcpy(pr->name, anchor->name,
! 2319: sizeof(pr->name));
! 2320: break;
! 2321: }
! 2322: }
! 2323: if (!pr->name[0])
! 2324: error = EBUSY;
! 2325: break;
! 2326: }
! 2327:
! 2328: case DIOCRCLRTABLES: {
! 2329: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2330:
! 2331: if (io->pfrio_esize != 0) {
! 2332: error = ENODEV;
! 2333: break;
! 2334: }
! 2335: error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
! 2336: io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2337: break;
! 2338: }
! 2339:
! 2340: case DIOCRADDTABLES: {
! 2341: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2342:
! 2343: if (io->pfrio_esize != sizeof(struct pfr_table)) {
! 2344: error = ENODEV;
! 2345: break;
! 2346: }
! 2347: error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size,
! 2348: &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2349: break;
! 2350: }
! 2351:
! 2352: case DIOCRDELTABLES: {
! 2353: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2354:
! 2355: if (io->pfrio_esize != sizeof(struct pfr_table)) {
! 2356: error = ENODEV;
! 2357: break;
! 2358: }
! 2359: error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size,
! 2360: &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2361: break;
! 2362: }
! 2363:
! 2364: case DIOCRGETTABLES: {
! 2365: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2366:
! 2367: if (io->pfrio_esize != sizeof(struct pfr_table)) {
! 2368: error = ENODEV;
! 2369: break;
! 2370: }
! 2371: error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer,
! 2372: &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2373: break;
! 2374: }
! 2375:
! 2376: case DIOCRGETTSTATS: {
! 2377: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2378:
! 2379: if (io->pfrio_esize != sizeof(struct pfr_tstats)) {
! 2380: error = ENODEV;
! 2381: break;
! 2382: }
! 2383: error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer,
! 2384: &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2385: break;
! 2386: }
! 2387:
! 2388: case DIOCRCLRTSTATS: {
! 2389: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2390:
! 2391: if (io->pfrio_esize != sizeof(struct pfr_table)) {
! 2392: error = ENODEV;
! 2393: break;
! 2394: }
! 2395: error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size,
! 2396: &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2397: break;
! 2398: }
! 2399:
! 2400: case DIOCRSETTFLAGS: {
! 2401: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2402:
! 2403: if (io->pfrio_esize != sizeof(struct pfr_table)) {
! 2404: error = ENODEV;
! 2405: break;
! 2406: }
! 2407: error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size,
! 2408: io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
! 2409: &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2410: break;
! 2411: }
! 2412:
! 2413: case DIOCRCLRADDRS: {
! 2414: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2415:
! 2416: if (io->pfrio_esize != 0) {
! 2417: error = ENODEV;
! 2418: break;
! 2419: }
! 2420: error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
! 2421: io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2422: break;
! 2423: }
! 2424:
! 2425: case DIOCRADDADDRS: {
! 2426: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2427:
! 2428: if (io->pfrio_esize != sizeof(struct pfr_addr)) {
! 2429: error = ENODEV;
! 2430: break;
! 2431: }
! 2432: error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer,
! 2433: io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
! 2434: PFR_FLAG_USERIOCTL);
! 2435: break;
! 2436: }
! 2437:
! 2438: case DIOCRDELADDRS: {
! 2439: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2440:
! 2441: if (io->pfrio_esize != sizeof(struct pfr_addr)) {
! 2442: error = ENODEV;
! 2443: break;
! 2444: }
! 2445: error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer,
! 2446: io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
! 2447: PFR_FLAG_USERIOCTL);
! 2448: break;
! 2449: }
! 2450:
! 2451: case DIOCRSETADDRS: {
! 2452: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2453:
! 2454: if (io->pfrio_esize != sizeof(struct pfr_addr)) {
! 2455: error = ENODEV;
! 2456: break;
! 2457: }
! 2458: error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer,
! 2459: io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
! 2460: &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
! 2461: PFR_FLAG_USERIOCTL, 0);
! 2462: break;
! 2463: }
! 2464:
! 2465: case DIOCRGETADDRS: {
! 2466: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2467:
! 2468: if (io->pfrio_esize != sizeof(struct pfr_addr)) {
! 2469: error = ENODEV;
! 2470: break;
! 2471: }
! 2472: error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer,
! 2473: &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2474: break;
! 2475: }
! 2476:
! 2477: case DIOCRGETASTATS: {
! 2478: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2479:
! 2480: if (io->pfrio_esize != sizeof(struct pfr_astats)) {
! 2481: error = ENODEV;
! 2482: break;
! 2483: }
! 2484: error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer,
! 2485: &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2486: break;
! 2487: }
! 2488:
! 2489: case DIOCRCLRASTATS: {
! 2490: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2491:
! 2492: if (io->pfrio_esize != sizeof(struct pfr_addr)) {
! 2493: error = ENODEV;
! 2494: break;
! 2495: }
! 2496: error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer,
! 2497: io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
! 2498: PFR_FLAG_USERIOCTL);
! 2499: break;
! 2500: }
! 2501:
! 2502: case DIOCRTSTADDRS: {
! 2503: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2504:
! 2505: if (io->pfrio_esize != sizeof(struct pfr_addr)) {
! 2506: error = ENODEV;
! 2507: break;
! 2508: }
! 2509: error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer,
! 2510: io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
! 2511: PFR_FLAG_USERIOCTL);
! 2512: break;
! 2513: }
! 2514:
! 2515: case DIOCRINADEFINE: {
! 2516: struct pfioc_table *io = (struct pfioc_table *)addr;
! 2517:
! 2518: if (io->pfrio_esize != sizeof(struct pfr_addr)) {
! 2519: error = ENODEV;
! 2520: break;
! 2521: }
! 2522: error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer,
! 2523: io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
! 2524: io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
! 2525: break;
! 2526: }
! 2527:
! 2528: case DIOCOSFPADD: {
! 2529: struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
! 2530: error = pf_osfp_add(io);
! 2531: break;
! 2532: }
! 2533:
! 2534: case DIOCOSFPGET: {
! 2535: struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
! 2536: error = pf_osfp_get(io);
! 2537: break;
! 2538: }
! 2539:
! 2540: case DIOCXBEGIN: {
! 2541: struct pfioc_trans *io = (struct pfioc_trans *)addr;
! 2542: struct pfioc_trans_e *ioe;
! 2543: struct pfr_table *table;
! 2544: int i;
! 2545:
! 2546: if (io->esize != sizeof(*ioe)) {
! 2547: error = ENODEV;
! 2548: goto fail;
! 2549: }
! 2550: ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe),
! 2551: M_TEMP, M_WAITOK);
! 2552: table = (struct pfr_table *)malloc(sizeof(*table),
! 2553: M_TEMP, M_WAITOK);
! 2554: for (i = 0; i < io->size; i++) {
! 2555: if (copyin(io->array+i, ioe, sizeof(*ioe))) {
! 2556: free(table, M_TEMP);
! 2557: free(ioe, M_TEMP);
! 2558: error = EFAULT;
! 2559: goto fail;
! 2560: }
! 2561: switch (ioe->rs_num) {
! 2562: #ifdef ALTQ
! 2563: case PF_RULESET_ALTQ:
! 2564: if (ioe->anchor[0]) {
! 2565: free(table, M_TEMP);
! 2566: free(ioe, M_TEMP);
! 2567: error = EINVAL;
! 2568: goto fail;
! 2569: }
! 2570: if ((error = pf_begin_altq(&ioe->ticket))) {
! 2571: free(table, M_TEMP);
! 2572: free(ioe, M_TEMP);
! 2573: goto fail;
! 2574: }
! 2575: break;
! 2576: #endif /* ALTQ */
! 2577: case PF_RULESET_TABLE:
! 2578: bzero(table, sizeof(*table));
! 2579: strlcpy(table->pfrt_anchor, ioe->anchor,
! 2580: sizeof(table->pfrt_anchor));
! 2581: if ((error = pfr_ina_begin(table,
! 2582: &ioe->ticket, NULL, 0))) {
! 2583: free(table, M_TEMP);
! 2584: free(ioe, M_TEMP);
! 2585: goto fail;
! 2586: }
! 2587: break;
! 2588: default:
! 2589: if ((error = pf_begin_rules(&ioe->ticket,
! 2590: ioe->rs_num, ioe->anchor))) {
! 2591: free(table, M_TEMP);
! 2592: free(ioe, M_TEMP);
! 2593: goto fail;
! 2594: }
! 2595: break;
! 2596: }
! 2597: if (copyout(ioe, io->array+i, sizeof(io->array[i]))) {
! 2598: free(table, M_TEMP);
! 2599: free(ioe, M_TEMP);
! 2600: error = EFAULT;
! 2601: goto fail;
! 2602: }
! 2603: }
! 2604: free(table, M_TEMP);
! 2605: free(ioe, M_TEMP);
! 2606: break;
! 2607: }
! 2608:
! 2609: case DIOCXROLLBACK: {
! 2610: struct pfioc_trans *io = (struct pfioc_trans *)addr;
! 2611: struct pfioc_trans_e *ioe;
! 2612: struct pfr_table *table;
! 2613: int i;
! 2614:
! 2615: if (io->esize != sizeof(*ioe)) {
! 2616: error = ENODEV;
! 2617: goto fail;
! 2618: }
! 2619: ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe),
! 2620: M_TEMP, M_WAITOK);
! 2621: table = (struct pfr_table *)malloc(sizeof(*table),
! 2622: M_TEMP, M_WAITOK);
! 2623: for (i = 0; i < io->size; i++) {
! 2624: if (copyin(io->array+i, ioe, sizeof(*ioe))) {
! 2625: free(table, M_TEMP);
! 2626: free(ioe, M_TEMP);
! 2627: error = EFAULT;
! 2628: goto fail;
! 2629: }
! 2630: switch (ioe->rs_num) {
! 2631: #ifdef ALTQ
! 2632: case PF_RULESET_ALTQ:
! 2633: if (ioe->anchor[0]) {
! 2634: free(table, M_TEMP);
! 2635: free(ioe, M_TEMP);
! 2636: error = EINVAL;
! 2637: goto fail;
! 2638: }
! 2639: if ((error = pf_rollback_altq(ioe->ticket))) {
! 2640: free(table, M_TEMP);
! 2641: free(ioe, M_TEMP);
! 2642: goto fail; /* really bad */
! 2643: }
! 2644: break;
! 2645: #endif /* ALTQ */
! 2646: case PF_RULESET_TABLE:
! 2647: bzero(table, sizeof(*table));
! 2648: strlcpy(table->pfrt_anchor, ioe->anchor,
! 2649: sizeof(table->pfrt_anchor));
! 2650: if ((error = pfr_ina_rollback(table,
! 2651: ioe->ticket, NULL, 0))) {
! 2652: free(table, M_TEMP);
! 2653: free(ioe, M_TEMP);
! 2654: goto fail; /* really bad */
! 2655: }
! 2656: break;
! 2657: default:
! 2658: if ((error = pf_rollback_rules(ioe->ticket,
! 2659: ioe->rs_num, ioe->anchor))) {
! 2660: free(table, M_TEMP);
! 2661: free(ioe, M_TEMP);
! 2662: goto fail; /* really bad */
! 2663: }
! 2664: break;
! 2665: }
! 2666: }
! 2667: free(table, M_TEMP);
! 2668: free(ioe, M_TEMP);
! 2669: break;
! 2670: }
! 2671:
! 2672: case DIOCXCOMMIT: {
! 2673: struct pfioc_trans *io = (struct pfioc_trans *)addr;
! 2674: struct pfioc_trans_e *ioe;
! 2675: struct pfr_table *table;
! 2676: struct pf_ruleset *rs;
! 2677: int i;
! 2678:
! 2679: if (io->esize != sizeof(*ioe)) {
! 2680: error = ENODEV;
! 2681: goto fail;
! 2682: }
! 2683: ioe = (struct pfioc_trans_e *)malloc(sizeof(*ioe),
! 2684: M_TEMP, M_WAITOK);
! 2685: table = (struct pfr_table *)malloc(sizeof(*table),
! 2686: M_TEMP, M_WAITOK);
! 2687: /* first makes sure everything will succeed */
! 2688: for (i = 0; i < io->size; i++) {
! 2689: if (copyin(io->array+i, ioe, sizeof(*ioe))) {
! 2690: free(table, M_TEMP);
! 2691: free(ioe, M_TEMP);
! 2692: error = EFAULT;
! 2693: goto fail;
! 2694: }
! 2695: switch (ioe->rs_num) {
! 2696: #ifdef ALTQ
! 2697: case PF_RULESET_ALTQ:
! 2698: if (ioe->anchor[0]) {
! 2699: free(table, M_TEMP);
! 2700: free(ioe, M_TEMP);
! 2701: error = EINVAL;
! 2702: goto fail;
! 2703: }
! 2704: if (!altqs_inactive_open || ioe->ticket !=
! 2705: ticket_altqs_inactive) {
! 2706: free(table, M_TEMP);
! 2707: free(ioe, M_TEMP);
! 2708: error = EBUSY;
! 2709: goto fail;
! 2710: }
! 2711: break;
! 2712: #endif /* ALTQ */
! 2713: case PF_RULESET_TABLE:
! 2714: rs = pf_find_ruleset(ioe->anchor);
! 2715: if (rs == NULL || !rs->topen || ioe->ticket !=
! 2716: rs->tticket) {
! 2717: free(table, M_TEMP);
! 2718: free(ioe, M_TEMP);
! 2719: error = EBUSY;
! 2720: goto fail;
! 2721: }
! 2722: break;
! 2723: default:
! 2724: if (ioe->rs_num < 0 || ioe->rs_num >=
! 2725: PF_RULESET_MAX) {
! 2726: free(table, M_TEMP);
! 2727: free(ioe, M_TEMP);
! 2728: error = EINVAL;
! 2729: goto fail;
! 2730: }
! 2731: rs = pf_find_ruleset(ioe->anchor);
! 2732: if (rs == NULL ||
! 2733: !rs->rules[ioe->rs_num].inactive.open ||
! 2734: rs->rules[ioe->rs_num].inactive.ticket !=
! 2735: ioe->ticket) {
! 2736: free(table, M_TEMP);
! 2737: free(ioe, M_TEMP);
! 2738: error = EBUSY;
! 2739: goto fail;
! 2740: }
! 2741: break;
! 2742: }
! 2743: }
! 2744: /* now do the commit - no errors should happen here */
! 2745: for (i = 0; i < io->size; i++) {
! 2746: if (copyin(io->array+i, ioe, sizeof(*ioe))) {
! 2747: free(table, M_TEMP);
! 2748: free(ioe, M_TEMP);
! 2749: error = EFAULT;
! 2750: goto fail;
! 2751: }
! 2752: switch (ioe->rs_num) {
! 2753: #ifdef ALTQ
! 2754: case PF_RULESET_ALTQ:
! 2755: if ((error = pf_commit_altq(ioe->ticket))) {
! 2756: free(table, M_TEMP);
! 2757: free(ioe, M_TEMP);
! 2758: goto fail; /* really bad */
! 2759: }
! 2760: break;
! 2761: #endif /* ALTQ */
! 2762: case PF_RULESET_TABLE:
! 2763: bzero(table, sizeof(*table));
! 2764: strlcpy(table->pfrt_anchor, ioe->anchor,
! 2765: sizeof(table->pfrt_anchor));
! 2766: if ((error = pfr_ina_commit(table, ioe->ticket,
! 2767: NULL, NULL, 0))) {
! 2768: free(table, M_TEMP);
! 2769: free(ioe, M_TEMP);
! 2770: goto fail; /* really bad */
! 2771: }
! 2772: break;
! 2773: default:
! 2774: if ((error = pf_commit_rules(ioe->ticket,
! 2775: ioe->rs_num, ioe->anchor))) {
! 2776: free(table, M_TEMP);
! 2777: free(ioe, M_TEMP);
! 2778: goto fail; /* really bad */
! 2779: }
! 2780: break;
! 2781: }
! 2782: }
! 2783: free(table, M_TEMP);
! 2784: free(ioe, M_TEMP);
! 2785: break;
! 2786: }
! 2787:
! 2788: case DIOCGETSRCNODES: {
! 2789: struct pfioc_src_nodes *psn = (struct pfioc_src_nodes *)addr;
! 2790: struct pf_src_node *n, *p, *pstore;
! 2791: u_int32_t nr = 0;
! 2792: int space = psn->psn_len;
! 2793:
! 2794: if (space == 0) {
! 2795: RB_FOREACH(n, pf_src_tree, &tree_src_tracking)
! 2796: nr++;
! 2797: psn->psn_len = sizeof(struct pf_src_node) * nr;
! 2798: break;
! 2799: }
! 2800:
! 2801: pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK);
! 2802:
! 2803: p = psn->psn_src_nodes;
! 2804: RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
! 2805: int secs = time_second, diff;
! 2806:
! 2807: if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len)
! 2808: break;
! 2809:
! 2810: bcopy(n, pstore, sizeof(*pstore));
! 2811: if (n->rule.ptr != NULL)
! 2812: pstore->rule.nr = n->rule.ptr->nr;
! 2813: pstore->creation = secs - pstore->creation;
! 2814: if (pstore->expire > secs)
! 2815: pstore->expire -= secs;
! 2816: else
! 2817: pstore->expire = 0;
! 2818:
! 2819: /* adjust the connection rate estimate */
! 2820: diff = secs - n->conn_rate.last;
! 2821: if (diff >= n->conn_rate.seconds)
! 2822: pstore->conn_rate.count = 0;
! 2823: else
! 2824: pstore->conn_rate.count -=
! 2825: n->conn_rate.count * diff /
! 2826: n->conn_rate.seconds;
! 2827:
! 2828: error = copyout(pstore, p, sizeof(*p));
! 2829: if (error) {
! 2830: free(pstore, M_TEMP);
! 2831: goto fail;
! 2832: }
! 2833: p++;
! 2834: nr++;
! 2835: }
! 2836: psn->psn_len = sizeof(struct pf_src_node) * nr;
! 2837:
! 2838: free(pstore, M_TEMP);
! 2839: break;
! 2840: }
! 2841:
! 2842: case DIOCCLRSRCNODES: {
! 2843: struct pf_src_node *n;
! 2844: struct pf_state *state;
! 2845:
! 2846: RB_FOREACH(state, pf_state_tree_id, &tree_id) {
! 2847: state->src_node = NULL;
! 2848: state->nat_src_node = NULL;
! 2849: }
! 2850: RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
! 2851: n->expire = 1;
! 2852: n->states = 0;
! 2853: }
! 2854: pf_purge_expired_src_nodes(1);
! 2855: pf_status.src_nodes = 0;
! 2856: break;
! 2857: }
! 2858:
! 2859: case DIOCKILLSRCNODES: {
! 2860: struct pf_src_node *sn;
! 2861: struct pf_state *s;
! 2862: struct pfioc_src_node_kill *psnk = \
! 2863: (struct pfioc_src_node_kill *) addr;
! 2864: int killed = 0;
! 2865:
! 2866: RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) {
! 2867: if (PF_MATCHA(psnk->psnk_src.neg, \
! 2868: &psnk->psnk_src.addr.v.a.addr, \
! 2869: &psnk->psnk_src.addr.v.a.mask, \
! 2870: &sn->addr, sn->af) &&
! 2871: PF_MATCHA(psnk->psnk_dst.neg, \
! 2872: &psnk->psnk_dst.addr.v.a.addr, \
! 2873: &psnk->psnk_dst.addr.v.a.mask, \
! 2874: &sn->raddr, sn->af)) {
! 2875: /* Handle state to src_node linkage */
! 2876: if (sn->states != 0) {
! 2877: RB_FOREACH(s, pf_state_tree_id,
! 2878: &tree_id) {
! 2879: if (s->src_node == sn)
! 2880: s->src_node = NULL;
! 2881: if (s->nat_src_node == sn)
! 2882: s->nat_src_node = NULL;
! 2883: }
! 2884: sn->states = 0;
! 2885: }
! 2886: sn->expire = 1;
! 2887: killed++;
! 2888: }
! 2889: }
! 2890:
! 2891: if (killed > 0)
! 2892: pf_purge_expired_src_nodes(1);
! 2893:
! 2894: psnk->psnk_af = killed;
! 2895: break;
! 2896: }
! 2897:
! 2898: case DIOCSETHOSTID: {
! 2899: u_int32_t *hostid = (u_int32_t *)addr;
! 2900:
! 2901: if (*hostid == 0)
! 2902: pf_status.hostid = arc4random();
! 2903: else
! 2904: pf_status.hostid = *hostid;
! 2905: break;
! 2906: }
! 2907:
! 2908: case DIOCOSFPFLUSH:
! 2909: pf_osfp_flush();
! 2910: break;
! 2911:
! 2912: case DIOCIGETIFACES: {
! 2913: struct pfioc_iface *io = (struct pfioc_iface *)addr;
! 2914:
! 2915: if (io->pfiio_esize != sizeof(struct pfi_kif)) {
! 2916: error = ENODEV;
! 2917: break;
! 2918: }
! 2919: error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer,
! 2920: &io->pfiio_size);
! 2921: break;
! 2922: }
! 2923:
! 2924: case DIOCSETIFFLAG: {
! 2925: struct pfioc_iface *io = (struct pfioc_iface *)addr;
! 2926:
! 2927: error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
! 2928: break;
! 2929: }
! 2930:
! 2931: case DIOCCLRIFFLAG: {
! 2932: struct pfioc_iface *io = (struct pfioc_iface *)addr;
! 2933:
! 2934: error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
! 2935: break;
! 2936: }
! 2937:
! 2938: default:
! 2939: error = ENODEV;
! 2940: break;
! 2941: }
! 2942: fail:
! 2943: splx(s);
! 2944: if (flags & FWRITE)
! 2945: rw_exit_write(&pf_consistency_lock);
! 2946: else
! 2947: rw_exit_read(&pf_consistency_lock);
! 2948: return (error);
! 2949: }