sys/net/pf/pf_if.c

   1 /*      $FreeBSD: src/sys/contrib/pf/net/pf_if.c,v 1.6 2004/09/14 15:20:24 mlaier Exp $ */
   2 /*      $OpenBSD: pf_if.c,v 1.11 2004/03/15 11:38:23 cedric Exp $ */
   3 /* add  $OpenBSD: pf_if.c,v 1.19 2004/08/11 12:06:44 henning Exp $ */
   4 /*      $DragonFly: src/sys/net/pf/pf_if.c,v 1.3 2004/09/28 16:22:41 joerg Exp $ */
   5
   6 /*
   7  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
   8  *
   9  * Copyright (c) 2001 Daniel Hartmeier
  10  * Copyright (c) 2003 Cedric Berger
  11  * All rights reserved.
  12  *
  13  * Redistribution and use in source and binary forms, with or without
  14  * modification, are permitted provided that the following conditions
  15  * are met:
  16  *
  17  *    - Redistributions of source code must retain the above copyright
  18  *      notice, this list of conditions and the following disclaimer.
  19  *    - Redistributions in binary form must reproduce the above
  20  *      copyright notice, this list of conditions and the following
  21  *      disclaimer in the documentation and/or other materials provided
  22  *      with the distribution.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  25  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  26  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  27  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  28  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  29  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  30  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  31  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  32  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  34  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 #include "opt_inet.h"
  39 #include "opt_inet6.h"
  40
  41 #include <sys/param.h>
  42 #include <sys/systm.h>
  43 #include <sys/malloc.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/eventhandler.h>
  46 #include <sys/filio.h>
  47 #include <sys/socket.h>
  48 #include <sys/socketvar.h>
  49 #include <sys/kernel.h>
  50 #include <sys/time.h>
  51 #include <vm/vm_zone.h>
  52
  53 #include <net/if.h>
  54 #include <net/if_types.h>
  55 #include <net/route.h>
  56
  57 #include <netinet/in.h>
  58 #include <netinet/in_var.h>
  59 #include <netinet/in_systm.h>
  60 #include <netinet/ip.h>
  61 #include <netinet/ip_var.h>
  62
  63 #include <net/pf/pfvar.h>
  64
  65 #ifdef INET6
  66 #include <netinet/ip6.h>
  67 #endif /* INET6 */
  68
  69 #define ACCEPT_FLAGS(oklist)                    \
  70         do {                                    \
  71                 if ((flags & ~(oklist)) &       \
  72                     PFI_FLAG_ALLMASK)           \
  73                         return (EINVAL);        \
  74         } while (0)
  75
  76 #define senderr(e)      do { rv = (e); goto _bad; } while (0)
  77
  78 struct pfi_kif          **pfi_index2kif;
  79 struct pfi_kif           *pfi_self, *pfi_dummy;
  80 int                       pfi_indexlim;
  81 struct pfi_ifhead         pfi_ifs;
  82 struct pfi_statehead      pfi_statehead;
  83 int                       pfi_ifcnt;
  84 vm_zone_t                 pfi_addr_pl;
  85 long                      pfi_update = 1;
  86 struct pfr_addr          *pfi_buffer;
  87 int                       pfi_buffer_cnt;
  88 int                       pfi_buffer_max;
  89 char                      pfi_reserved_anchor[PF_ANCHOR_NAME_SIZE] =
  90                                 PF_RESERVED_ANCHOR;
  91 char                      pfi_interface_ruleset[PF_RULESET_NAME_SIZE] =
  92                                 PF_INTERFACE_RULESET;
  93
  94 eventhandler_tag         pfi_clone_cookie = NULL;
  95 eventhandler_tag         pfi_attach_cookie = NULL;
  96 eventhandler_tag         pfi_detach_cookie = NULL;
  97
  98 void             pfi_dynaddr_update(void *);
  99 void             pfi_kifaddr_update(void *);
 100 void             pfi_table_update(struct pfr_ktable *, struct pfi_kif *,
 101                     int, int);
 102 void             pfi_instance_add(struct ifnet *, int, int);
 103 void             pfi_address_add(struct sockaddr *, int, int);
 104 int              pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
 105 struct pfi_kif  *pfi_if_create(const char *, struct pfi_kif *, int);
 106 void             pfi_copy_group(char *, const char *, int);
 107 void             pfi_dynamic_drivers(void);
 108 void             pfi_newgroup(const char *, int);
 109 int              pfi_skip_if(const char *, struct pfi_kif *, int);
 110 int              pfi_unmask(void *);
 111 void             pfi_dohooks(struct pfi_kif *);
 112 void             pfi_kifaddr_update_event(void *, struct ifnet *);
 113 void             pfi_attach_clone_event(void *, struct if_clone *);
 114 void             pfi_attach_ifnet_event(void *, struct ifnet *);
 115 void             pfi_detach_ifnet_event(void *, struct ifnet *);
 116
 117 RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 118 RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
 119
 120 #define PFI_DYNAMIC_BUSES       { "pcmcia", "cardbus", "uhub" }
 121 #define PFI_BUFFER_MAX          0x10000
 122 MALLOC_DEFINE(PFI_MTYPE, "pf_if", "pf interface table");
 123
 124 void
 125 pfi_initialize(void)
 126 {
 127         struct ifnet    *ifp;
 128
 129         if (pfi_self != NULL)   /* already initialized */
 130                 return;
 131
 132         TAILQ_INIT(&pfi_statehead);
 133         pfi_buffer_max = 64;
 134         pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer),
 135             PFI_MTYPE, M_WAITOK);
 136         pfi_self = pfi_if_create("self", NULL, PFI_IFLAG_GROUP);
 137         pfi_dynamic_drivers();
 138
 139         TAILQ_FOREACH(ifp, &ifnet, if_link) {
 140                 if (ifp->if_dunit != IF_DUNIT_NONE)
 141                         pfi_attach_ifnet(ifp);
 142         }
 143         pfi_dummy = pfi_if_create("notyet", pfi_self,
 144             PFI_IFLAG_GROUP | PFI_IFLAG_DYNAMIC);
 145         pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_attach_event,
 146             pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
 147         pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_detach_event,
 148             pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
 149         pfi_clone_cookie = EVENTHANDLER_REGISTER(if_clone_event,
 150             pfi_attach_clone_event, NULL, EVENTHANDLER_PRI_ANY);
 151 }
 152
 153 void
 154 pfi_cleanup(void)
 155 {
 156         struct pfi_kif *p, key;
 157         struct ifnet *ifp;
 158
 159         EVENTHANDLER_DEREGISTER(ifnet_attach_event, pfi_attach_cookie);
 160         EVENTHANDLER_DEREGISTER(ifnet_detach_event, pfi_detach_cookie);
 161         EVENTHANDLER_DEREGISTER(if_clone_event, pfi_clone_cookie);
 162
 163         /* release PFI_IFLAG_INSTANCE */
 164         TAILQ_FOREACH(ifp, &ifnet, if_link) {
 165                 strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name));
 166                 p = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
 167                 if (p != NULL)
 168                         pfi_detach_ifnet(ifp);
 169         }
 170
 171         /* XXX clear all other interface group */
 172         while ((p = RB_MIN(pfi_ifhead, &pfi_ifs))) {
 173                 RB_REMOVE(pfi_ifhead, &pfi_ifs, p);
 174
 175                 free(p->pfik_ah_head, PFI_MTYPE);
 176                 free(p, PFI_MTYPE);
 177         }
 178         free(pfi_index2kif, PFI_MTYPE);
 179         free(pfi_buffer, PFI_MTYPE);
 180         pfi_index2kif = NULL;
 181         pfi_buffer = NULL;
 182         pfi_self = NULL;
 183 }
 184
 185 /*
 186  * Wrapper functions for FreeBSD eventhandler
 187  */
 188 void
 189 pfi_kifaddr_update_event(void *arg, struct ifnet *ifp)
 190 {
 191         struct pfi_kif *p = arg;
 192
 193         /*
 194          * Check to see if it is 'our' interface as we do not have per
 195          * interface hooks and thus get an update for every interface.
 196          */
 197         if (p && p->pfik_ifp == ifp)
 198                 pfi_kifaddr_update(p);
 199 }
 200
 201 void
 202 pfi_attach_clone_event(void *arg __unused, struct if_clone *ifc)
 203 {
 204         pfi_attach_clone(ifc);
 205 }
 206
 207 void
 208 pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp)
 209 {
 210         if (ifp->if_dunit != IF_DUNIT_NONE)
 211                 pfi_attach_ifnet(ifp);
 212 }
 213
 214 void
 215 pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp)
 216 {
 217         pfi_detach_ifnet(ifp);
 218 }
 219
 220 void
 221 pfi_attach_clone(struct if_clone *ifc)
 222 {
 223         pfi_initialize();
 224         pfi_newgroup(ifc->ifc_name, PFI_IFLAG_CLONABLE);
 225 }
 226
 227 void
 228 pfi_attach_ifnet(struct ifnet *ifp)
 229 {
 230         struct pfi_kif  *p, *q, key;
 231         int              s;
 232         int              realname;
 233
 234         pfi_initialize();
 235         s = splsoftnet();
 236         pfi_update++;
 237         if (ifp->if_index >= pfi_indexlim) {
 238                 /*
 239                  * grow pfi_index2kif,  similar to ifindex2ifnet code in if.c
 240                  */
 241                 size_t m, n, oldlim;
 242                 struct pfi_kif **mp, **np;
 243
 244                 oldlim = pfi_indexlim;
 245                 if (pfi_indexlim == 0)
 246                         pfi_indexlim = 64;
 247                 while (ifp->if_index >= pfi_indexlim)
 248                         pfi_indexlim <<= 1;
 249
 250                 m = oldlim * sizeof(struct pfi_kif *);
 251                 mp = pfi_index2kif;
 252                 n = pfi_indexlim * sizeof(struct pfi_kif *);
 253                 np = malloc(n, PFI_MTYPE, M_NOWAIT);
 254                 if (np == NULL)
 255                         panic("pfi_attach_ifnet: "
 256                             "cannot allocate translation table");
 257                 bzero(np, n);
 258                 if (mp != NULL)
 259                         bcopy(mp, np, m);
 260                 pfi_index2kif = np;
 261                 if (mp != NULL)
 262                         free(mp, PFI_MTYPE);
 263         }
 264
 265         strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name));
 266         p = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
 267         /* some additional trickery for placeholders */
 268         if ((p == NULL) || (p->pfik_parent == pfi_dummy)) {
 269                 /* are we looking at a renamed instance or not? */
 270                 pfi_copy_group(key.pfik_name, ifp->if_xname,
 271                     sizeof(key.pfik_name));
 272                 realname = (strncmp(key.pfik_name, ifp->if_dname,
 273                     sizeof(key.pfik_name)) == 0);
 274                 /* add group */
 275                 /* we can change if_xname, hence use if_dname as group id */
 276                 pfi_copy_group(key.pfik_name, ifp->if_dname,
 277                     sizeof(key.pfik_name));
 278                 q = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
 279                 if (q == NULL)
 280                     q = pfi_if_create(key.pfik_name, pfi_self,
 281                         PFI_IFLAG_GROUP|PFI_IFLAG_DYNAMIC);
 282                 else if (q->pfik_parent == pfi_dummy) {
 283                         q->pfik_parent = pfi_self;
 284                         q->pfik_flags = (PFI_IFLAG_GROUP | PFI_IFLAG_DYNAMIC);
 285                 }
 286                 if (q == NULL)
 287                         panic("pfi_attach_ifnet: "
 288                             "cannot allocate '%s' group", key.pfik_name);
 289
 290                 /* add/modify interface */
 291                 if (p == NULL)
 292                         p = pfi_if_create(ifp->if_xname, q,
 293                             realname?PFI_IFLAG_INSTANCE:PFI_IFLAG_PLACEHOLDER);
 294                 else {
 295                         /* remove from the dummy group */
 296                         /* XXX: copy stats? We should not have any!!! */
 297                         pfi_dummy->pfik_delcnt++;
 298                         TAILQ_REMOVE(&pfi_dummy->pfik_grouphead, p,
 299                             pfik_instances);
 300                         /* move to the right group */
 301                         p->pfik_parent = q;
 302                         q->pfik_addcnt++;
 303                         TAILQ_INSERT_TAIL(&q->pfik_grouphead, p,
 304                             pfik_instances);
 305                         if (realname) {
 306                                 p->pfik_flags &= ~PFI_IFLAG_PLACEHOLDER;
 307                                 p->pfik_flags |= PFI_IFLAG_INSTANCE;
 308                         }
 309                 }
 310                 if (p == NULL)
 311                         panic("pfi_attach_ifnet: "
 312                             "cannot allocate '%s' interface", ifp->if_xname);
 313         } else
 314                 q = p->pfik_parent;
 315         p->pfik_ifp = ifp;
 316         p->pfik_flags |= PFI_IFLAG_ATTACHED;
 317         p->pfik_ah_cookie = EVENTHANDLER_REGISTER(ifaddr_event,
 318             pfi_kifaddr_update_event, p, EVENTHANDLER_PRI_ANY);
 319         pfi_index2kif[ifp->if_index] = p;
 320         pfi_dohooks(p);
 321         splx(s);
 322 }
 323
 324 void
 325 pfi_detach_ifnet(struct ifnet *ifp)
 326 {
 327         struct pfi_kif  *p, *q, key;
 328         int              s;
 329
 330         strlcpy(key.pfik_name, ifp->if_xname, sizeof(key.pfik_name));
 331
 332         s = splsoftnet();
 333         pfi_update++;
 334         p = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
 335         if (p == NULL) {
 336                 printf("pfi_detach_ifnet: cannot find %s", ifp->if_xname);
 337                 splx(s);
 338                 return;
 339         }
 340         EVENTHANDLER_DEREGISTER(ifaddr_event, p->pfik_ah_cookie);
 341         q = p->pfik_parent;
 342         p->pfik_ifp = NULL;
 343         p->pfik_flags &= ~PFI_IFLAG_ATTACHED;
 344         pfi_index2kif[ifp->if_index] = NULL;
 345         pfi_dohooks(p);
 346         pfi_maybe_destroy(p);
 347         splx(s);
 348 }
 349
 350 struct pfi_kif *
 351 pfi_lookup_create(const char *name)
 352 {
 353         struct pfi_kif  *p, *q, key;
 354         int              s;
 355
 356         s = splsoftnet();
 357         p = pfi_lookup_if(name);
 358         if (p == NULL) {
 359                 pfi_copy_group(key.pfik_name, name, sizeof(key.pfik_name));
 360                 q = pfi_lookup_if(key.pfik_name);
 361                 if ((q != NULL) && (q->pfik_parent != pfi_dummy))
 362                         p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE);
 363                 else {
 364                         if (pfi_dummy == NULL)
 365                                 panic("no 'notyet' dummy group");
 366                         p = pfi_if_create(name, pfi_dummy,
 367                             PFI_IFLAG_PLACEHOLDER);
 368                 }
 369         }
 370         splx(s);
 371         return (p);
 372 }
 373
 374 struct pfi_kif *
 375 pfi_attach_rule(const char *name)
 376 {
 377         struct pfi_kif  *p;
 378
 379         p = pfi_lookup_create(name);
 380         if (p != NULL)
 381                 p->pfik_rules++;
 382         return (p);
 383 }
 384
 385 void
 386 pfi_detach_rule(struct pfi_kif *p)
 387 {
 388         if (p == NULL)
 389                 return;
 390         if (p->pfik_rules > 0)
 391                 p->pfik_rules--;
 392         else
 393                 printf("pfi_detach_rule: reference count at 0\n");
 394         pfi_maybe_destroy(p);
 395 }
 396
 397 void
 398 pfi_attach_state(struct pfi_kif *p)
 399 {
 400         if (!p->pfik_states++)
 401                 TAILQ_INSERT_TAIL(&pfi_statehead, p, pfik_w_states);
 402 }
 403
 404 void
 405 pfi_detach_state(struct pfi_kif *p)
 406 {
 407         if (p == NULL)
 408                 return;
 409         if (p->pfik_states <= 0) {
 410                 printf("pfi_detach_state: reference count <= 0\n");
 411                 return;
 412         }
 413         if (!--p->pfik_states)
 414                 TAILQ_REMOVE(&pfi_statehead, p, pfik_w_states);
 415         pfi_maybe_destroy(p);
 416 }
 417
 418 int
 419 pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
 420 {
 421         struct pfi_dynaddr      *dyn;
 422         char                     tblname[PF_TABLE_NAME_SIZE];
 423         struct pf_ruleset       *ruleset = NULL;
 424         int                      s, rv = 0;
 425
 426         if (aw->type != PF_ADDR_DYNIFTL)
 427                 return (0);
 428         dyn = pool_get(&pfi_addr_pl, PR_NOWAIT);
 429         if (dyn == NULL)
 430                 return (1);
 431         bzero(dyn, sizeof(*dyn));
 432
 433         s = splsoftnet();
 434         dyn->pfid_kif = pfi_attach_rule(aw->v.ifname);
 435         if (dyn->pfid_kif == NULL)
 436                 senderr(1);
 437
 438         dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
 439         if (af == AF_INET && dyn->pfid_net == 32)
 440                 dyn->pfid_net = 128;
 441         strlcpy(tblname, aw->v.ifname, sizeof(tblname));
 442         if (aw->iflags & PFI_AFLAG_NETWORK)
 443                 strlcat(tblname, ":network", sizeof(tblname));
 444         if (aw->iflags & PFI_AFLAG_BROADCAST)
 445                 strlcat(tblname, ":broadcast", sizeof(tblname));
 446         if (aw->iflags & PFI_AFLAG_PEER)
 447                 strlcat(tblname, ":peer", sizeof(tblname));
 448         if (aw->iflags & PFI_AFLAG_NOALIAS)
 449                 strlcat(tblname, ":0", sizeof(tblname));
 450         if (dyn->pfid_net != 128)
 451                 snprintf(tblname + strlen(tblname),
 452                     sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
 453         ruleset = pf_find_or_create_ruleset(pfi_reserved_anchor,
 454             pfi_interface_ruleset);
 455         if (ruleset == NULL)
 456                 senderr(1);
 457
 458         dyn->pfid_kt = pfr_attach_table(ruleset, tblname);
 459         if (dyn->pfid_kt == NULL)
 460                 senderr(1);
 461
 462         dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE;
 463         dyn->pfid_iflags = aw->iflags;
 464         dyn->pfid_af = af;
 465         dyn->pfid_hook_cookie = hook_establish(dyn->pfid_kif->pfik_ah_head, 1,
 466             pfi_dynaddr_update, dyn);
 467         if (dyn->pfid_hook_cookie == NULL)
 468                 senderr(1);
 469
 470         aw->p.dyn = dyn;
 471         pfi_dynaddr_update(aw->p.dyn);
 472         splx(s);
 473         return (0);
 474
 475 _bad:
 476         if (dyn->pfid_kt != NULL)
 477                 pfr_detach_table(dyn->pfid_kt);
 478         if (ruleset != NULL)
 479                 pf_remove_if_empty_ruleset(ruleset);
 480         if (dyn->pfid_kif != NULL)
 481                 pfi_detach_rule(dyn->pfid_kif);
 482         pool_put(&pfi_addr_pl, dyn);
 483         splx(s);
 484         return (rv);
 485 }
 486
 487 void
 488 pfi_dynaddr_update(void *p)
 489 {
 490         struct pfi_dynaddr      *dyn = (struct pfi_dynaddr *)p;
 491         struct pfi_kif          *kif = dyn->pfid_kif;
 492         struct pfr_ktable       *kt = dyn->pfid_kt;
 493
 494         if (dyn == NULL || kif == NULL || kt == NULL)
 495                 panic("pfi_dynaddr_update");
 496         if (kt->pfrkt_larg != pfi_update) {
 497                 /* this table needs to be brought up-to-date */
 498                 pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags);
 499                 kt->pfrkt_larg = pfi_update;
 500         }
 501         pfr_dynaddr_update(kt, dyn);
 502 }
 503
 504 void
 505 pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
 506 {
 507         int                      e, size2 = 0;
 508         struct pfi_kif          *p;
 509         struct pfr_table         t;
 510
 511         if ((kif->pfik_flags & PFI_IFLAG_INSTANCE) && kif->pfik_ifp == NULL) {
 512                 pfr_clr_addrs(&kt->pfrkt_t, NULL, 0);
 513                 return;
 514         }
 515         pfi_buffer_cnt = 0;
 516         if ((kif->pfik_flags & PFI_IFLAG_INSTANCE))
 517                 pfi_instance_add(kif->pfik_ifp, net, flags);
 518         else if (strcmp(kif->pfik_name, "self")) {
 519                 TAILQ_FOREACH(p, &kif->pfik_grouphead, pfik_instances)
 520                         pfi_instance_add(p->pfik_ifp, net, flags);
 521         } else {
 522                 RB_FOREACH(p, pfi_ifhead, &pfi_ifs)
 523                         if (p->pfik_flags & PFI_IFLAG_INSTANCE)
 524                                 pfi_instance_add(p->pfik_ifp, net, flags);
 525         }
 526         t = kt->pfrkt_t;
 527         t.pfrt_flags = 0;
 528         if ((e = pfr_set_addrs(&t, pfi_buffer, pfi_buffer_cnt, &size2,
 529             NULL, NULL, NULL, 0)))
 530                 printf("pfi_table_update: cannot set %d new addresses "
 531                     "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);
 532 }
 533
 534 void
 535 pfi_instance_add(struct ifnet *ifp, int net, int flags)
 536 {
 537         struct ifaddr   *ia;
 538         int              got4 = 0, got6 = 0;
 539         int              net2, af;
 540
 541         if (ifp == NULL)
 542                 return;
 543         TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) {
 544                 if (ia->ifa_addr == NULL)
 545                         continue;
 546                 af = ia->ifa_addr->sa_family;
 547                 if (af != AF_INET && af != AF_INET6)
 548                         continue;
 549                 /*
 550                  * XXX: For point-to-point interfaces, (ifname:0) and IPv4,
 551                  *      jump over address without a proper route to work
 552                  *      around a problem with ppp not fully removing the
 553                  *      address used during IPCP.
 554                  */
 555                 if ((ifp->if_flags & IFF_POINTOPOINT) &&
 556                     !(ia->ifa_flags & IFA_ROUTE) &&
 557                     (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET))
 558                         continue;
 559                 if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6)
 560                         continue;
 561                 if ((flags & PFI_AFLAG_BROADCAST) &&
 562                     !(ifp->if_flags & IFF_BROADCAST))
 563                         continue;
 564                 if ((flags & PFI_AFLAG_PEER) &&
 565                     !(ifp->if_flags & IFF_POINTOPOINT))
 566                         continue;
 567                 if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
 568                     IN6_IS_ADDR_LINKLOCAL(
 569                     &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
 570                         continue;
 571                 if (flags & PFI_AFLAG_NOALIAS) {
 572                         if (af == AF_INET && got4)
 573                                 continue;
 574                         if (af == AF_INET6 && got6)
 575                                 continue;
 576                 }
 577                 if (af == AF_INET)
 578                         got4 = 1;
 579                 else
 580                         got6 = 1;
 581                 net2 = net;
 582                 if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
 583                         if (af == AF_INET) {
 584                                 net2 = pfi_unmask(&((struct sockaddr_in *)
 585                                     ia->ifa_netmask)->sin_addr);
 586                         } else {
 587                                 net2 = pfi_unmask(&((struct sockaddr_in6 *)
 588                                     ia->ifa_netmask)->sin6_addr);
 589                         }
 590                 }
 591                 if (af == AF_INET && net2 > 32)
 592                         net2 = 32;
 593                 if (flags & PFI_AFLAG_BROADCAST)
 594                         pfi_address_add(ia->ifa_broadaddr, af, net2);
 595                 else if (flags & PFI_AFLAG_PEER)
 596                         pfi_address_add(ia->ifa_dstaddr, af, net2);
 597                 else
 598                         pfi_address_add(ia->ifa_addr, af, net2);
 599         }
 600 }
 601
 602 void
 603 pfi_address_add(struct sockaddr *sa, int af, int net)
 604 {
 605         struct pfr_addr *p;
 606         int              i;
 607
 608         if (pfi_buffer_cnt >= pfi_buffer_max) {
 609                 int              new_max = pfi_buffer_max * 2;
 610
 611                 if (new_max > PFI_BUFFER_MAX) {
 612                         printf("pfi_address_add: address buffer full (%d/%d)\n",
 613                             pfi_buffer_cnt, PFI_BUFFER_MAX);
 614                         return;
 615                 }
 616                 p = malloc(new_max * sizeof(*pfi_buffer), PFI_MTYPE,
 617                     M_NOWAIT);
 618                 if (p == NULL) {
 619                         printf("pfi_address_add: no memory to grow buffer "
 620                             "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
 621                         return;
 622                 }
 623                 memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer));
 624                 /* no need to zero buffer */
 625                 free(pfi_buffer, PFI_MTYPE);
 626                 pfi_buffer = p;
 627                 pfi_buffer_max = new_max;
 628         }
 629         if (af == AF_INET && net > 32)
 630                 net = 128;
 631         p = pfi_buffer + pfi_buffer_cnt++;
 632         bzero(p, sizeof(*p));
 633         p->pfra_af = af;
 634         p->pfra_net = net;
 635         if (af == AF_INET)
 636                 p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr;
 637         if (af == AF_INET6) {
 638                 p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr;
 639                 if (IN6_IS_ADDR_LINKLOCAL(&p->pfra_ip6addr))
 640                         p->pfra_ip6addr.s6_addr16[1] = 0;
 641         }
 642         /* mask network address bits */
 643         if (net < 128)
 644                 ((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
 645         for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++)
 646                 ((caddr_t)p)[i] = 0;
 647 }
 648
 649 void
 650 pfi_dynaddr_remove(struct pf_addr_wrap *aw)
 651 {
 652         int     s;
 653
 654         if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 655             aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL)
 656                 return;
 657
 658         s = splsoftnet();
 659         hook_disestablish(aw->p.dyn->pfid_kif->pfik_ah_head,
 660             aw->p.dyn->pfid_hook_cookie);
 661         pfi_detach_rule(aw->p.dyn->pfid_kif);
 662         aw->p.dyn->pfid_kif = NULL;
 663         pfr_detach_table(aw->p.dyn->pfid_kt);
 664         aw->p.dyn->pfid_kt = NULL;
 665         pool_put(&pfi_addr_pl, aw->p.dyn);
 666         aw->p.dyn = NULL;
 667         splx(s);
 668 }
 669
 670 void
 671 pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
 672 {
 673         if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
 674             aw->p.dyn->pfid_kif == NULL)
 675                 return;
 676         aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
 677 }
 678
 679 void
 680 pfi_kifaddr_update(void *v)
 681 {
 682         int              s;
 683
 684         s = splsoftnet();
 685         pfi_update++;
 686         pfi_dohooks(v);
 687         splx(s);
 688 }
 689
 690 int
 691 pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
 692 {
 693         return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
 694 }
 695
 696 struct pfi_kif *
 697 pfi_if_create(const char *name, struct pfi_kif *q, int flags)
 698 {
 699         struct pfi_kif *p;
 700
 701         p = malloc(sizeof(*p), PFI_MTYPE, M_NOWAIT);
 702         if (p == NULL)
 703                 return (NULL);
 704         bzero(p, sizeof(*p));
 705         p->pfik_ah_head = malloc(sizeof(*p->pfik_ah_head), PFI_MTYPE,
 706             M_NOWAIT);
 707         if (p->pfik_ah_head == NULL) {
 708                 free(p, PFI_MTYPE);
 709                 return (NULL);
 710         }
 711         bzero(p->pfik_ah_head, sizeof(*p->pfik_ah_head));
 712         TAILQ_INIT(p->pfik_ah_head);
 713         TAILQ_INIT(&p->pfik_grouphead);
 714         strlcpy(p->pfik_name, name, sizeof(p->pfik_name));
 715         RB_INIT(&p->pfik_lan_ext);
 716         RB_INIT(&p->pfik_ext_gwy);
 717         p->pfik_flags = flags;
 718         p->pfik_parent = q;
 719         p->pfik_tzero = time_second;
 720
 721         RB_INSERT(pfi_ifhead, &pfi_ifs, p);
 722         if (q != NULL) {
 723                 q->pfik_addcnt++;
 724                 TAILQ_INSERT_TAIL(&q->pfik_grouphead, p, pfik_instances);
 725         }
 726         pfi_ifcnt++;
 727         return (p);
 728 }
 729
 730 int
 731 pfi_maybe_destroy(struct pfi_kif *p)
 732 {
 733         int              i, j, k, s;
 734         struct pfi_kif  *q = p->pfik_parent;
 735
 736         if ((p->pfik_flags & (PFI_IFLAG_ATTACHED | PFI_IFLAG_GROUP)) ||
 737             p->pfik_rules > 0 || p->pfik_states > 0)
 738                 if (!(p->pfik_flags & PFI_IFLAG_PLACEHOLDER))
 739                         return (0);
 740
 741         s = splsoftnet();
 742         if (q != NULL) {
 743                 for (i = 0; i < 2; i++)
 744                         for (j = 0; j < 2; j++)
 745                                 for (k = 0; k < 2; k++) {
 746                                         q->pfik_bytes[i][j][k] +=
 747                                             p->pfik_bytes[i][j][k];
 748                                         q->pfik_packets[i][j][k] +=
 749                                             p->pfik_packets[i][j][k];
 750                         /* clear stats in case we return to the dummy group */
 751                                         p->pfik_bytes[i][j][k] = 0;
 752                                         p->pfik_packets[i][j][k] = 0;
 753                                 }
 754                 q->pfik_delcnt++;
 755                 TAILQ_REMOVE(&q->pfik_grouphead, p, pfik_instances);
 756         }
 757         if (p->pfik_rules > 0 || p->pfik_states > 0) {
 758                 /* move back to the dummy group */
 759                 p->pfik_parent = pfi_dummy;
 760                 pfi_dummy->pfik_addcnt++;
 761                 TAILQ_INSERT_TAIL(&pfi_dummy->pfik_grouphead, p,
 762                     pfik_instances);
 763                 return (0);
 764         }
 765         pfi_ifcnt--;
 766         RB_REMOVE(pfi_ifhead, &pfi_ifs, p);
 767         splx(s);
 768
 769         free(p->pfik_ah_head, PFI_MTYPE);
 770         free(p, PFI_MTYPE);
 771         return (1);
 772 }
 773
 774 void
 775 pfi_copy_group(char *p, const char *q, int m)
 776 {
 777         while (m > 1 && *q && !(*q >= '0' && *q <= '9')) {
 778                 *p++ = *q++;
 779                 m--;
 780         }
 781         if (m > 0)
 782                 *p++ = '\0';
 783 }
 784
 785 void
 786 pfi_dynamic_drivers(void)
 787 {
 788         struct ifnet    *ifp;
 789
 790 /*
 791  * For FreeBSD basically every interface is "dynamic" as we can unload
 792  * modules e.g.
 793  */
 794         TAILQ_FOREACH(ifp, &ifnet, if_link) {
 795                 if (ifp->if_dunit == IF_DUNIT_NONE)
 796                         continue;
 797                 pfi_newgroup(ifp->if_dname, PFI_IFLAG_DYNAMIC);
 798         }
 799 }
 800
 801 void
 802 pfi_newgroup(const char *name, int flags)
 803 {
 804         struct pfi_kif  *p;
 805
 806         p = pfi_lookup_if(name);
 807         if (p == NULL)
 808                 p = pfi_if_create(name, pfi_self, PFI_IFLAG_GROUP);
 809         if (p == NULL) {
 810                 printf("pfi_newgroup: cannot allocate '%s' group", name);
 811                 return;
 812         }
 813         p->pfik_flags |= flags;
 814 }
 815
 816 void
 817 pfi_fill_oldstatus(struct pf_status *pfs)
 818 {
 819         struct pfi_kif  *p, key;
 820         int              i, j, k, s;
 821
 822         strlcpy(key.pfik_name, pfs->ifname, sizeof(key.pfik_name));
 823         s = splsoftnet();
 824         p = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
 825         if (p == NULL) {
 826                 splx(s);
 827                 return;
 828         }
 829         bzero(pfs->pcounters, sizeof(pfs->pcounters));
 830         bzero(pfs->bcounters, sizeof(pfs->bcounters));
 831         for (i = 0; i < 2; i++)
 832                 for (j = 0; j < 2; j++)
 833                         for (k = 0; k < 2; k++) {
 834                                 pfs->pcounters[i][j][k] =
 835                                         p->pfik_packets[i][j][k];
 836                                 pfs->bcounters[i][j] +=
 837                                         p->pfik_bytes[i][j][k];
 838                         }
 839         splx(s);
 840 }
 841
 842 int
 843 pfi_clr_istats(const char *name, int *nzero, int flags)
 844 {
 845         struct pfi_kif  *p;
 846         int              n = 0, s;
 847         long             tzero = time_second;
 848
 849         s = splsoftnet();
 850         ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE);
 851         RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
 852                 if (pfi_skip_if(name, p, flags))
 853                         continue;
 854                 bzero(p->pfik_packets, sizeof(p->pfik_packets));
 855                 bzero(p->pfik_bytes, sizeof(p->pfik_bytes));
 856                 p->pfik_tzero = tzero;
 857                 n++;
 858         }
 859         splx(s);
 860         if (nzero != NULL)
 861                 *nzero = n;
 862         return (0);
 863 }
 864
 865 int
 866 pfi_get_ifaces(const char *name, struct pfi_if *buf, int *size, int flags)
 867 {
 868         struct pfi_kif  *p;
 869         int              s, n = 0;
 870
 871         ACCEPT_FLAGS(PFI_FLAG_GROUP|PFI_FLAG_INSTANCE);
 872         s = splsoftnet();
 873         RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
 874                 if (pfi_skip_if(name, p, flags))
 875                         continue;
 876                 if (*size > n++) {
 877                         if (!p->pfik_tzero)
 878                                 p->pfik_tzero = boottime.tv_sec;
 879                         if (copyout(p, buf++, sizeof(*buf))) {
 880                                 splx(s);
 881                                 return (EFAULT);
 882                         }
 883                 }
 884         }
 885         splx(s);
 886         *size = n;
 887         return (0);
 888 }
 889
 890 struct pfi_kif *
 891 pfi_lookup_if(const char *name)
 892 {
 893         struct pfi_kif  *p, key;
 894
 895         strlcpy(key.pfik_name, name, sizeof(key.pfik_name));
 896         p = RB_FIND(pfi_ifhead, &pfi_ifs, &key);
 897         return (p);
 898 }
 899
 900 int
 901 pfi_skip_if(const char *filter, struct pfi_kif *p, int f)
 902 {
 903         int     n;
 904
 905         if ((p->pfik_flags & PFI_IFLAG_GROUP) && !(f & PFI_FLAG_GROUP))
 906                 return (1);
 907         if ((p->pfik_flags & PFI_IFLAG_INSTANCE) && !(f & PFI_FLAG_INSTANCE))
 908                 return (1);
 909         if (filter == NULL || !*filter)
 910                 return (0);
 911         if (!strcmp(p->pfik_name, filter))
 912                 return (0);     /* exact match */
 913         n = strlen(filter);
 914         if (n < 1 || n >= IFNAMSIZ)
 915                 return (1);     /* sanity check */
 916         if (filter[n-1] >= '0' && filter[n-1] <= '9')
 917                 return (1);     /* only do exact match in that case */
 918         if (strncmp(p->pfik_name, filter, n))
 919                 return (1);     /* prefix doesn't match */
 920         return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
 921 }
 922
 923 /* from pf_print_state.c */
 924 int
 925 pfi_unmask(void *addr)
 926 {
 927         struct pf_addr *m = addr;
 928         int i = 31, j = 0, b = 0;
 929         u_int32_t tmp;
 930
 931         while (j < 4 && m->addr32[j] == 0xffffffff) {
 932                 b += 32;
 933                 j++;
 934         }
 935         if (j < 4) {
 936                 tmp = ntohl(m->addr32[j]);
 937                 for (i = 31; tmp & (1 << i); --i)
 938                         b++;
 939         }
 940         return (b);
 941 }
 942
 943 void
 944 pfi_dohooks(struct pfi_kif *p)
 945 {
 946         for (; p != NULL; p = p->pfik_parent)
 947                 dohooks(p->pfik_ah_head, 0);
 948 }
 949
 950 int
 951 pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
 952 {
 953         if (af == AF_INET) {
 954                 switch (dyn->pfid_acnt4) {
 955                 case 0:
 956                         return (0);
 957                 case 1:
 958                         return (PF_MATCHA(0, &dyn->pfid_addr4,
 959                             &dyn->pfid_mask4, a, AF_INET));
 960                 default:
 961                         return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
 962                 }
 963         } else {
 964                 switch (dyn->pfid_acnt6) {
 965                 case 0:
 966                         return (0);
 967                 case 1:
 968                         return (PF_MATCHA(0, &dyn->pfid_addr6,
 969                             &dyn->pfid_mask6, a, AF_INET6));
 970                 default:
 971                         return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
 972                 }
 973         }
 974 }