1 /* $OpenBSD: pf_ruleset.c,v 1.1 2006/10/27 13:56:51 mcbride Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002,2003 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38 #include <sys/cdefs.h> 39 #include <sys/param.h> 40 #include <sys/socket.h> 41 #ifdef _KERNEL 42 # include <sys/systm.h> 43 #endif /* _KERNEL */ 44 #include <sys/mbuf.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_systm.h> 48 #include <netinet/ip.h> 49 #include <netinet/tcp.h> 50 51 #include <net/if.h> 52 #include <net/pf/pfvar.h> 53 54 #ifdef INET6 55 #include <netinet/ip6.h> 56 #endif /* INET6 */ 57 58 59 #ifdef _KERNEL 60 # define DPFPRINTF(format, x...) \ 61 if (pf_status.debug >= PF_DEBUG_NOISY) \ 62 kprintf(format , ##x) 63 #define rs_malloc(x) kmalloc(x, M_TEMP, M_WAITOK) 64 #define rs_free(x) kfree(x, M_TEMP) 65 #define printf kprintf 66 #else 67 /* Userland equivalents so we can lend code to pfctl et al. */ 68 69 # include <arpa/inet.h> 70 # include <errno.h> 71 # include <stdio.h> 72 # include <stdlib.h> 73 # include <string.h> 74 # define rs_malloc(x) malloc(x) 75 # define rs_free(x) free(x) 76 77 # ifdef PFDEBUG 78 # include <sys/stdarg.h> 79 # define DPFPRINTF(format, x...) fprintf(stderr, format , ##x) 80 # else 81 # define DPFPRINTF(format, x...) ((void)0) 82 # endif /* PFDEBUG */ 83 #endif /* _KERNEL */ 84 85 86 struct pf_anchor_global pf_anchors; 87 struct pf_anchor pf_main_anchor; 88 89 /* 90 * XXX: hum? 91 int pf_get_ruleset_number(u_int8_t); 92 void pf_init_ruleset(struct pf_ruleset *); 93 int pf_anchor_setup(struct pf_rule *, 94 const struct pf_ruleset *, const char *); 95 int pf_anchor_copyout(const struct pf_ruleset *, 96 const struct pf_rule *, struct pfioc_rule *); 97 void pf_anchor_remove(struct pf_rule *); 98 */ 99 100 static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *); 101 102 RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare); 103 RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare); 104 105 static __inline int 106 pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b) 107 { 108 int c = strcmp(a->path, b->path); 109 110 return (c ? (c < 0 ? -1 : 1) : 0); 111 } 112 113 int 114 pf_get_ruleset_number(u_int8_t action) 115 { 116 switch (action) { 117 case PF_SCRUB: 118 case PF_NOSCRUB: 119 return (PF_RULESET_SCRUB); 120 break; 121 case PF_PASS: 122 case PF_DROP: 123 return (PF_RULESET_FILTER); 124 break; 125 case PF_NAT: 126 case PF_NONAT: 127 return (PF_RULESET_NAT); 128 break; 129 case PF_BINAT: 130 case PF_NOBINAT: 131 return (PF_RULESET_BINAT); 132 break; 133 case PF_RDR: 134 case PF_NORDR: 135 return (PF_RULESET_RDR); 136 break; 137 default: 138 return (PF_RULESET_MAX); 139 break; 140 } 141 } 142 143 void 144 pf_init_ruleset(struct pf_ruleset *ruleset) 145 { 146 int i; 147 148 memset(ruleset, 0, sizeof(struct pf_ruleset)); 149 for (i = 0; i < PF_RULESET_MAX; i++) { 150 TAILQ_INIT(&ruleset->rules[i].queues[0]); 151 TAILQ_INIT(&ruleset->rules[i].queues[1]); 152 ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0]; 153 ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1]; 154 } 155 } 156 157 struct pf_anchor * 158 pf_find_anchor(const char *path) 159 { 160 struct pf_anchor *key, *found; 161 162 key = (struct pf_anchor *)rs_malloc(sizeof(*key)); 163 memset(key, 0, sizeof(*key)); 164 strlcpy(key->path, path, sizeof(key->path)); 165 found = RB_FIND(pf_anchor_global, &pf_anchors, key); 166 rs_free(key); 167 return (found); 168 } 169 170 struct pf_ruleset * 171 pf_find_ruleset(const char *path) 172 { 173 struct pf_anchor *anchor; 174 175 while (*path == '/') 176 path++; 177 if (!*path) 178 return (&pf_main_ruleset); 179 anchor = pf_find_anchor(path); 180 if (anchor == NULL) 181 return (NULL); 182 else 183 return (&anchor->ruleset); 184 } 185 186 struct pf_ruleset * 187 pf_find_or_create_ruleset(const char *path) 188 { 189 char *p, *q, *r; 190 struct pf_ruleset *ruleset; 191 struct pf_anchor *anchor = NULL, *dup, *parent = NULL; 192 193 if (path[0] == 0) 194 return (&pf_main_ruleset); 195 while (*path == '/') 196 path++; 197 ruleset = pf_find_ruleset(path); 198 if (ruleset != NULL) 199 return (ruleset); 200 p = (char *)rs_malloc(MAXPATHLEN); 201 bzero(p, MAXPATHLEN); 202 strlcpy(p, path, MAXPATHLEN); 203 while (parent == NULL && (q = strrchr(p, '/')) != NULL) { 204 *q = 0; 205 if ((ruleset = pf_find_ruleset(p)) != NULL) { 206 parent = ruleset->anchor; 207 break; 208 } 209 } 210 if (q == NULL) 211 q = p; 212 else 213 q++; 214 strlcpy(p, path, MAXPATHLEN); 215 if (!*q) { 216 rs_free(p); 217 return (NULL); 218 } 219 while ((r = strchr(q, '/')) != NULL || *q) { 220 if (r != NULL) 221 *r = 0; 222 if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE || 223 (parent != NULL && strlen(parent->path) >= 224 MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) { 225 rs_free(p); 226 return (NULL); 227 } 228 anchor = (struct pf_anchor *)rs_malloc(sizeof(*anchor)); 229 if (anchor == NULL) { 230 rs_free(p); 231 return (NULL); 232 } 233 memset(anchor, 0, sizeof(*anchor)); 234 RB_INIT(&anchor->children); 235 strlcpy(anchor->name, q, sizeof(anchor->name)); 236 if (parent != NULL) { 237 strlcpy(anchor->path, parent->path, 238 sizeof(anchor->path)); 239 strlcat(anchor->path, "/", sizeof(anchor->path)); 240 } 241 strlcat(anchor->path, anchor->name, sizeof(anchor->path)); 242 if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) != 243 NULL) { 244 printf("pf_find_or_create_ruleset: RB_INSERT1 " 245 "'%s' '%s' collides with '%s' '%s'\n", 246 anchor->path, anchor->name, dup->path, dup->name); 247 rs_free(anchor); 248 rs_free(p); 249 return (NULL); 250 } 251 if (parent != NULL) { 252 anchor->parent = parent; 253 if ((dup = RB_INSERT(pf_anchor_node, &parent->children, 254 anchor)) != NULL) { 255 printf("pf_find_or_create_ruleset: " 256 "RB_INSERT2 '%s' '%s' collides with " 257 "'%s' '%s'\n", anchor->path, anchor->name, 258 dup->path, dup->name); 259 RB_REMOVE(pf_anchor_global, &pf_anchors, 260 anchor); 261 rs_free(anchor); 262 rs_free(p); 263 return (NULL); 264 } 265 } 266 pf_init_ruleset(&anchor->ruleset); 267 anchor->ruleset.anchor = anchor; 268 parent = anchor; 269 if (r != NULL) 270 q = r + 1; 271 else 272 *q = 0; 273 } 274 rs_free(p); 275 return (&anchor->ruleset); 276 } 277 278 void 279 pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset) 280 { 281 struct pf_anchor *parent; 282 int i; 283 284 while (ruleset != NULL) { 285 if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL || 286 !RB_EMPTY(&ruleset->anchor->children) || 287 ruleset->anchor->refcnt > 0 || ruleset->tables > 0 || 288 ruleset->topen) 289 return; 290 for (i = 0; i < PF_RULESET_MAX; ++i) 291 if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) || 292 !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) || 293 ruleset->rules[i].inactive.open) 294 return; 295 RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor); 296 if ((parent = ruleset->anchor->parent) != NULL) 297 RB_REMOVE(pf_anchor_node, &parent->children, 298 ruleset->anchor); 299 rs_free(ruleset->anchor); 300 if (parent == NULL) 301 return; 302 ruleset = &parent->ruleset; 303 } 304 } 305 306 int 307 pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s, 308 const char *name) 309 { 310 char *p, *path; 311 struct pf_ruleset *ruleset; 312 313 r->anchor = NULL; 314 r->anchor_relative = 0; 315 r->anchor_wildcard = 0; 316 if (!name[0]) 317 return (0); 318 path = (char *)rs_malloc(MAXPATHLEN); 319 bzero(path, MAXPATHLEN); 320 if (name[0] == '/') 321 strlcpy(path, name + 1, MAXPATHLEN); 322 else { 323 /* relative path */ 324 r->anchor_relative = 1; 325 if (s->anchor == NULL || !s->anchor->path[0]) 326 path[0] = 0; 327 else 328 strlcpy(path, s->anchor->path, MAXPATHLEN); 329 while (name[0] == '.' && name[1] == '.' && name[2] == '/') { 330 if (!path[0]) { 331 printf("pf_anchor_setup: .. beyond root\n"); 332 rs_free(path); 333 return (1); 334 } 335 if ((p = strrchr(path, '/')) != NULL) 336 *p = 0; 337 else 338 path[0] = 0; 339 r->anchor_relative++; 340 name += 3; 341 } 342 if (path[0]) 343 strlcat(path, "/", MAXPATHLEN); 344 strlcat(path, name, MAXPATHLEN); 345 } 346 if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) { 347 r->anchor_wildcard = 1; 348 *p = 0; 349 } 350 ruleset = pf_find_or_create_ruleset(path); 351 rs_free(path); 352 if (ruleset == NULL || ruleset->anchor == NULL) { 353 printf("pf_anchor_setup: ruleset\n"); 354 return (1); 355 } 356 r->anchor = ruleset->anchor; 357 r->anchor->refcnt++; 358 return (0); 359 } 360 361 int 362 pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r, 363 struct pfioc_rule *pr) 364 { 365 pr->anchor_call[0] = 0; 366 if (r->anchor == NULL) 367 return (0); 368 if (!r->anchor_relative) { 369 strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call)); 370 strlcat(pr->anchor_call, r->anchor->path, 371 sizeof(pr->anchor_call)); 372 } else { 373 char *a, *p; 374 int i; 375 376 a = (char *)rs_malloc(MAXPATHLEN); 377 bzero(a, MAXPATHLEN); 378 if (rs->anchor == NULL) 379 a[0] = 0; 380 else 381 strlcpy(a, rs->anchor->path, MAXPATHLEN); 382 for (i = 1; i < r->anchor_relative; ++i) { 383 if ((p = strrchr(a, '/')) == NULL) 384 p = a; 385 *p = 0; 386 strlcat(pr->anchor_call, "../", 387 sizeof(pr->anchor_call)); 388 } 389 if (strncmp(a, r->anchor->path, strlen(a))) { 390 printf("pf_anchor_copyout: '%s' '%s'\n", a, 391 r->anchor->path); 392 rs_free(a); 393 return (1); 394 } 395 if (strlen(r->anchor->path) > strlen(a)) 396 strlcat(pr->anchor_call, r->anchor->path + (a[0] ? 397 strlen(a) + 1 : 0), sizeof(pr->anchor_call)); 398 rs_free(a); 399 } 400 if (r->anchor_wildcard) 401 strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*", 402 sizeof(pr->anchor_call)); 403 return (0); 404 } 405 406 void 407 pf_anchor_remove(struct pf_rule *r) 408 { 409 if (r->anchor == NULL) 410 return; 411 if (r->anchor->refcnt <= 0) { 412 printf("pf_anchor_remove: broken refcount\n"); 413 r->anchor = NULL; 414 return; 415 } 416 if (!--r->anchor->refcnt) 417 pf_remove_if_empty_ruleset(&r->anchor->ruleset); 418 r->anchor = NULL; 419 } 420