usr.sbin/pfctl/pfctl_radix.c

   1 /*      $OpenBSD: pfctl_radix.c,v 1.27 2005/05/21 21:03:58 henning Exp $ */
   2
   3 /*
   4  * Copyright (c) 2002 Cedric Berger
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  *    - Redistributions of source code must retain the above copyright
  12  *      notice, this list of conditions and the following disclaimer.
  13  *    - Redistributions in binary form must reproduce the above
  14  *      copyright notice, this list of conditions and the following
  15  *      disclaimer in the documentation and/or other materials provided
  16  *      with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  21  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  22  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  24  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  25  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  26  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  28  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  29  * POSSIBILITY OF SUCH DAMAGE.
  30  *
  31  */
  32
  33 #include <sys/types.h>
  34 #include <sys/ioctl.h>
  35 #include <sys/socket.h>
  36
  37 #include <net/if.h>
  38 #include <net/pf/pfvar.h>
  39
  40 #include <errno.h>
  41 #include <string.h>
  42 #include <ctype.h>
  43 #include <stdio.h>
  44 #include <stdlib.h>
  45 #include <limits.h>
  46 #include <err.h>
  47
  48 #include "pfctl.h"
  49
  50 #define BUF_SIZE 256
  51
  52 extern int dev_fd;
  53
  54 static int       pfr_next_token(char buf[], FILE *);
  55
  56
  57 int
  58 pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
  59 {
  60         struct pfioc_table io;
  61
  62         bzero(&io, sizeof io);
  63         io.pfrio_flags = flags;
  64         if (filter != NULL)
  65                 io.pfrio_table = *filter;
  66         if (ioctl(dev_fd, DIOCRCLRTABLES, &io))
  67                 return (-1);
  68         if (ndel != NULL)
  69                 *ndel = io.pfrio_ndel;
  70         return (0);
  71 }
  72
  73 int
  74 pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
  75 {
  76         struct pfioc_table io;
  77
  78         if (size < 0 || (size && tbl == NULL)) {
  79                 errno = EINVAL;
  80                 return (-1);
  81         }
  82         bzero(&io, sizeof io);
  83         io.pfrio_flags = flags;
  84         io.pfrio_buffer = tbl;
  85         io.pfrio_esize = sizeof(*tbl);
  86         io.pfrio_size = size;
  87         if (ioctl(dev_fd, DIOCRADDTABLES, &io))
  88                 return (-1);
  89         if (nadd != NULL)
  90                 *nadd = io.pfrio_nadd;
  91         return (0);
  92 }
  93
  94 int
  95 pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
  96 {
  97         struct pfioc_table io;
  98
  99         if (size < 0 || (size && tbl == NULL)) {
 100                 errno = EINVAL;
 101                 return (-1);
 102         }
 103         bzero(&io, sizeof io);
 104         io.pfrio_flags = flags;
 105         io.pfrio_buffer = tbl;
 106         io.pfrio_esize = sizeof(*tbl);
 107         io.pfrio_size = size;
 108         if (ioctl(dev_fd, DIOCRDELTABLES, &io))
 109                 return (-1);
 110         if (ndel != NULL)
 111                 *ndel = io.pfrio_ndel;
 112         return (0);
 113 }
 114
 115 int
 116 pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
 117         int flags)
 118 {
 119         struct pfioc_table io;
 120
 121         if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
 122                 errno = EINVAL;
 123                 return (-1);
 124         }
 125         bzero(&io, sizeof io);
 126         io.pfrio_flags = flags;
 127         if (filter != NULL)
 128                 io.pfrio_table = *filter;
 129         io.pfrio_buffer = tbl;
 130         io.pfrio_esize = sizeof(*tbl);
 131         io.pfrio_size = *size;
 132         if (ioctl(dev_fd, DIOCRGETTABLES, &io))
 133                 return (-1);
 134         *size = io.pfrio_size;
 135         return (0);
 136 }
 137
 138 int
 139 pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
 140         int flags)
 141 {
 142         struct pfioc_table io;
 143
 144         if (size == NULL || *size < 0 || (*size && tbl == NULL)) {
 145                 errno = EINVAL;
 146                 return (-1);
 147         }
 148         bzero(&io, sizeof io);
 149         io.pfrio_flags = flags;
 150         if (filter != NULL)
 151                 io.pfrio_table = *filter;
 152         io.pfrio_buffer = tbl;
 153         io.pfrio_esize = sizeof(*tbl);
 154         io.pfrio_size = *size;
 155         if (ioctl(dev_fd, DIOCRGETTSTATS, &io))
 156                 return (-1);
 157         *size = io.pfrio_size;
 158         return (0);
 159 }
 160
 161 int
 162 pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
 163 {
 164         struct pfioc_table io;
 165
 166         if (tbl == NULL) {
 167                 errno = EINVAL;
 168                 return (-1);
 169         }
 170         bzero(&io, sizeof io);
 171         io.pfrio_flags = flags;
 172         io.pfrio_table = *tbl;
 173         if (ioctl(dev_fd, DIOCRCLRADDRS, &io))
 174                 return (-1);
 175         if (ndel != NULL)
 176                 *ndel = io.pfrio_ndel;
 177         return (0);
 178 }
 179
 180 int
 181 pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 182     int *nadd, int flags)
 183 {
 184         struct pfioc_table io;
 185
 186         if (tbl == NULL || size < 0 || (size && addr == NULL)) {
 187                 errno = EINVAL;
 188                 return (-1);
 189         }
 190         bzero(&io, sizeof io);
 191         io.pfrio_flags = flags;
 192         io.pfrio_table = *tbl;
 193         io.pfrio_buffer = addr;
 194         io.pfrio_esize = sizeof(*addr);
 195         io.pfrio_size = size;
 196         if (ioctl(dev_fd, DIOCRADDADDRS, &io))
 197                 return (-1);
 198         if (nadd != NULL)
 199                 *nadd = io.pfrio_nadd;
 200         return (0);
 201 }
 202
 203 int
 204 pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 205     int *ndel, int flags)
 206 {
 207         struct pfioc_table io;
 208
 209         if (tbl == NULL || size < 0 || (size && addr == NULL)) {
 210                 errno = EINVAL;
 211                 return (-1);
 212         }
 213         bzero(&io, sizeof io);
 214         io.pfrio_flags = flags;
 215         io.pfrio_table = *tbl;
 216         io.pfrio_buffer = addr;
 217         io.pfrio_esize = sizeof(*addr);
 218         io.pfrio_size = size;
 219         if (ioctl(dev_fd, DIOCRDELADDRS, &io))
 220                 return (-1);
 221         if (ndel != NULL)
 222                 *ndel = io.pfrio_ndel;
 223         return (0);
 224 }
 225
 226 int
 227 pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 228     int *size2, int *nadd, int *ndel, int *nchange, int flags)
 229 {
 230         struct pfioc_table io;
 231
 232         if (tbl == NULL || size < 0 || (size && addr == NULL)) {
 233                 errno = EINVAL;
 234                 return (-1);
 235         }
 236         bzero(&io, sizeof io);
 237         io.pfrio_flags = flags;
 238         io.pfrio_table = *tbl;
 239         io.pfrio_buffer = addr;
 240         io.pfrio_esize = sizeof(*addr);
 241         io.pfrio_size = size;
 242         io.pfrio_size2 = (size2 != NULL) ? *size2 : 0;
 243         if (ioctl(dev_fd, DIOCRSETADDRS, &io))
 244                 return (-1);
 245         if (nadd != NULL)
 246                 *nadd = io.pfrio_nadd;
 247         if (ndel != NULL)
 248                 *ndel = io.pfrio_ndel;
 249         if (nchange != NULL)
 250                 *nchange = io.pfrio_nchange;
 251         if (size2 != NULL)
 252                 *size2 = io.pfrio_size2;
 253         return (0);
 254 }
 255
 256 int
 257 pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
 258     int flags)
 259 {
 260         struct pfioc_table io;
 261
 262         if (tbl == NULL || size == NULL || *size < 0 ||
 263             (*size && addr == NULL)) {
 264                 errno = EINVAL;
 265                 return (-1);
 266         }
 267         bzero(&io, sizeof io);
 268         io.pfrio_flags = flags;
 269         io.pfrio_table = *tbl;
 270         io.pfrio_buffer = addr;
 271         io.pfrio_esize = sizeof(*addr);
 272         io.pfrio_size = *size;
 273         if (ioctl(dev_fd, DIOCRGETADDRS, &io))
 274                 return (-1);
 275         *size = io.pfrio_size;
 276         return (0);
 277 }
 278
 279 int
 280 pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
 281     int flags)
 282 {
 283         struct pfioc_table io;
 284
 285         if (tbl == NULL || size == NULL || *size < 0 ||
 286             (*size && addr == NULL)) {
 287                 errno = EINVAL;
 288                 return (-1);
 289         }
 290         bzero(&io, sizeof io);
 291         io.pfrio_flags = flags;
 292         io.pfrio_table = *tbl;
 293         io.pfrio_buffer = addr;
 294         io.pfrio_esize = sizeof(*addr);
 295         io.pfrio_size = *size;
 296         if (ioctl(dev_fd, DIOCRGETASTATS, &io))
 297                 return (-1);
 298         *size = io.pfrio_size;
 299         return (0);
 300 }
 301
 302 int
 303 pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 304     int *nzero, int flags)
 305 {
 306         struct pfioc_table io;
 307
 308         if (tbl == NULL || size < 0 || (size && addr == NULL)) {
 309                 errno = EINVAL;
 310                 return (-1);
 311         }
 312         bzero(&io, sizeof io);
 313         io.pfrio_flags = flags;
 314         io.pfrio_table = *tbl;
 315         io.pfrio_buffer = addr;
 316         io.pfrio_esize = sizeof(*addr);
 317         io.pfrio_size = size;
 318         if (ioctl(dev_fd, DIOCRCLRASTATS, &io))
 319                 return (-1);
 320         if (nzero != NULL)
 321                 *nzero = io.pfrio_nzero;
 322         return (0);
 323 }
 324
 325 int
 326 pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
 327 {
 328         struct pfioc_table io;
 329
 330         if (size < 0 || (size && !tbl)) {
 331                 errno = EINVAL;
 332                 return (-1);
 333         }
 334         bzero(&io, sizeof io);
 335         io.pfrio_flags = flags;
 336         io.pfrio_buffer = tbl;
 337         io.pfrio_esize = sizeof(*tbl);
 338         io.pfrio_size = size;
 339         if (ioctl(dev_fd, DIOCRCLRTSTATS, &io))
 340                 return (-1);
 341         if (nzero)
 342                 *nzero = io.pfrio_nzero;
 343         return (0);
 344 }
 345
 346 int
 347 pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
 348     int *nchange, int *ndel, int flags)
 349 {
 350         struct pfioc_table io;
 351
 352         if (size < 0 || (size && !tbl)) {
 353                 errno = EINVAL;
 354                 return (-1);
 355         }
 356         bzero(&io, sizeof io);
 357         io.pfrio_flags = flags;
 358         io.pfrio_buffer = tbl;
 359         io.pfrio_esize = sizeof(*tbl);
 360         io.pfrio_size = size;
 361         io.pfrio_setflag = setflag;
 362         io.pfrio_clrflag = clrflag;
 363         if (ioctl(dev_fd, DIOCRSETTFLAGS, &io))
 364                 return (-1);
 365         if (nchange)
 366                 *nchange = io.pfrio_nchange;
 367         if (ndel)
 368                 *ndel = io.pfrio_ndel;
 369         return (0);
 370 }
 371
 372 int
 373 pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 374     int *nmatch, int flags)
 375 {
 376         struct pfioc_table io;
 377
 378         if (tbl == NULL || size < 0 || (size && addr == NULL)) {
 379                 errno = EINVAL;
 380                 return (-1);
 381         }
 382         bzero(&io, sizeof io);
 383         io.pfrio_flags = flags;
 384         io.pfrio_table = *tbl;
 385         io.pfrio_buffer = addr;
 386         io.pfrio_esize = sizeof(*addr);
 387         io.pfrio_size = size;
 388         if (ioctl(dev_fd, DIOCRTSTADDRS, &io))
 389                 return (-1);
 390         if (nmatch)
 391                 *nmatch = io.pfrio_nmatch;
 392         return (0);
 393 }
 394
 395 int
 396 pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
 397     int *nadd, int *naddr, int ticket, int flags)
 398 {
 399         struct pfioc_table io;
 400
 401         if (tbl == NULL || size < 0 || (size && addr == NULL)) {
 402                 errno = EINVAL;
 403                 return (-1);
 404         }
 405         bzero(&io, sizeof io);
 406         io.pfrio_flags = flags;
 407         io.pfrio_table = *tbl;
 408         io.pfrio_buffer = addr;
 409         io.pfrio_esize = sizeof(*addr);
 410         io.pfrio_size = size;
 411         io.pfrio_ticket = ticket;
 412         if (ioctl(dev_fd, DIOCRINADEFINE, &io))
 413                 return (-1);
 414         if (nadd != NULL)
 415                 *nadd = io.pfrio_nadd;
 416         if (naddr != NULL)
 417                 *naddr = io.pfrio_naddr;
 418         return (0);
 419 }
 420
 421 /* interface management code */
 422
 423 int
 424 pfi_get_ifaces(const char *filter, struct pfi_kif *buf, int *size)
 425 {
 426         struct pfioc_iface io;
 427
 428         if (size == NULL || *size < 0 || (*size && buf == NULL)) {
 429                 errno = EINVAL;
 430                 return (-1);
 431         }
 432         bzero(&io, sizeof io);
 433         if (filter != NULL)
 434                 if (strlcpy(io.pfiio_name, filter, sizeof(io.pfiio_name)) >=
 435                     sizeof(io.pfiio_name)) {
 436                         errno = EINVAL;
 437                         return (-1);
 438                 }
 439         io.pfiio_buffer = buf;
 440         io.pfiio_esize = sizeof(*buf);
 441         io.pfiio_size = *size;
 442         if (ioctl(dev_fd, DIOCIGETIFACES, &io))
 443                 return (-1);
 444         *size = io.pfiio_size;
 445         return (0);
 446 }
 447
 448 /* buffer management code */
 449
 450 size_t buf_esize[PFRB_MAX] = { 0,
 451         sizeof(struct pfr_table), sizeof(struct pfr_tstats),
 452         sizeof(struct pfr_addr), sizeof(struct pfr_astats),
 453         sizeof(struct pfi_kif), sizeof(struct pfioc_trans_e)
 454 };
 455
 456 /*
 457  * add one element to the buffer
 458  */
 459 int
 460 pfr_buf_add(struct pfr_buffer *b, const void *e)
 461 {
 462         size_t bs;
 463
 464         if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX ||
 465             e == NULL) {
 466                 errno = EINVAL;
 467                 return (-1);
 468         }
 469         bs = buf_esize[b->pfrb_type];
 470         if (b->pfrb_size == b->pfrb_msize)
 471                 if (pfr_buf_grow(b, 0))
 472                         return (-1);
 473         memcpy(((caddr_t)b->pfrb_caddr) + bs * b->pfrb_size, e, bs);
 474         b->pfrb_size++;
 475         return (0);
 476 }
 477
 478 /*
 479  * return next element of the buffer (or first one if prev is NULL)
 480  * see PFRB_FOREACH macro
 481  */
 482 const void *
 483 pfr_buf_next(struct pfr_buffer *b, const void *prev)
 484 {
 485         size_t bs;
 486
 487         if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX)
 488                 return (NULL);
 489         if (b->pfrb_size == 0)
 490                 return (NULL);
 491         if (prev == NULL)
 492                 return (b->pfrb_caddr);
 493         bs = buf_esize[b->pfrb_type];
 494         if ((((c_caddr_t)prev)-((c_caddr_t)b->pfrb_caddr)) / bs + 1 >=
 495             (size_t)b->pfrb_size)
 496                 return (NULL);
 497         return (((c_caddr_t)prev) + bs);
 498 }
 499
 500 /*
 501  * minsize:
 502  *    0: make the buffer somewhat bigger
 503  *    n: make room for "n" entries in the buffer
 504  */
 505 int
 506 pfr_buf_grow(struct pfr_buffer *b, int minsize)
 507 {
 508         caddr_t p;
 509         size_t bs;
 510
 511         if (b == NULL || b->pfrb_type <= 0 || b->pfrb_type >= PFRB_MAX) {
 512                 errno = EINVAL;
 513                 return (-1);
 514         }
 515         if (minsize != 0 && minsize <= b->pfrb_msize)
 516                 return (0);
 517         bs = buf_esize[b->pfrb_type];
 518         if (!b->pfrb_msize) {
 519                 if (minsize < 64)
 520                         minsize = 64;
 521                 b->pfrb_caddr = calloc(bs, minsize);
 522                 if (b->pfrb_caddr == NULL)
 523                         return (-1);
 524                 b->pfrb_msize = minsize;
 525         } else {
 526                 if (minsize == 0)
 527                         minsize = b->pfrb_msize * 2;
 528                 if (minsize < 0 || (size_t)minsize >= SIZE_T_MAX / bs) {
 529                         /* msize overflow */
 530                         errno = ENOMEM;
 531                         return (-1);
 532                 }
 533                 p = realloc(b->pfrb_caddr, minsize * bs);
 534                 if (p == NULL)
 535                         return (-1);
 536                 bzero(p + b->pfrb_msize * bs, (minsize - b->pfrb_msize) * bs);
 537                 b->pfrb_caddr = p;
 538                 b->pfrb_msize = minsize;
 539         }
 540         return (0);
 541 }
 542
 543 /*
 544  * reset buffer and free memory.
 545  */
 546 void
 547 pfr_buf_clear(struct pfr_buffer *b)
 548 {
 549         if (b == NULL)
 550                 return;
 551         if (b->pfrb_caddr != NULL)
 552                 free(b->pfrb_caddr);
 553         b->pfrb_caddr = NULL;
 554         b->pfrb_size = b->pfrb_msize = 0;
 555 }
 556
 557 int
 558 pfr_buf_load(struct pfr_buffer *b, char *file, int nonetwork,
 559     int (*append_addr)(struct pfr_buffer *, char *, int))
 560 {
 561         FILE    *fp;
 562         char     buf[BUF_SIZE];
 563         int      rv;
 564
 565         if (file == NULL)
 566                 return (0);
 567         if (!strcmp(file, "-"))
 568                 fp = stdin;
 569         else {
 570                 fp = pfctl_fopen(file, "r");
 571                 if (fp == NULL)
 572                         return (-1);
 573         }
 574         while ((rv = pfr_next_token(buf, fp)) == 1)
 575                 if (append_addr(b, buf, nonetwork)) {
 576                         rv = -1;
 577                         break;
 578                 }
 579         if (fp != stdin)
 580                 fclose(fp);
 581         return (rv);
 582 }
 583
 584 int
 585 pfr_next_token(char buf[BUF_SIZE], FILE *fp)
 586 {
 587         static char     next_ch = ' ';
 588         int             i = 0;
 589
 590         for (;;) {
 591                 /* skip spaces */
 592                 while (isspace(next_ch) && !feof(fp))
 593                         next_ch = fgetc(fp);
 594                 /* remove from '#' until end of line */
 595                 if (next_ch == '#')
 596                         while (!feof(fp)) {
 597                                 next_ch = fgetc(fp);
 598                                 if (next_ch == '\n')
 599                                         break;
 600                         }
 601                 else
 602                         break;
 603         }
 604         if (feof(fp)) {
 605                 next_ch = ' ';
 606                 return (0);
 607         }
 608         do {
 609                 if (i < BUF_SIZE)
 610                         buf[i++] = next_ch;
 611                 next_ch = fgetc(fp);
 612         } while (!feof(fp) && !isspace(next_ch));
 613         if (i >= BUF_SIZE) {
 614                 errno = EINVAL;
 615                 return (-1);
 616         }
 617         buf[i] = '\0';
 618         return (1);
 619 }
 620
 621 const char *
 622 pfr_strerror(int errnum)
 623 {
 624         switch (errnum) {
 625         case ESRCH:
 626                 return "Table does not exist";
 627         case ENOENT:
 628                 return "Anchor or Ruleset does not exist";
 629         default:
 630                 return strerror(errnum);
 631         }
 632 }