M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl
- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer handling with NF_STOLEN + re-injection (documented divergence: re-entry) - pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback - pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires under the write lock — observed as full-VM network hang) - tools: static pfctl link for musl VMs
This commit is contained in:
lgcosta committed
1 parent
0119e70960
commit
5323ee2c71
49 files changed
+20028
-28
No files matched your search
@@ -0,0 +1,28 @@
|
||||
/* PFLINUX: <md5.h> — userland copy of OpenBSD 8.0 <sys/crypto/md5.h>
|
||||
* (from _vendor/upstream/sys/crypto/md5.h) with the kernel-only
|
||||
* __bounded__ attribute annotations dropped (glibc sys/cdefs.h has no
|
||||
* __bounded__) and <sys/types.h> added. Algorithm and constants are
|
||||
* unchanged; PF_MD5_DIGEST_LENGTH checks in pfvar.h rely on
|
||||
* MD5_DIGEST_LENGTH == 16. */
|
||||
#ifndef _MD5_H_
|
||||
#define _MD5_H_
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#define MD5_BLOCK_LENGTH 64
|
||||
#define MD5_DIGEST_LENGTH 16
|
||||
|
||||
typedef struct MD5Context {
|
||||
u_int32_t state[4]; /* state */
|
||||
u_int64_t count; /* number of bits, mod 2^64 */
|
||||
u_int8_t buffer[MD5_BLOCK_LENGTH]; /* input buffer */
|
||||
} MD5_CTX;
|
||||
|
||||
__BEGIN_DECLS
|
||||
void MD5Init(MD5_CTX *);
|
||||
void MD5Update(MD5_CTX *, const void *, size_t);
|
||||
void MD5Final(u_int8_t [MD5_DIGEST_LENGTH], MD5_CTX *);
|
||||
void MD5Transform(u_int32_t [4], const u_int8_t [MD5_BLOCK_LENGTH]);
|
||||
__END_DECLS
|
||||
|
||||
#endif /* _MD5_H_ */
|
||||
@@ -0,0 +1,54 @@
|
||||
/* PFLINUX: <net/if.h> — glibc's <net/if.h> plus OpenBSD's interface-group
|
||||
* ABI (sys/sockio.h) used by pfctl_parser.c (ifa_exists/ifa_grouplookup).
|
||||
* Linux has no interface groups: SIOCGIFGMEMB keeps the OpenBSD encoding
|
||||
* (it is computed with our OpenBSD _IOWR) and every use of it on an AF_INET
|
||||
* socket returns ENOTTY, so group lookups degrade to "not a group" exactly
|
||||
* like on an OpenBSD without the group. */
|
||||
#ifndef _PFLINUX_NET_IF_H
|
||||
#define _PFLINUX_NET_IF_H
|
||||
|
||||
#include_next <net/if.h>
|
||||
|
||||
#include <sys/ioctl.h>
|
||||
#include <sys/types.h>
|
||||
|
||||
#ifndef IFNAMSIZ
|
||||
#define IFNAMSIZ IF_NAMESIZE
|
||||
#endif
|
||||
|
||||
#define IFG_ALL "all" /* group contains all interfaces */
|
||||
#define IFG_EGRESS "egress" /* if(s) default route(s) point to */
|
||||
|
||||
struct ifg_req {
|
||||
union {
|
||||
char ifgrqu_group[IFNAMSIZ];
|
||||
char ifgrqu_member[IFNAMSIZ];
|
||||
} ifgrq_ifgrqu;
|
||||
#define ifgrq_group ifgrq_ifgrqu.ifgrqu_group
|
||||
#define ifgrq_member ifgrq_ifgrqu.ifgrqu_member
|
||||
};
|
||||
|
||||
struct ifgroupreq {
|
||||
char ifgr_name[IFNAMSIZ];
|
||||
u_int ifgr_len;
|
||||
union {
|
||||
char ifgru_group[IFNAMSIZ];
|
||||
struct ifg_req *ifgru_groups;
|
||||
} ifgr_ifgru;
|
||||
#define ifgr_group ifgr_ifgru.ifgru_group
|
||||
#define ifgr_groups ifgr_ifgru.ifgru_groups
|
||||
};
|
||||
|
||||
#ifndef SIOCGIFGMEMB
|
||||
#define SIOCGIFGMEMB _IOWR('i', 138, struct ifgroupreq) /* OpenBSD value */
|
||||
#endif
|
||||
|
||||
/* PFLINUX: OpenBSD if.h queue-priority range (parse.y `prio` check) */
|
||||
#ifndef IFQ_NQUEUES
|
||||
#define IFQ_NQUEUES 8
|
||||
#endif
|
||||
#ifndef IFQ_MAXPRIO
|
||||
#define IFQ_MAXPRIO (IFQ_NQUEUES - 1)
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_NET_IF_H */
|
||||
@@ -0,0 +1,30 @@
|
||||
/* PFLINUX: <net/if_dl.h> — BSD link-layer address. Linux has no AF_LINK;
|
||||
* getifaddrs() reports link-layer addresses as AF_PACKET/struct sockaddr_ll.
|
||||
* We therefore define AF_LINK as AF_PACKET and lay struct sockaddr_dl out
|
||||
* exactly like struct sockaddr_ll, so pfctl_parser.c's
|
||||
* ((struct sockaddr_dl *)ifa->ifa_addr)->sdl_index finds sll_ifindex.
|
||||
* Everything stays userland-internal: af values tagged AF_LINK never cross
|
||||
* /dev/pf (rules carry ifname strings, not sockaddr families). */
|
||||
#ifndef _PFLINUX_NET_IF_DL_H
|
||||
#define _PFLINUX_NET_IF_DL_H
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/socket.h>
|
||||
|
||||
#ifndef AF_LINK
|
||||
#define AF_LINK AF_PACKET /* PFLINUX mapping, see header note */
|
||||
#endif
|
||||
|
||||
struct sockaddr_dl {
|
||||
sa_family_t sdl_family; /* sll_family (offset 0) */
|
||||
u_short sdl_protocol; /* sll_protocol (offset 2) */
|
||||
int sdl_index; /* sll_ifindex (offset 4) */
|
||||
u_short sdl_type; /* sll_hatype (offset 8) */
|
||||
u_char sdl_pkttype; /* sll_pkttype (offset 10) */
|
||||
u_char sdl_alen; /* sll_halen (offset 11) */
|
||||
u_char sdl_data[8]; /* sll_addr (offset 12) */
|
||||
};
|
||||
|
||||
#define LLADDR(s) ((caddr_t *)((s)->sdl_data))
|
||||
|
||||
#endif /* _PFLINUX_NET_IF_DL_H */
|
||||
@@ -0,0 +1,32 @@
|
||||
/* PFLINUX: <net/route.h> — the userland-visible subset of OpenBSD's
|
||||
* <net/route.h>/<sys/socket.h> routing constants that net/pfvar.h
|
||||
* (RTLABEL_LEN) and parse.y (CTL_NET route lookups) rely on. Linux'
|
||||
* glibc <net/route.h> carries only struct rtentry/ioctls, so this shim
|
||||
* shadows it. Values copied from OpenBSD 8.0 sys/sys/socket.h and
|
||||
* sys/net/route.h; RT_TABLEID_MAX matches module/include/pfk.h (32),
|
||||
* the routing-domain ceiling our pf.ko implements. */
|
||||
#ifndef _PFLINUX_NET_ROUTE_H
|
||||
#define _PFLINUX_NET_ROUTE_H
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
/* PFLINUX: AF_ROUTE/PF_ROUTE (== 17) come from glibc <sys/socket.h>
|
||||
* unmodified; only the routing-table constants pfvar.h/parse.y need
|
||||
* live here. */
|
||||
|
||||
#define NET_RT_DUMP 1
|
||||
#define NET_RT_FLAGS 2
|
||||
#define NET_RT_IFLIST 3
|
||||
#define NET_RT_TABLE 5
|
||||
|
||||
#define RTLABEL_LEN 32
|
||||
#define RT_TABLEID_MAX 32 /* keep in sync with module/include/pfk.h */
|
||||
|
||||
struct rt_tableinfo {
|
||||
u_short rti_tableid; /* routing table id */
|
||||
u_short rti_domainid; /* routing domain id */
|
||||
};
|
||||
|
||||
struct rtentry; /* only referenced via pointers/prototypes */
|
||||
|
||||
#endif /* _PFLINUX_NET_ROUTE_H */
|
||||
@@ -0,0 +1,56 @@
|
||||
/* PFLINUX: shadow <netinet/icmp6.h> — glibc's copy lacks the MLD/nodeinfo
|
||||
* and ND redirect-code constants pfctl_parser.c's icmp6-type keyword
|
||||
* table references. Values copied verbatim from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/icmp6.h (OpenBSD 8.0). */
|
||||
#ifndef _PFLINUX_NETINET_ICMP6_H
|
||||
#define _PFLINUX_NETINET_ICMP6_H
|
||||
|
||||
#include_next <netinet/icmp6.h>
|
||||
|
||||
#ifndef ICMP6_MEMBERSHIP_QUERY
|
||||
#define ICMP6_MEMBERSHIP_QUERY 130 /* group membership query */
|
||||
#endif
|
||||
#ifndef ICMP6_MEMBERSHIP_REPORT
|
||||
#define ICMP6_MEMBERSHIP_REPORT 131 /* group membership report */
|
||||
#endif
|
||||
#ifndef ICMP6_MEMBERSHIP_REDUCTION
|
||||
#define ICMP6_MEMBERSHIP_REDUCTION 132 /* membership termination */
|
||||
#endif
|
||||
#ifndef ICMP6_WRUREQUEST
|
||||
#define ICMP6_WRUREQUEST 139 /* who are you request */
|
||||
#endif
|
||||
#ifndef ICMP6_WRUREPLY
|
||||
#define ICMP6_WRUREPLY 140 /* who are you reply */
|
||||
#endif
|
||||
#ifndef ICMP6_FQDN_QUERY
|
||||
#define ICMP6_FQDN_QUERY 139 /* FQDN query */
|
||||
#endif
|
||||
#ifndef ICMP6_FQDN_REPLY
|
||||
#define ICMP6_FQDN_REPLY 140 /* FQDN reply */
|
||||
#endif
|
||||
#ifndef ICMP6_NI_QUERY
|
||||
#define ICMP6_NI_QUERY 139 /* node information request */
|
||||
#endif
|
||||
#ifndef ICMP6_NI_REPLY
|
||||
#define ICMP6_NI_REPLY 140 /* node information reply */
|
||||
#endif
|
||||
#ifndef MLD_LISTENER_DONE
|
||||
#define MLD_LISTENER_DONE 132 /* multicast listener done */
|
||||
#endif
|
||||
#ifndef MLD_MTRACE_RESP
|
||||
#define MLD_MTRACE_RESP 200 /* mtrace resp (to sender) */
|
||||
#endif
|
||||
#ifndef MLD_MTRACE
|
||||
#define MLD_MTRACE 201 /* mtrace messages */
|
||||
#endif
|
||||
#ifndef MLDV2_LISTENER_REPORT
|
||||
#define MLDV2_LISTENER_REPORT 143 /* RFC3810 listener report */
|
||||
#endif
|
||||
#ifndef ND_REDIRECT_ONLINK
|
||||
#define ND_REDIRECT_ONLINK 0 /* redirect to on-link node */
|
||||
#endif
|
||||
#ifndef ND_REDIRECT_ROUTER
|
||||
#define ND_REDIRECT_ROUTER 1 /* redirect to better router */
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_NETINET_ICMP6_H */
|
||||
@@ -0,0 +1,44 @@
|
||||
/* PFLINUX: shadow <netinet/ip.h> — glibc's copy lacks the IPTOS_DSCP_CS*
|
||||
* class-selector codepoints parse.y's `set tos` table references (plus a
|
||||
* few neighbours); values copied verbatim from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/ip.h (OpenBSD 8.0). */
|
||||
#ifndef _PFLINUX_NETINET_IP_H
|
||||
#define _PFLINUX_NETINET_IP_H
|
||||
|
||||
#include_next <netinet/ip.h>
|
||||
|
||||
#ifndef IPTOS_DSCP_CS0
|
||||
#define IPTOS_DSCP_CS0 0x00
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_LE
|
||||
#define IPTOS_DSCP_LE 0x04
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS1
|
||||
#define IPTOS_DSCP_CS1 0x20
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS2
|
||||
#define IPTOS_DSCP_CS2 0x40
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS3
|
||||
#define IPTOS_DSCP_CS3 0x60
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS4
|
||||
#define IPTOS_DSCP_CS4 0x80
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS5
|
||||
#define IPTOS_DSCP_CS5 0xa0
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_VA
|
||||
#define IPTOS_DSCP_VA 0xb0
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_EF
|
||||
#define IPTOS_DSCP_EF 0xb8
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS6
|
||||
#define IPTOS_DSCP_CS6 0xc0
|
||||
#endif
|
||||
#ifndef IPTOS_DSCP_CS7
|
||||
#define IPTOS_DSCP_CS7 0xe0
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_NETINET_IP_H */
|
||||
@@ -0,0 +1,62 @@
|
||||
/* PFLINUX: shadow <netinet/ip_icmp.h> — glibc's copy lacks the extended
|
||||
* ICMP type/code constants pfctl_parser.c's icmp-type keyword table
|
||||
* references. Values copied verbatim from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/ip_icmp.h (OpenBSD 8.0). */
|
||||
#ifndef _PFLINUX_NETINET_IP_ICMP_H
|
||||
#define _PFLINUX_NETINET_IP_ICMP_H
|
||||
|
||||
#include_next <netinet/ip_icmp.h>
|
||||
|
||||
#ifndef ICMP_ALTHOSTADDR
|
||||
#define ICMP_ALTHOSTADDR 6 /* alternate host address */
|
||||
#endif
|
||||
#ifndef ICMP_TRACEROUTE
|
||||
#define ICMP_TRACEROUTE 30 /* traceroute */
|
||||
#endif
|
||||
#ifndef ICMP_DATACONVERR
|
||||
#define ICMP_DATACONVERR 31 /* data conversion error */
|
||||
#endif
|
||||
#ifndef ICMP_MOBILE_REDIRECT
|
||||
#define ICMP_MOBILE_REDIRECT 32 /* mobile host redirect */
|
||||
#endif
|
||||
#ifndef ICMP_IPV6_WHEREAREYOU
|
||||
#define ICMP_IPV6_WHEREAREYOU 33 /* IPv6 where-are-you */
|
||||
#endif
|
||||
#ifndef ICMP_IPV6_IAMHERE
|
||||
#define ICMP_IPV6_IAMHERE 34 /* IPv6 i-am-here */
|
||||
#endif
|
||||
#ifndef ICMP_MOBILE_REGREQUEST
|
||||
#define ICMP_MOBILE_REGREQUEST 35 /* mobile registration req */
|
||||
#endif
|
||||
#ifndef ICMP_MOBILE_REGREPLY
|
||||
#define ICMP_MOBILE_REGREPLY 36 /* mobile registration reply */
|
||||
#endif
|
||||
#ifndef ICMP_SKIP
|
||||
#define ICMP_SKIP 39 /* SKIP */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS
|
||||
#define ICMP_PHOTURIS 40 /* Photuris */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS_UNKNOWN_INDEX
|
||||
#define ICMP_PHOTURIS_UNKNOWN_INDEX 1 /* unknown sec index */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS_AUTH_FAILED
|
||||
#define ICMP_PHOTURIS_AUTH_FAILED 2 /* auth failed */
|
||||
#endif
|
||||
#ifndef ICMP_PHOTURIS_DECRYPT_FAILED
|
||||
#define ICMP_PHOTURIS_DECRYPT_FAILED 3 /* decrypt failed */
|
||||
#endif
|
||||
#ifndef ICMP_PARAMPROB_ERRATPTR
|
||||
#define ICMP_PARAMPROB_ERRATPTR 0 /* req. opt. absent */
|
||||
#endif
|
||||
#ifndef ICMP_PARAMPROB_LENGTH
|
||||
#define ICMP_PARAMPROB_LENGTH 2 /* bad length */
|
||||
#endif
|
||||
#ifndef ICMP_ROUTERADVERT_NORMAL
|
||||
#define ICMP_ROUTERADVERT_NORMAL 0 /* normal advertisement */
|
||||
#endif
|
||||
#ifndef ICMP_ROUTERADVERT_NOROUTE_COMMON
|
||||
#define ICMP_ROUTERADVERT_NOROUTE_COMMON 16 /* selective routing */
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_NETINET_IP_ICMP_H */
|
||||
@@ -0,0 +1,32 @@
|
||||
/* PFLINUX: <netinet/tcp_fsm.h> — OpenBSD 8.0 TCP state machine header
|
||||
* (glibc has no equivalent). Values copied from
|
||||
* _vendor/openbsd/obbsd/sys/netinet/tcp_fsm.h. Kernel-only bodies
|
||||
* (TCPOUTFLAGS/TCPSTATES arrays) dropped; tcpstates[] is declared extern
|
||||
* and defined in tools/compat-user/bsd.c for pf_print_state.c. */
|
||||
#ifndef _PFLINUX_NETINET_TCP_FSM_H
|
||||
#define _PFLINUX_NETINET_TCP_FSM_H
|
||||
|
||||
#define TCP_NSTATES 11
|
||||
|
||||
#define TCPS_CLOSED 0 /* closed */
|
||||
#define TCPS_LISTEN 1 /* listening for connection */
|
||||
#define TCPS_SYN_SENT 2 /* active, have sent syn */
|
||||
#define TCPS_SYN_RECEIVED 3 /* have sent and received syn */
|
||||
/* states < TCPS_ESTABLISHED are those where connections not established */
|
||||
#define TCPS_ESTABLISHED 4 /* established */
|
||||
#define TCPS_CLOSE_WAIT 5 /* rcvd fin, waiting for close */
|
||||
/* states > TCPS_CLOSE_WAIT are those where user has closed */
|
||||
#define TCPS_FIN_WAIT_1 6 /* have closed, sent fin */
|
||||
#define TCPS_CLOSING 7 /* closed xchd FIN; await FIN ACK */
|
||||
#define TCPS_LAST_ACK 8 /* had fin and close; await FIN ACK */
|
||||
/* states > TCPS_CLOSE_WAIT && < TCPS_FIN_WAIT_2 await ACK of FIN */
|
||||
#define TCPS_FIN_WAIT_2 9 /* have closed, fin is acked */
|
||||
#define TCPS_TIME_WAIT 10 /* in 2*msl quiet wait after close */
|
||||
|
||||
#define TCPS_HAVERCVDSYN(s) ((s) >= TCPS_SYN_RECEIVED)
|
||||
#define TCPS_HAVEESTABLISHED(s) ((s) >= TCPS_ESTABLISHED)
|
||||
#define TCPS_HAVERCVDFIN(s) ((s) >= TCPS_TIME_WAIT)
|
||||
|
||||
extern const char *const tcpstates[];
|
||||
|
||||
#endif /* _PFLINUX_NETINET_TCP_FSM_H */
|
||||
@@ -0,0 +1,121 @@
|
||||
/* PFLINUX: force-include prelude for the Linux build of OpenBSD 8.0 pfctl
|
||||
* (see tools/Makefile, CPPFLAGS -include). Keeps the copied pfctl sources
|
||||
* byte-identical to _vendor except for the edits listed in UPSTREAM.md. */
|
||||
#ifndef _PFLINUX_PRELUDE_H
|
||||
#define _PFLINUX_PRELUDE_H
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <sys/cdefs.h>
|
||||
#include <stddef.h> /* offsetof for sys/tree.h RBT_GENERATE */
|
||||
#include <stdint.h>
|
||||
#include <stdio.h> /* fgetln(3) declaration below */
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <strings.h> /* PFLINUX: BSD bzero/bcopy; OpenBSD <string.h>
|
||||
* exposes them, glibc keeps them in <strings.h> */
|
||||
|
||||
/* PFLINUX: resolves to tools/include/sys/ioctl.h (first -I dir), which
|
||||
* redefines _IO/_IOW/_IOR/_IOWR to the OpenBSD sys/ioccom.h encoding that
|
||||
* pf.ko expects (identical to module/include/pfk.h). */
|
||||
#include <sys/ioctl.h>
|
||||
|
||||
/* PFLINUX: BSD AF_LINK. tools/include/net/if_dl.h maps it to AF_PACKET
|
||||
* with a sockaddr_ll-compatible struct sockaddr_dl; parse.y compares
|
||||
* n->af against AF_LINK but never includes <net/if_dl.h>, so the
|
||||
* definition lives in this prelude (if_dl.h's own copy is #ifndef'd). */
|
||||
#include <sys/socket.h>
|
||||
#ifndef AF_LINK
|
||||
#define AF_LINK AF_PACKET
|
||||
#endif
|
||||
|
||||
/* OpenBSD sys/cdefs.h attribute macros that glibc does not provide. */
|
||||
#ifndef __dead
|
||||
#define __dead __attribute__((__noreturn__))
|
||||
#endif
|
||||
#ifndef __printflike
|
||||
#define __printflike(f, a) __attribute__((__format__(__printf__, f, a)))
|
||||
#endif
|
||||
/* net/pfvar.h marks pfsync structs with __packed (OpenBSD cdefs); recent
|
||||
* glibc does not define it. */
|
||||
#ifndef __packed
|
||||
#define __packed __attribute__((__packed__))
|
||||
#endif
|
||||
/* sys/tree.h's RBT_* / RB_* generator macros use __unused/__inline;
|
||||
* recent glibc sys/cdefs.h no longer provides them. */
|
||||
#ifndef __unused
|
||||
#define __unused __attribute__((__unused__))
|
||||
#endif
|
||||
#ifndef __inline
|
||||
#define __inline inline
|
||||
#endif
|
||||
/*
|
||||
* OpenBSD <sys/endian.h> also spells the byte-order helpers
|
||||
* betoh16/32/64 and letoh16/32/64 (pf_print_state.c uses betoh64);
|
||||
* glibc only has
|
||||
* beXXtoh/leXXtoh names.
|
||||
*/
|
||||
#include <endian.h>
|
||||
#ifndef betoh16
|
||||
#define betoh16(x) be16toh(x)
|
||||
#endif
|
||||
#ifndef betoh32
|
||||
#define betoh32(x) be32toh(x)
|
||||
#endif
|
||||
#ifndef betoh64
|
||||
#define betoh64(x) be64toh(x)
|
||||
#endif
|
||||
#ifndef letoh16
|
||||
#define letoh16(x) le16toh(x)
|
||||
#endif
|
||||
#ifndef letoh32
|
||||
#define letoh32(x) le32toh(x)
|
||||
#endif
|
||||
#ifndef letoh64
|
||||
#define letoh64(x) le64toh(x)
|
||||
#endif
|
||||
|
||||
/*
|
||||
* OpenBSD <sys/param.h> assignment-style host<->net byte-order helpers
|
||||
* (pfctl.c uses them). htonl/ntohl/htons/ntohs come from <netinet/in.h>
|
||||
* which the including source pulls in.
|
||||
*/
|
||||
#ifndef HTONL
|
||||
#define HTONL(x) ((x) = htonl(x))
|
||||
#endif
|
||||
#ifndef NTOL
|
||||
#define NTOL(x) ((x) = ntohl(x))
|
||||
#endif
|
||||
#ifndef HTONS
|
||||
#define HTONS(x) ((x) = htons(x))
|
||||
#endif
|
||||
#ifndef NOSH
|
||||
#define NOSH(x) ((x) = ntohs(x))
|
||||
#endif
|
||||
|
||||
/* strtonum(3) is BSD (lib/libc/stdlib/strtonum.c); glibc has none.
|
||||
* Implemented in tools/compat-user/strtonum.c. */
|
||||
long long strtonum(const char *numstr, long long minval,
|
||||
long long maxval, const char **errstrp);
|
||||
|
||||
/* pledge(2)/unveil(2) are BSD-only. The 8.0 pfctl sources do not call
|
||||
* them, but the stubs are provided (tools/compat-user/bsd.c) for future
|
||||
* upstream syncs. */
|
||||
int pledge(const char *promises, const char *paths[]);
|
||||
int unveil(const char *path, const char *permissions);
|
||||
|
||||
/* fgetln(3) is BSD stdio (pfctl_osfp.c uses it); implemented in
|
||||
* tools/compat-user/bsd.c on top of getline(3). */
|
||||
char *fgetln(FILE *stream, size_t *len);
|
||||
|
||||
/* freezero(3) is BSD stdlib (pf_ruleset.c userland branch uses it);
|
||||
* implemented in tools/compat-user/bsd.c. */
|
||||
void freezero(void *ptr, size_t siz);
|
||||
|
||||
/* uid_from_user(3)/gid_from_group(3) are BSD <pwd.h>/<grp.h> helpers
|
||||
* (parse.y `user`/`group` keywords); implemented in
|
||||
* tools/compat-user/bsd.c on getpwnam(3)/getgrnam(3). Return 0 on
|
||||
* success, non-zero with errno on failure (OpenBSD semantics). */
|
||||
int uid_from_user(const char *, uid_t *);
|
||||
int gid_from_group(const char *, gid_t *);
|
||||
|
||||
#endif /* _PFLINUX_PRELUDE_H */
|
||||
@@ -0,0 +1,14 @@
|
||||
/* PFLINUX: <sys/_null.h> — OpenBSD's NULL guard header, required by the
|
||||
* vendored <sys/queue.h> and <sys/tree.h>. */
|
||||
#ifndef _PFLINUX_SYS__NULL_H
|
||||
#define _PFLINUX_SYS__NULL_H
|
||||
|
||||
#ifndef NULL
|
||||
#ifdef __cplusplus
|
||||
#define NULL 0
|
||||
#else
|
||||
#define NULL ((void *)0)
|
||||
#endif
|
||||
#endif
|
||||
|
||||
#endif /* _PFLINUX_SYS__NULL_H */
|
||||
@@ -0,0 +1,45 @@
|
||||
/* PFLINUX: <sys/ioctl.h> — OpenBSD 8.0 ioctl encoding for userland pfctl.
|
||||
*
|
||||
* net/pfvar.h builds every DIOC* number with _IO/_IOW/_IOR/_IOWR. pf.ko
|
||||
* (see module/include/pfk.h) interprets ioctl commands using the OpenBSD
|
||||
* sys/ioccom.h bit layout, NOT Linux asm/ioctl.h, so this header must
|
||||
* reproduce pfk.h's PFKXIOC_* encoding byte-for-byte. We pull in the real
|
||||
* glibc <sys/ioctl.h> first (ioctl(2) prototype, Linux SIOC* constants used
|
||||
* by <net/if.h>) and then redefine the _IO family.
|
||||
*
|
||||
* Values copied from module/include/pfk.h lines 135-152.
|
||||
*/
|
||||
#ifndef _PFLINUX_SYS_IOCTL_H
|
||||
#define _PFLINUX_SYS_IOCTL_H
|
||||
|
||||
#include_next <sys/ioctl.h>
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
#undef _IO
|
||||
#undef _IOR
|
||||
#undef _IOW
|
||||
#undef _IOWR
|
||||
|
||||
#define PFKXIOC_NRBITS 8
|
||||
#define PFKXIOC_TYPEBITS 8
|
||||
#define PFKXIOC_SIZEBITS 13
|
||||
#define PFKXIOC_DIRBITS 2
|
||||
#define PFKXIOC_NRSHIFT 0
|
||||
#define PFKXIOC_TYPESHIFT (PFKXIOC_NRSHIFT + PFKXIOC_NRBITS)
|
||||
#define PFKXIOC_SIZESHIFT (PFKXIOC_TYPESHIFT + PFKXIOC_TYPEBITS)
|
||||
#define PFKXIOC_DIRSHIFT (PFKXIOC_SIZESHIFT + PFKXIOC_SIZEBITS + 1)
|
||||
#define PFKXIOC_NONE 0U
|
||||
#define PFKXIOC_WRITE 1U /* OpenBSD IOC_IN (copyin) */
|
||||
#define PFKXIOC_READ 2U /* OpenBSD IOC_OUT (copyout) */
|
||||
|
||||
#define PFKXIOC(dir,type,nr,size) \
|
||||
(((dir) << PFKXIOC_DIRSHIFT) | ((type) << PFKXIOC_TYPESHIFT) | \
|
||||
((nr) << PFKXIOC_NRSHIFT) | ((size) << PFKXIOC_SIZESHIFT))
|
||||
|
||||
#define _IO(t, n) PFKXIOC(PFKXIOC_NONE, (t), (n), 0)
|
||||
#define _IOWR(t, n, s) PFKXIOC(PFKXIOC_WRITE|PFKXIOC_READ, (t), (n), sizeof(s))
|
||||
#define _IOW(t, n, s) PFKXIOC(PFKXIOC_WRITE, (t), (n), sizeof(s))
|
||||
#define _IOR(t, n, s) PFKXIOC(PFKXIOC_READ, (t), (n), sizeof(s))
|
||||
|
||||
#endif /* _PFLINUX_SYS_IOCTL_H */
|
||||
@@ -0,0 +1,63 @@
|
||||
/* PFLINUX: <sys/refcnt.h> — userland twin of
|
||||
* module/include/compat/sys/refcnt.h. The kernel side is
|
||||
* `struct refcnt { refcount_t rc; }` where refcount_t wraps a single
|
||||
* atomic_t (4 bytes on Linux). Only struct pf_anchor embeds it and
|
||||
* pf_anchor never crosses /dev/pf, but size/alignment are kept equal. */
|
||||
#ifndef _PFLINUX_SYS_REFCNT_H
|
||||
#define _PFLINUX_SYS_REFCNT_H
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
struct refcnt {
|
||||
unsigned int rc;
|
||||
};
|
||||
|
||||
#define REFCNT_INITIALIZER { .rc = 1 }
|
||||
|
||||
static inline void
|
||||
refcnt_init(struct refcnt *r, unsigned int v)
|
||||
{
|
||||
r->rc = v ? v : 1;
|
||||
}
|
||||
|
||||
static inline unsigned int
|
||||
refcnt_value(const struct refcnt *r)
|
||||
{
|
||||
return (r->rc);
|
||||
}
|
||||
|
||||
static inline void
|
||||
refcnt_take(struct refcnt *r)
|
||||
{
|
||||
r->rc++;
|
||||
}
|
||||
|
||||
static inline int
|
||||
refcnt_take_not0(struct refcnt *r)
|
||||
{
|
||||
if (r->rc == 0)
|
||||
return (0);
|
||||
r->rc++;
|
||||
return (1);
|
||||
}
|
||||
|
||||
static inline unsigned int
|
||||
refcnt_rele(struct refcnt *r)
|
||||
{
|
||||
return (--r->rc);
|
||||
}
|
||||
|
||||
static inline unsigned int
|
||||
refcnt_rele_wake(struct refcnt *r)
|
||||
{
|
||||
return (refcnt_rele(r));
|
||||
}
|
||||
|
||||
static inline void
|
||||
refcnt_finalize(struct refcnt *r, const void *unused)
|
||||
{
|
||||
(void)r;
|
||||
(void)unused;
|
||||
}
|
||||
|
||||
#endif /* _PFLINUX_SYS_REFCNT_H */
|
||||
@@ -0,0 +1,28 @@
|
||||
/* PFLINUX: <sys/sysctl.h> — OpenBSD sysctl(3) surface used by pfctl.
|
||||
* Linux removed both <sys/sysctl.h> and the legacy sysctl(2) syscall; the
|
||||
* constants below mirror OpenBSD 8.0 (sys/sysctl.h) and sysctl() is
|
||||
* implemented in tools/compat-user/sysctl.c for exactly the three MIBs
|
||||
* pfctl queries. */
|
||||
#ifndef _PFLINUX_SYS_SYSCTL_H
|
||||
#define _PFLINUX_SYS_SYSCTL_H
|
||||
|
||||
#include <sys/types.h>
|
||||
#include <stddef.h>
|
||||
|
||||
#define CTL_UNSPEC 0
|
||||
#define CTL_KERN 1
|
||||
#define CTL_VM 2
|
||||
#define CTL_NET 4 /* PF_ROUTE etc. */
|
||||
#define CTL_HW 6
|
||||
|
||||
#define KERN_MAXCLUSTERS 67 /* int: mbuf cluster limit */
|
||||
#define HW_PHYSMEM64 19 /* int64_t: total RAM */
|
||||
|
||||
struct kinfo_proc; /* forward: nothing pfctl uses, avoid clash */
|
||||
|
||||
__BEGIN_DECLS
|
||||
int sysctl(const int *name, u_int namelen, void *old, size_t *oldlenp,
|
||||
const void *new, size_t newlen);
|
||||
__END_DECLS
|
||||
|
||||
#endif /* _PFLINUX_SYS_SYSCTL_H */
|
||||
@@ -0,0 +1,8 @@
|
||||
/* PFLINUX: <sys/syslimits.h> — glibc ships no such header; PATH_MAX etc.
|
||||
* live in <limits.h>. */
|
||||
#ifndef _PFLINUX_SYS_SYSLIMITS_H
|
||||
#define _PFLINUX_SYS_SYSLIMITS_H
|
||||
|
||||
#include <limits.h>
|
||||
|
||||
#endif /* _PFLINUX_SYS_SYSLIMITS_H */
|
||||
@@ -0,0 +1,18 @@
|
||||
/* PFLINUX: <sys/timeout.h> — pfvar.h embeds struct timeout by value inside
|
||||
* struct pf_pktdelay. pf_pktdelay is kernel-internal only (it never
|
||||
* appears in any ioctl payload; the kernel side uses the real
|
||||
* module/include/compat/sys/timeout.h with linux/timer.h), so userland
|
||||
* just needs the type to be complete for pfvar.h to compile. */
|
||||
#ifndef _PFLINUX_SYS_TIMEOUT_H
|
||||
#define _PFLINUX_SYS_TIMEOUT_H
|
||||
|
||||
#include <sys/types.h>
|
||||
|
||||
typedef void (timeout_fn)(void *);
|
||||
|
||||
struct timeout {
|
||||
timeout_fn *fn;
|
||||
void *arg;
|
||||
};
|
||||
|
||||
#endif /* _PFLINUX_SYS_TIMEOUT_H */
|
||||
Reference in new issue
Block a user